bus: row 237 one decision, one open publish; checkPublish refuses publish-busy while another ticket holds the decision, since it is spent only at recordPublish after the push; a broker test and a socket race test with exactly one receive-pack; BUILD.md with the option chosen, M1 and three residuals (duckworth-0068 N1, #1743 )

2026-10-20 19:31:48 -05:00
26 changed files with 132 additions and 1930 deletions
@@ -1,104 +0,0 @@
-# Row 230: C2-13a unit render and host precheck
-
-Gitea #1732. Vikunja #416 (track T2). Brief: docs/plans/2026-10-20_case2-rows.md, section "C2-13a",
-blob f6b4933f0f47 (01b40d357, sage-1562). Base: 00d4cc1f6 (row 190). Reviewer: Webby. Gate: the cli
-suite plus every scripts/test-*.sh.
-
-## What ships
-
-`scripts/case2-unit.sh` renders `[email protected]` and `mosaic-webui.service` from the two existing
-templates into the system unit directory, for the default instance only. It writes each unit through
-a temp file at mode 0644, runs `daemon-reload`, enables both units, starts the bus and then the
-Console. If the bus fails to start, the script refuses and leaves the Console unstarted. Both units
-get `WantedBy=multi-user.target`, and neither gets `After=` or `Wants=`. The script never links a unit
-file into place. A re-install refuses unless each installed unit passes the same checks, both units
-name one copy, and each equals the render apart from the copy id.
-
-`--profile library` (the default) refuses `--pm`, `--claude`, `--tester-port` and `--sso`, and needs
-the preview proxy flags plus the proof pair. `--profile factory` refuses the six proxy flags and takes
-`--pm` and `--claude`. Both refuse `--checkout` and `--board`.
-
-`scripts/case2-precheck.sh --business ID [--profile factory|library]` runs as `<user>`. It prints one
-`ok` or `REFUSED` line per check and exits 1 if any check refused. It prints variable names only,
-never values.
-
-`packages/cli/README.md:713` now says nothing creates the session env file, only the Case 2 precheck
-reads it, and the precheck prints only variable names (webby-0034 N2, webby-0035).
-
-## Deviations for review
-
-Sage accepted all six for the build (sage-1570). Webby rules on each.
-
-1. The precheck takes `--business ID`. The brief names no other way to find the business file.
-2. A run root `<dataRoot>/launches/<business>` that doesn't exist passes, with a note that the first
-   launch creates it at 0700 (session.mjs:47 and newRun). A symlink refuses, and so does an existing
-   entry that isn't a 0700 directory.
-3. The claude marker check passes when the reply holds the marker and input plus cache tokens are at
-   most 2000. **The 2000 ceiling is unmeasured.** The tests use fakes at 40 and 9000 tokens. Measuring
-   it on a real claude belongs to row 195's install run, not this row.
-4. A non-root test can't create a root-owned proof file. For the "proof not owned by the user" case,
-   the fake getent reports another uid for the user, so the user's own file reads as someone else's.
-5. The unit script refuses `%h` left in any unit, rendered or installed. A system unit expands `%h`
-   to root's home. The render replaces every `%h`, so the test edits an installed unit to reach it.
-6. With `--auth-header X-Authentik-Uid`, the allowed user must be 64 lower-case hex characters (lead
-   decision 101). The test covers both the refusal and the pass.
-
-## Tests (packages/cli/tests/case2-unit.test.mjs, 30 cases after round 2)
-
-The tests use a scratch unit directory and a scratch home, plus fake systemctl, getent, sudo, id,
-node, bwrap and claude. They never touch /etc/systemd, ~/.mosaic-dev, ~/.config/mosaic-dev or a
-live unit. Every precheck case asserts its output doesn't hold the fixture key.
-
- Unit: the clean library render, PATH for a node outside the default list and for /usr/bin/node, the
-  systemctl order, a failed bus start, no `systemctl link`, factory `--pm` and `--claude` rendered and
-  absent, re-install to another copy, edits to an installed unit, template restrictions,
-  EnvironmentFile placement, unknown tokens, PermissionsStartOnly and `+`/`-+` Exec prefixes,
-  symlinked unit paths, bad `--node`, re-install drift, a split copy pair, bad copy ids, every library
-  and factory flag refusal, and bad `--claude`.
- Precheck: a good host, node older than 24, more than one group, sudo succeeding, XDG_DATA_HOME,
-  HOME mismatch, a run root mode, a bad config, bwrap failing, the port floor at or below the Console
-  port, a missing Console unit, bus.tester per profile, profile-library-business, the claude check
-  (no route, replaces, appends, missing, the unit's MOSAIC_CLAUDE_BIN beating PATH), and the session
-  env file (missing, 0644, symlink, empty, emptied by a later line, quoted).
- Bind (mos-1100): inside `binds()` plus `sandboxArgv()`, a bind on port 980 gets EACCES, and a bind
-  on a free port of 1024 or above succeeds. The test fails if the host's floor is at or below 980.
-
-## Verification
-
-Round 1 singles, run before the gate: case2-unit.test.mjs passes 28/28 with no skips, and host.test.mjs (it
-reads the cli README) passes 42/42. No test pins a hash of the README. No other test reads the two
-scripts.
-
-## Round 2 (webby-0046, sage-1589, sage-1590, sage-1591)
-
-Base: origin/refactor (rebased from 00d4cc1f6; the 15 commits between touch none of the five paths
-or the two unit templates). Branch gosalyn/c2-13a-r2.
-
-B1. The precheck now has a case for each refusal Webby named: the user missing from passwd (:77),
-a business file that is unparsable, missing or fails the schema (:137), a run root that is a symlink
-to a 0700 directory (:151), a Console ExecStart with no --port (:179), an unreadable port floor
-(:180), a claude reply without the marker (:223) and a claude reply that isn't JSON (:224). The fake
-claude gained `nomarker` and `text` kinds. The no-claude-code case and the missing-claude case share
-a PATH without `/usr/bin/claude` (`pathWithoutClaude`), so the no-claude-code case now shows a host
-with no claude passes.
-
-N1 (ruled in for this round). Before writing, `case2-unit.sh` asks `systemctl is-active` for both
-units. For each unit that was running, it prints that the unit is still on its old copy, never
-"started", and then that the bus and Console must restart together to reach the new copy. A unit
-that wasn't running gets "started ... on copy". A fresh install prints the round 1 line. The script
-still restarts nothing. The new test covers both units running and only the Console running.
-
-N4. The README line at :713 is rewrapped.
-
-Mutants, run in Sage's slot on a scratch worktree, one branch each: :77, :137, :151, :179, :180,
-:223, :224, a precheck that refuses with no claude on PATH (for the no-claude-code case), and an
-install that prints "started" for a running unit (sage-1591).
-
-## Carry items for row 195
-
- N1's restart. Row 195 restarts the bus and Console together after a re-install over running
-  units, as the install line now asks.
- N2. A system drop-in check like `bus-service.sh:122-145`, so a drop-in under
-  `[email protected]/` or `mosaic-webui.service.d/` can't change what the checked unit runs.
- N3. The precheck finds claude on the shell PATH. The bus unit's `PATH=` is what a session uses
-  when `MOSAIC_CLAUDE_BIN` is unset, so the check should search that PATH.
@@ -1,47 +0,0 @@
-# Row 238: the sso-config hint names the instance (row 200 follow-up N1)
-
-Launchpad, 2026-10-21. Author Launchpad, reviewer Webby, gate owner Sage. Issue #1744. Brief "Brief: row 200
-follow-up N1, the sso-config hint names the instance" in `docs/plans/2026-10-20_stack-release-sso.md` (76134dfde),
-from Webby's row 200 round 3 note N1 (comment 29772), assigned in sage-1597.
-
-Base 011d41ba6 (`base.txt`), which has row 200's landing 9e1085816 below it. Built on 76134dfde, then rebased
-before the first push onto 011d41ba6, because row 199 (cb5fdb064) added 6 lines to `docs/TOOLS.md`; no
-conflict. Branch `launchpad/row238`.
-`candidate-manifest.sha256` lists the 3 changed paths; the packet files are not in it.
-
-No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, `~/.mosaic`, a live unit or a live slot. The new
-subtest runs on row 190's `named()` scratch instance under the test's temp HOME.
-
-## Files
-
-| Path | Change |
-| --- | --- |
-| `scripts/stack-release.sh` | `sso_checks`: the N4 first step puts `${INSTANCE_FLAGS[*]}` after `activate $TO` in both commands. |
-| `packages/cli/tests/stack-release.test.mjs` | T57 subtest "row 238 (#1744)": the sso-config refusal and the `--plan` line on instance `alpha`. |
-| `docs/TOOLS.md` | The `sso-config` paragraph says both commands carry `--instance NAME` on a named instance. |
-
-## What it does
-
-On a named instance the hint now reads `activate ID --instance NAME without --sso first, then write
-console.sso, then run activate ID --instance NAME --sso`. `INSTANCE_FLAGS` is empty for the default instance,
-so `inst` is empty and the default text is unchanged byte for byte. T57's item 2 subtest still asserts the
-default text exactly. The flag goes right after `ID`, the same place the other entry points take it from
-`INSTANCE_FLAGS`. BUSINESS is not in the hint before or after this row.
-
-## Tests run (this tree)
-
- `node --test tests/stack-release.test.mjs`, the whole file: 193/193 on 76134dfde
-  (`/mnt/storage/scratch/launchpad-r238/sr-whole.log`) and 193/193 again after the rebase onto 011d41ba6
-  (`sr-whole-2.log`), with the new subtest and T57's default-text check.
- `tests/stack-instances.test.mjs`, whole: 23/23 (`si.log`). It names `stack-release` only in a comment.
- A grep of `packages/*/tests/` and `scripts/test-*.sh` finds the hint text only in `stack-release.test.mjs`
-  (`:1951` default, `:2102` and `:2104` named) and no 64-hex pin on the 3 paths.
- The cli suite, every `scripts/test-*.sh` and the mutant go to Sage's slot.
-
-## Mutants (`mutants.py`, run as `python3 mutants.py <tree> [N ...]`, against T57)
-
-| # | Mutant | Result |
-| --- | --- | --- |
-| 1 | the first step drops `--instance NAME` (`inst=""`) | not run, Sage's slot |
-
-The pattern matches once on this tree.
@@ -1 +0,0 @@
-011d41ba6a703be3c6c8d70996aa780223aa3b00
@@ -1,3 +0,0 @@
-868dcf320abcd745aad33a15a3d2ae212902b4dd4f763f8d8fd23cca46c9da74  docs/TOOLS.md
-b169c6c0a8e6fe947669d3f4e161ff200d596fb0a7706ee4d3f81cd742e542ca  packages/cli/tests/stack-release.test.mjs
-8b0193de39ac13c38e5c0e3e96df6d2204acb80c214f5c6d2eb240ae7bd3c33c  scripts/stack-release.sh
@@ -1,37 +0,0 @@
-# Row 238 (#1744) mutant: `python3 mutants.py <tree> [N ...]`. Each applies to the tree's scripts/stack-release.sh,
-# runs T57 in packages/cli/tests/stack-release.test.mjs and restores the file from a saved copy, checked by sha256.
-# Killed = test exit != 0.
-import hashlib, os, subprocess, sys, signal
-R = os.path.abspath(sys.argv[1])
-S = os.path.join(R, 'scripts', 'stack-release.sh')
-if not os.path.isfile(S): sys.exit(f'ABORT no scripts/stack-release.sh under {sys.argv[1]}')
-T, PAT = 'tests/stack-release.test.mjs', '^T57'
-M = [
- ('the sso-config first step drops --instance NAME (row 238)', [('    local first="" inst="${INSTANCE_FLAGS[*]:+ ${INSTANCE_FLAGS[*]}}"', '    local first="" inst=""')]),
-]
-sha = lambda b: hashlib.sha256(b).hexdigest()
-only = sys.argv[2:]
-os.chdir(os.path.join(R, 'packages', 'cli'))
-survived = []
-for i, (name, pairs) in enumerate(M, 1):
-    if only and str(i) not in only: continue
-    orig = open(S, 'rb').read(); h = sha(orig)
-    src = orig.decode()
-    for a, b in pairs:
-        if src.count(a) != 1: sys.exit(f'ABORT {i} {name}: pattern found {src.count(a)} times')
-        src = src.replace(a, b)
-    try:
-        open(S, 'w').write(src); os.chmod(S, 0o755)
-        p = subprocess.Popen(['node', '--test', f'--test-name-pattern={PAT}', T], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session=True)
-        try: out, _ = p.communicate(timeout=300)
-        except subprocess.TimeoutExpired:
-            os.killpg(p.pid, signal.SIGKILL); out, _ = p.communicate(); out += b'\nTIMEOUT'
-        text = out.decode(errors='replace')
-        ran = [l for l in text.splitlines() if l.startswith('ℹ fail ')]
-        verdict = 'KILLED' if p.returncode != 0 else 'SURVIVED'
-        if verdict == 'SURVIVED': survived.append(name)
-        print(f'{i:2} {verdict} {name} [{ran[0] if ran else "no count"}]', flush=True)
-    finally:
-        open(S, 'wb').write(orig); os.chmod(S, 0o755)
-        if sha(open(S, 'rb').read()) != h: sys.exit(f'ABORT restore failed for {S}')
-print('survived:', survived or 'none')
@@ -0,0 +1,75 @@
+# Row 237: one decision publishes once (#1743)
+
+Megavolt, 2026-10-21 (from `date -u`). Brief: `docs/plans/2026-10-20_agent-credentials.md`
+§ "row 199 follow-up N1", blob dca67d310e1b. Source: Duckworth's row 199 round 1 note N1
+(duckworth-0068). Base: `cb5fdb064` (row 199's landing). Reviewer Duckworth, gate owner Sage.
+
+## The defect
+
+`checkPublish` opens a ticket after checking the decision is unspent. The decision is spent only at
+`recordPublish`, which runs after the bus process has pushed. Two `checkPublish` calls on one decision
+therefore both get tickets, and both push. With different branches, the commit lands on two fork refs:
+`refs/heads/<user>/feat` and `refs/heads/<user>/other`. The second `recordPublish` then refuses
+`decision-consumed`, but by then its push has already reached the fork.
+
+## The fix, and why this option
+
+`checkPublish` refuses `publish-busy` when an open ticket in `#publishes` holds the same business and
+decision (`packages/bus/src/broker.mjs:1038-1040`). It runs after the authority and fact checks, so a
+spent decision still refuses `decision-consumed` first.
+
+The brief's other option, rechecking `#spent` in `publishTarget`, doesn't close the race. Both tickets
+reach `publishTarget` before either push ends, and nothing is spent until `recordPublish`. So both
+rechecks pass and both pushes run. The only state that exists while the first push runs is the open
+ticket, so the check reads that.
+
+A refusal (`publishRefused`) drops the ticket and leaves the decision unspent, so a retry on the same
+decision gets a new ticket. That is row 199's behaviour, unchanged. A within-role publish has no
+decision and isn't affected.
+
+## Tests
+
+- `packages/bus/tests/publish.test.mjs:186`. A second ticket refuses `publish-busy`, on the same branch
+  and on another. After `publishRefused` the retry gets a ticket and a third refuses busy. After
+  `recordPublish` there is one `action.allowed` for git.push.remote and the next call refuses
+  `decision-consumed`. Another agent's decision on the same task isn't held.
+- `packages/cli/tests/publish-socket.test.mjs:269`. End to end through the git socket, the bus runtime
+  and the TLS fake Gitea. While the first publish holds its ticket, a second publish on the same
+  decision to branch `other` gets `publish-busy`. The fake Gitea gets exactly one `git-receive-pack`,
+  the fork has only `refs/heads/coder/feat`, and there is one `action.allowed`.
+
+Runs on this branch, single files:
+- publish.test.mjs: 13/13.
+- publish-socket.test.mjs: 8/8.
+
+## Mutant
+
+M1 removes the `publish-busy` line. Both tests fail:
+- The bus test fails at the first busy assert.
+- The cli test fails because the second publish answers `ok: true` with `ref: refs/heads/coder/other`.
+  That is the defect: two refs on the fork.
+
+Logs are in `/mnt/storage/scratch/megavolt-r237/` (m1-bus.log, m1b-cli.log). `cmp` confirmed
+broker.mjs matched the saved copy after the restore. The first cli mutant run (m1-cli.log) was against
+a hook that recursed on every checkPublish. I fixed the hook to fire only for branch `feat` and reran
+it (m1b-cli.log).
+
+## Residuals, not fixed here
+
+1. **A ticket that never ends holds its decision until the bus restarts.** `#publishes` is in memory.
+   That happens when the host dies between checkPublish and recordPublish or publishRefused. It fails
+   closed (`publish-busy`), and a restart clears it.
+2. **publish-timeout (sage-1440).** The socket files `publishRefused` and drops the ticket, but the bus
+   process's push may still be running. A retry on the same decision can then open a ticket while that
+   push is live. This is the same residual the socket already logs ("the bus process's push may still
+   reach the fork"). Closing it means the runtime's `remotes` must keep the decision busy until its push
+   settles, which reaches into runtime.mjs. That is beyond the brief's two options.
+3. **checkLand has the same shape.** `#landings` takes a ticket per call and the decision is spent at
+   `recordLand`. Whether two landings on one decision can both reach main isn't checked here. That's a
+   follow-up for Sage to row or dismiss.
+
+## Gate
+
+Per the brief: Duckworth approves the manifest, the bus suite and every `scripts/test-*.sh` are green
+on Sage's gate, and M1 is killed. This row also changes a cli test file, so the cli suite (or that file
+alone) should run on the gate too.
@@ -196,23 +196,3 @@ a piece. It passed, so the "pm doesn't answer" branch does not apply and
 no defect is filed.

 Piece 1 is Jason's next real Mosaic Stack request to pm. It is not open yet.
-
-## 2026-10-21T01:14Z dates (sage-1622, Mos mos-1148, Vikunja #442)
-
-Mos accepted the plan with changes C1 and C2. The dates are latest-by markers (Q111).
-
-1. Pieces 1-5 open by 2026-10-23 23:59Z. Mos gives Jason the plain command after tonight's open items with him
-   (Q13 on PRD 1.8, the 1012 and 1008 boot). I don't ask again.
-2. C1: no piece is pinned to a copy. A piece runs on whatever copy is live when Jason sends it. For each piece
-   this log records the activation id at send. A piece still open across a window gets the new activation id
-   recorded too.
-3. C2: neither the Q175 phase 2 window (10-23) nor the 10-24 re-pin window rolls back or restores while a piece
-   has history, unless that window has failed. If a restore happens anyway, this log names the pieces to redo.
-4. All five closed and reviewed by 2026-10-26 18:00Z. Jason reads the five trails at his gate on 10-26 or
-   10-27. A pass starts merge plan step 1 under decision 146, and step 4 stays his.
-5. Fallback: if fewer than five pieces are open by 10-23, the gate moves to 10-28. No agent opens a piece in
-   Jason's place.
-
-When Jason sends a piece, I tell Mos its message id.
-
-Correction (2026-10-21T01:06Z): the heading above says 01:14Z. The clock read 2026-10-21T01:05:56Z when I wrote that entry, so 01:06Z is the right time.
@@ -1,60 +0,0 @@
-// Sage, 2026-10-21: re-plan comments on P19 405-408 and 411 (due 10-22). Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
-// Checks each task's title before posting. Prints no secret.
-// Usage: node comment-p19-405-411-replan.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
-const PROJECT = 19;
-const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
-const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
-const POSTS = [
-  { id: 405, title: /^stack-release --plan: no test plans a missing store/, body: [
-    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
-  ] },
-  { id: 406, title: /^stack-release --plan: backup line printed/, body: [
-    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
-  ] },
-  { id: 407, title: /^stack-release\.sh: the proof_for_target comment/, body: [
-    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
-  ] },
-  { id: 408, title: /^docs\/TOOLS\.md: the row 178 paragraph/, body: [
-    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
-  ] },
-  { id: 411, title: /^stack-release\.sh and webui-service\.sh: the proof file repository check/, body: [
-    "Re-plan (Sage, 2026-10-21, due 10-22). Tasks 405, 406, 407, 408 and 411 become one queue row, a stack-release follow-up row. All five touch scripts/stack-release.sh, scripts/webui-service.sh or docs/TOOLS.md, and rows 232 (Darkwing) and 238 (Launchpad) are changing stack-release.sh now. So I brief the row after 232 and 238 land, from their landing, which avoids base drift (the row 68 rule). It lands after the 10-24 window, because that window holds the four service scripts at NEW (P5). 411's hold was the Part B window, and Part B is superseded (Q175, mos-0970), so that hold is gone. Each item keeps the test and mutant its task names. I'll name the owner when I brief it, either the seat that frees up first of Darkwing and Launchpad, or me.",
-  ] },
-];
-const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
-async function api(method, path, body, auth) {
-  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
-  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
-  return { status: r.status, json };
-}
-const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
-const rec = { at: new Date().toISOString(), comments: [], problems: [] };
-const save = () => {
-  const out = JSON.stringify(rec, null, 1) + "\n";
-  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
-  writeFileSync(OUT, out);
-};
-for (const P of POSTS) {
-  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
-  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
-}
-writeFileSync(OUT, "", { flag: "wx" });
-for (const P of POSTS) {
-  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
-  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
-  rec.comments.push(e);
-  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
-  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
-  const found = list(back.json).find((x) => x.id === c.json.id);
-  Object.assign(e, { readBack: back.status, found: Boolean(found) });
-  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
-  save();
-}
-save();
-process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
-if (rec.problems.length) process.exit(2);
@@ -1,53 +0,0 @@
-// Sage, 2026-10-21: landing comments on P19 412 (row 200) and 424 (row 199), per mos-0882. Sage's own key (bot user 13); the sync key reads back. Comments only: no task edits.
-// Checks each task's title before posting. Prints no secret.
-// Usage: node comment-r200-r199-landed.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
-const PROJECT = 19;
-const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
-const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
-const POSTS = [
-  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
-    "Row 200 landed on refactor as 9e1085816 (Gitea #1698, closed): stack-release.sh activate --sso, the phase 2 prerequisite. Launchpad built it and Webby approved r3. Sage's run killed 13 of 14 mutants (M12 is the equivalent ruled in round 2). Gate: 15 package suites and 10 scripts/test-*.sh suites, all green, at 00:07:57Z.",
-    "Follow-up N1 is row 238 (Gitea #1744, Launchpad, Webby). The sso-config hint will carry --instance NAME for a named instance. Nothing is live until a window activates a copy that includes 9e1085816.",
-  ] },
-  { id: 424, title: /^Credential store: per-agent host access/, body: [
-    "Row 199 landed on refactor as cb5fdb064 (Gitea #1697, closed). It adds the per-agent credential store, the agent's own git identity and pushes to a remote. Megavolt built it and Duckworth approved r1 (comment 29779). Gate on 9e1085816 plus the patch: packages 2735/0, scripts 429/0.",
-    "Row 210 (Gizmoduck) now rebases onto cb5fdb064 on a new branch (mos-1135, mos-1137). Rows 234 and 235 follow it. Rows 190, 199 and 210 go live together in the 10-24 window with the 3i-3j migration, backup first, under Q173 (mos-1145).",
-  ] },
-];
-const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
-async function api(method, path, body, auth) {
-  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
-  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
-  return { status: r.status, json };
-}
-const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
-const rec = { at: new Date().toISOString(), comments: [], problems: [] };
-const save = () => {
-  const out = JSON.stringify(rec, null, 1) + "\n";
-  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
-  writeFileSync(OUT, out);
-};
-for (const P of POSTS) {
-  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
-  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
-}
-writeFileSync(OUT, "", { flag: "wx" });
-for (const P of POSTS) {
-  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
-  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
-  rec.comments.push(e);
-  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
-  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
-  const found = list(back.json).find((x) => x.id === c.json.id);
-  Object.assign(e, { readBack: back.status, found: Boolean(found) });
-  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
-  save();
-}
-save();
-process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
-if (rec.problems.length) process.exit(2);
@@ -1,66 +0,0 @@
-// Sage, 2026-10-21: files row 237's review follow-ups N1 and N3 (duckworth-0069, #1743 comment 29810) as two P19 tasks.
-// Sage's own key (bot user 13); the sync key reads back. No labels, assignees, due dates or bucket moves. Refuses if
-// the title exists. Prints no secret.
-// Usage: node file-r237-followups.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
-const PROJECT = 19;
-const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
-const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
-const TASKS = [
-  {
-    title: "Bus publish: a retry after publish-timeout can push a second fork ref while the first push still runs (row 237 N1)",
-    description: ps(SIG, [
-      "Duckworth's row 237 review N1 (#1743 comment 29810, duckworth-0069). Row 237 makes checkPublish refuse publish-busy while an open ticket holds the same business and decision. publishRefused drops the ticket on publish-timeout, but the bus process's push may still be running, so a retry to another branch can push a second ref to the fork.",
-      "The fix belongs in packages/bus/src/runtime.mjs, in `remotes`: either keep the ticket until the push process exits, or kill the push on timeout and wait for it. A test should start a slow push, time it out, retry to another branch, and expect one ref on the fork. Not in row 237's scope. Megavolt's BUILD.md residual 2 (agents/megavolt/work/queue-237/BUILD.md). Needs a queue row once 237 lands.",
-    ]),
-  },
-  {
-    title: "Bus land: check whether checkLand has the same open-ticket race that row 237 fixed in checkPublish (row 237 N3)",
-    description: ps(SIG, [
-      "Row 237 residual 3 (Megavolt's BUILD.md) and Duckworth's N3 (#1743 comment 29810): checkLand has the same ticket shape as checkPublish had before row 237. Two lands on the same decision may both pass the check before either records. Duckworth didn't check it.",
-      "First step: read checkLand and its ticket code in packages/bus/src/broker.mjs against row 237's fix (broker.mjs:1038-1043). If the race exists, file a queue row with a race test like publish-socket.test.mjs's; if not, record why and close this task.",
-    ]),
-  },
-];
-const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
-async function api(method, path, body, auth) {
-  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
-  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
-  return { status: r.status, json };
-}
-const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
-async function existing() {
-  const out = [];
-  for (let page = 1; page < 20; page++) {
-    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
-    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
-    out.push(...list(r.json));
-    if (list(r.json).length < 50) return out;
-  }
-  throw new Error("more than 19 pages");
-}
-const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
-const save = () => {
-  const out = JSON.stringify(rec, null, 1) + "\n";
-  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
-  writeFileSync(OUT, out);
-};
-const have = await existing();
-for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
-writeFileSync(OUT, "", { flag: "wx" });
-rec.created = [];
-for (const T of TASKS) {
-  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
-  const c = { status: r.status, id: r.json?.id ?? null };
-  rec.created.push(c);
-  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
-  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
-  Object.assign(c, { readBack: back.status, done: back.json?.done });
-  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
-}
-save();
-console.log(JSON.stringify(rec));
@@ -1,41 +0,0 @@
-{
- "at": "2026-10-21T01:06:25.071Z",
- "comments": [
-  {
-   "task": 405,
-   "status": 201,
-   "id": 416,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 406,
-   "status": 201,
-   "id": 417,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 407,
-   "status": 201,
-   "id": 418,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 408,
-   "status": 201,
-   "id": 419,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 411,
-   "status": 201,
-   "id": 420,
-   "readBack": 200,
-   "found": true
-  }
- ],
- "problems": []
-}
@@ -1,20 +0,0 @@
-{
- "at": "2026-10-21T00:28:32.038Z",
- "comments": [
-  {
-   "task": 412,
-   "status": 201,
-   "id": 414,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 424,
-   "status": 201,
-   "id": 415,
-   "readBack": 200,
-   "found": true
-  }
- ],
- "problems": []
-}
@@ -1,19 +0,0 @@
-{
- "at": "2026-10-21T00:38:47.170Z",
- "project": 19,
- "created": [
-  {
-   "status": 201,
-   "id": 440,
-   "readBack": 200,
-   "done": false
-  },
-  {
-   "status": 201,
-   "id": 441,
-   "readBack": 200,
-   "done": false
-  }
- ],
- "problems": []
-}
@@ -1,16 +0,0 @@
-// Sage, 2026-10-21: read-only. Prints id, done, title, the last update and the description as plain text for the
-// given P19 tasks, with the sync key. Writes nothing. Prints no secret.
-// Usage: node read-tasks.mjs https://tasks.woltje.com SYNC_TOKEN_FILE ID...
-import { readFileSync } from "node:fs";
-const [ORIGIN, SYNC, ...IDS] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-const sync = readFileSync(SYNC, "utf8").trim();
-const text = (h) => (h ?? "").replace(/<\/p>|<br\s*\/?>|<\/li>/g, "\n").replace(/<[^>]+>/g, "").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&").trim();
-for (const id of IDS) {
-  const r = await fetch(`${ORIGIN}/api/v2/tasks/${id}`, { headers: { Authorization: `Bearer ${sync}` }, redirect: "error" });
-  const j = await r.json().catch(() => null);
-  if (r.status !== 200 || j?.project_id !== 19) { console.log(`== ${id}: status ${r.status}, not P19`); continue; }
-  const out = `== ${id} done=${j.done} updated=${j.updated}\n${j.title}\n${text(j.description)}\n`;
-  if (out.includes(sync)) throw new Error("secret in output");
-  console.log(out);
-}
@@ -1,73 +0,0 @@
-# 10-24 window: re-pin 4429a104f to the row 234 landing, with the 3i-3j migration (draft 0)
-
-Sage, 2026-10-21T01:05Z, draft 0, for mos-1145 under DECISIONS Q173. This is the skeleton. NEW isn't fixed yet,
-so Mos doesn't check this draft. Draft 1 names NEW and goes to Mos for the P0 check. The step layout follows
-`repin-4429a104f.md`. Steps that match are named, not copied.
-
-## Scope (mos-1145, mos-1134)
-
- One window carries the code of rows 190, 199 and 210, plus row 234 (row a) with its schema step 3i to 3j
-  through `activate --migrate`, agent-run under Q173, backup first.
- Row a lands before the .53 and .54 installs, by 10-25 (mos-1134). If row 234 hasn't landed by 10-24 12:00Z,
-  I ask Mos whether to run the window without it (no migration) or to move it.
- Jason has no step. Nobody acts as Jason. No pi (P19 383). No Save, no `mosaic name`. Nothing is pruned.
- `--sso` stays off. Row 200's `activate --sso` is in NEW as a tool. Turning it on changes who reaches the Console
-  from outside, so that's Jason's (Q173 exclusion). It has its own window, the Q175 phase 2 window on 10-23
-  (mos-1148). That window runs first, so this window's OLD may be the phase 2 copy, and P1 reads it from
-  `status`.
-
-## Names
-
- OLD, live: `4429a104f6d65ccf165f6c83b5d1dce3147dfde0`, schema 3i, pointer `pm: true` (record 99a406ed3).
-  P1 re-reads the activation id and the Console flags from `status`. I don't copy them from the last window.
- NEW: open. It's the row 234 landing, or a later code landing if Mos rules. Candidates in landing order:
-  210 (r4 due 10-21), 237, 194, 234.
- REPO, `P`, `WIN=agents/sage/work/window-repin-<NEW12>/`, `SNAP`: as in `repin-4429a104f.md`, with the
-  sha checks at P0 and before S1, S2 and any D3.
-
-## What NEW carries over OLD (so far, refactor c8bc5cf4c)
-
-`git log --first-parent 4429a104f..HEAD`, path-limited to packages, scripts, roles, contracts, adapters, skills
-and the package files:
-
-| Row | Commit | Live effect to check |
-|---|---|---|
-| 201 | afad4993f | business: access.json loader. Check: the live business has no access.json, and load stays LOAD_OK (P1). |
-| 204 | d0bbc5c1c | business: 193a viewer level. Same check. |
-| 190 | 00d4cc1f6 | Several instances per host. Touches `stack-release.sh`, `webui-service.sh`, `bus-service.sh`, `stack-copy.sh`. The default instance must render the same units: P2 diffs the rendered units OLD vs NEW for `mosaic-stack`, and any difference stops the window until it's explained. |
-| 200 | 9e1085816 | Tool: `activate --sso`. Off here. `--plan` must show no `--sso` line. |
-| 199 | cb5fdb064 | Credential store per agent. Check: bus start with no store entries for the live agents changes nothing, and the chief's and pm's launches still pass. The P3 rehearsal covers start. |
-| N3 | 390ea5261 | README only. |
-| 230 | c8bc5cf4c | Case 2 scripts, tools only. Not run live. |
-| 210 | open | Host access. The live business has no `hosts`, so nothing is granted. Bus start runs the host-run sweep (M34d). P3 must show it removes nothing. |
-| 237 | open | Publish busy check (199 N1). |
-| 234 | open | Machine grant row a and the 3i to 3j schema step. `--plan` must say `migration: 3i -> 3j`. |
-
-Service script drift OLD to HEAD is 415+/91- over the four scripts, mostly row 190. P5 holds them at NEW.
-
-## Backups and the migration
-
- W5: the stopped store backup that every activate takes (row 185), with SHA256SUMS, SCHEMA 3i and STAMP,
-  plus the rollback set. Before `--migrate` writes, I check that SCHEMA reads 3i and the backup SHA256SUMS hash.
- W0b: the business file copy, as in the last window.
- Rollback after a migration isn't the plain rollback. OLD is 3i and the store is 3j, so going back needs
-  `--restore <W5 activation>`, and that loses the events written after W5. The row 181 restore guard counts
-  11 tables, and the untimed ones need the D3 snapshot. Mos decides any restore past W5, as before.
- P3 is the rehearsal with `--migrate` on a copy of the live backup. It must show the 3j step and the row
-  counts before and after.
-
-## Row 42 (S7) interaction
-
-Row 42's pieces may be in flight at window start (sage-1622, mos-1148 C1 and C2). W1 adds: list open pm tasks, and either pm
-finishes or parks them before W5, or I record which piece crosses the window. No restore while a piece has
-history unless the window fails.
-
-## Open before draft 1
-
- Q1: NEW, once 234 lands. Do 194 and 237 go in if they land first? I recommend yes for 237 (small, bus
-  only) and asking Mos about 194, since 194 changes the lifecycle verbs and roles/chief-of-staff.*.
- Q2, settled by mos-1148: phase 2 is its own window on 10-23. Draft 1 takes OLD and the Console flags,
-  `--sso` included, from `status` after that window.
- Q3: who operates. If Darkwing is free, Darkwing operates and I check. Otherwise I operate as in the last
-  window.
- The P-step evidence list for rows 199 and 210 at bus start, written once both have landed.
@@ -582,8 +582,7 @@ error. Before anything stops, a run whose Console flags hold `--sso` refuses
 `sso-target` for a target Console without it, `sso-config` when the target's own
 `checkConsole` refuses the config's `console` key (or there is none, in which
 case, from another copy, it names the first step: activate the target without
-`--sso`, then write `console.sso`; on a named instance both commands carry
-`--instance NAME`), and `sso-slot` for each provider's slot file
+`--sso`, then write `console.sso`), and `sso-slot` for each provider's slot file
 that is missing, a symlink, not a regular file, not owned by this uid, has group
 or other bits, resolves inside the repository or the copies, or is empty. It
 uses `lstat`, `stat` and `realpath` on the slot and never reads it. `--plan`
@@ -1035,6 +1035,9 @@ export class Broker {
      const decision = args.decision ?? null;
      const result = this.#checkAuthority(s, 'git.push.remote', { decision, target: task_ref });
      const facts = this.#publishFacts(s, task_ref, project, result);
+      // Row 237 (#1743): one decision, one open publish. The decision is spent only at
+      // recordPublish, after the push, so a second ticket on it would push too, maybe to another ref.
+      if (result.decision && [...this.#publishes.values()].some((p) => p.s.business === s.business && p.decision === result.decision)) fail('publish-busy');
      const ticket = randomUUID();
      const dst = `refs/heads/${facts.user}/${branch}`;
      this.#publishes.set(ticket, { s, task_ref, project, decision, dst, ...facts });
@@ -181,6 +181,32 @@ test('the request cannot name the fork, the user or the destination', (t) => {
    assert.throws(() => f.publish(d, 'coder', extra), /invalid-request/);
 });

+// Row 237 (#1743, duckworth-0068 N1): the decision is spent at recordPublish, after the push, so
+// checkPublish refuses a second ticket on a decision that already has one open.
+test('one decision, one open publish: a second ticket refuses publish-busy, whatever its branch', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const d = f.approve();
+  const r = f.publish(d);
+  assert.throws(() => f.publish(d), /publish-busy/);
+  assert.throws(() => f.publish(d, 'coder', { branch: 'other' }), /publish-busy/);
+  // A refused publish frees the decision, which is still unspent; the retry gets a ticket.
+  f.b.publishRefused(r.ticket, { code: 'fork-unavailable' });
+  const retry = f.publish(d, 'coder', { branch: 'other' });
+  assert.throws(() => f.publish(d), /publish-busy/);
+  f.b.recordPublish(retry.ticket, { ref: retry.dst, commit: A, previous: null });
+  assert.equal(f.events('action.allowed').filter((e) => e.body.action === 'git.push.remote' && e.body.operation !== 'decision.raise').length, 1);
+  assert.throws(() => f.publish(d), /decision-consumed/);
+  // Another agent's decision on the same task isn't held by this one's ticket.
+  const f2 = setup(t);
+  f2.push(A);
+  const mine = f2.approve();
+  f2.publish(mine);
+  f2.push(B, A, 'second');
+  const theirs = f2.approve('second');
+  assert.equal(typeof f2.publish(theirs, 'second').ticket, 'string');
+});
+
 test('publishRefused files the code on the task\'s trail and drops the ticket', (t) => {
  const f = setup(t);
  f.push(A);
@@ -50,11 +50,10 @@ in this repository, or `$MOSAIC_ROLES_DIR` if set.
  `withinRole` actions run without asking. `crossRole` actions need the
  arbiter. Any action not listed is gated: it goes to Jason, or to the
  arbiter for its domain when the raise cites the project's current spec
-  commit (PRD 1.5 REQ-DEC-2). The nine hard waits in `GATED_ONLY`
+  commit (PRD 1.5 REQ-DEC-2). The eight hard waits in `GATED_ONLY`
  (REQ-WAIT-1: `spend`, `data.delete`, `network.expose`, `account.create`,
-  `credential.mint`, `message.external`, `git.push.protected`,
-  `git.push.remote`, `deploy`) always go to Jason and can't appear in
-  either list (REQ-WAIT-2). `git.push.remote` joined in row 199 (#1697).
+  `credential.mint`, `message.external`, `git.push.protected`, `deploy`)
+  always go to Jason and can't appear in either list (REQ-WAIT-2).
  `GATED_ONLY` is every action that `ROUTED` doesn't name, so an action
  added to the vocabulary is a hard wait until a PRD says otherwise and the
  commit adds it to `ROUTED` (REQ-WAIT-3). `git.merge.protected`,
@@ -710,9 +710,8 @@ The session credential comes from
 `EnvironmentFile=-%h/.config/mosaic-dev/secrets/claude-session.env`, the
 one place the path is set. The file holds one line, for example
 `CLAUDE_CODE_OAUTH_TOKEN=<token>`, mode 0600. The operator writes it;
-nothing in the repository creates it, and only the Case 2 precheck reads
-it, printing variable names, never values. No session sees the file
-itself, only the variable. The leading `-` lets the unit start
+nothing in the repository creates or reads it, and no session sees the
+file itself, only the variable. The leading `-` lets the unit start
 without it, so Pi sessions still launch and a Claude Code launch refuses
 `no-session-credential`. To change the credential, edit or swap the file
 (or this line and this paragraph), then restart the unit; a running host
@@ -1,683 +0,0 @@
-// Case 2 row C2-13a (#1732): scripts/case2-unit.sh renders and installs the hub's two system units,
-// and scripts/case2-precheck.sh checks the host before they start. Brief: docs/plans/2026-10-20_case2-rows.md
-// "C2-13a". Every case runs against a scratch unit directory, a scratch home and fake systemctl,
-// getent, sudo, id, node, bwrap and claude. Nothing here reads or writes /etc/systemd,
-// ~/.mosaic-dev or ~/.config/mosaic-dev, and no fixture value is a real credential.
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { createServer } from "node:net";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
-import { binds, prepareRun, sandboxArgv, sandboxProblem } from "../../seat/src/sandbox.mjs";
-import { tmp } from "./helpers.mjs";
-
-const REPO = fileURLToPath(new URL("../../../", import.meta.url));
-const UNIT = join(REPO, "scripts", "case2-unit.sh");
-const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
-const BUS_TEMPLATE = join(REPO, "packages", "cli", "systemd", "mosaic-bus.service.in");
-const WEBUI_TEMPLATE = join(REPO, "packages", "webui", "systemd", "mosaic-webui.service.in");
-const COPY_A = "a".repeat(40);
-const COPY_B = "b".repeat(40);
-const UID = process.getuid();
-const GID = process.getgid();
-// A made-up key value; no output may hold it.
-const FIXTURE_KEY = "fixture-zai-key-3c9e51";
-
-// A root-owned executable outside /usr/local/bin, /usr/bin and /bin, for the PATH case.
-function outsideNode() {
-  const dir = "/usr/lib/systemd";
-  for (const name of readdirSync(dir).sort()) {
-    const p = join(dir, name);
-    const s = statSync(p, { throwIfNoEntry: false });
-    if (s?.isFile() && s.uid === 0 && (s.mode & 0o111) && (s.mode & 0o022) === 0 && realpathSync(p) === p) return p;
-  }
-  throw new Error(`no root-owned executable in ${dir}`);
-}
-const USR_NODE = realpathSync("/usr/bin/node");
-const TRUE_BIN = realpathSync("/usr/bin/true");
-
-function script(file, text) {
-  mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(file, `#!/usr/bin/env bash\n${text}\n`);
-  chmodSync(file, 0o755);
-  return file;
-}
-
-// A scratch hub: a home with two copies and a proof file, a unit directory, and fakes.
-function hub(t, { uid = UID } = {}) {
-  const root = tmp(t, "case2-unit-");
-  const home = join(root, "home", "mosaic");
-  for (const id of [COPY_A, COPY_B]) {
-    mkdirSync(join(home, ".local", "share", "mosaic-stack", "copies", id, "scripts"), { recursive: true });
-    writeFileSync(join(home, ".local", "share", "mosaic-stack", "copies", id, "scripts", "mosaic"), "");
-  }
-  const secrets = join(home, ".config", "mosaic-dev", "secrets");
-  mkdirSync(secrets, { recursive: true, mode: 0o700 });
-  const proof = join(secrets, "proxy-proof");
-  writeFileSync(proof, "made-up-proof\n");
-  chmodSync(proof, 0o600);
-  const units = join(root, "units");
-  mkdirSync(units);
-  const bin = join(root, "bin");
-  const log = join(root, "systemctl.log");
-  script(join(bin, "getent"), `case "$1" in
-  passwd) [ "$2" = mosaic ] && echo "mosaic:x:${uid}:${GID}::${home}:/bin/bash" ;;
-  group) [ "$2" = "${GID}" ] && echo "mosaic:x:${GID}:" ;;
-  *) exit 2 ;;
-esac`);
-  // is-active answers yes for each unit named in CASE2_TEST_ACTIVE.
-  script(join(bin, "systemctl"), `echo "$*" >>'${log}'
-if [ "$1" = is-active ]; then case " \${CASE2_TEST_ACTIVE:-} " in *" $3 "*) exit 0 ;; *) exit 3 ;; esac; fi
-[ "$*" != "\${CASE2_TEST_FAIL:-}" ]`);
-  return { root, home, secrets, proof, units, bin, log };
-}
-
-const libraryFlags = (h) => ["--port", "443", "--business", "acme", "--public-host", "books.example", "--auth-header", "X-Auth-User",
-  "--allow-user", "melanie", "--send", "--proof-header", "X-Proxy-Proof", "--proof-file", h.proof];
-const factoryFlags = () => ["--port", "443", "--business", "acme", "--tester-port", "7333"];
-
-function unit(h, { profile = "library", node = USR_NODE, copy = COPY_A, extra = [], flags, env = {} } = {}) {
-  const serve = flags ?? (profile === "factory" ? factoryFlags() : libraryFlags(h));
-  const args = ["--user", "mosaic", "--home", h.home, "--business", "acme", "--copy", copy, "--node", node, "--profile", profile, ...extra, "--", ...serve];
-  const r = spawnSync(UNIT, args, {
-    encoding: "utf8",
-    timeout: 30000,
-    env: { PATH: process.env.PATH, CASE2_UNIT_DIR: h.units, CASE2_SYSTEMCTL: join(h.bin, "systemctl"), CASE2_GETENT: join(h.bin, "getent"), ...env },
-  });
-  return { code: r.status, out: r.stdout, err: r.stderr };
-}
-
-const busFile = (h) => join(h.units, "[email protected]");
-const webuiFile = (h) => join(h.units, "mosaic-webui.service");
-const read = (f) => readFileSync(f, "utf8");
-const lines = (text, key) => text.split("\n").filter((l) => l.startsWith(`${key}=`)).map((l) => l.slice(key.length + 1));
-const copyDir = (h, id = COPY_A) => join(h.home, ".local", "share", "mosaic-stack", "copies", id);
-const HARDENING = (h) => ["ProtectSystem=strict", `ReadWritePaths=${h.home}`, "ProtectHome=yes", "PrivateTmp=yes"];
-
-function refuses(r, pattern) {
-  assert.equal(r.code, 1, `expected a refusal, got ${r.code}: ${r.out}${r.err}`);
-  assert.match(r.err, pattern);
-}
-
-// A template copy with one edit, for the template cases.
-function template(h, from, name, edit) {
-  const file = join(h.root, name);
-  writeFileSync(file, edit(read(from)));
-  return file;
-}
-
-test("a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console", (t) => {
-  const h = hub(t);
-  const r = unit(h);
-  assert.equal(r.code, 0, r.err);
-  for (const f of [busFile(h), webuiFile(h)]) assert.equal(statSync(f).mode & 0o777, 0o644);
-  const bus = read(busFile(h));
-  const webui = read(webuiFile(h));
-  assert.deepEqual(lines(bus, "Environment"), ["PATH=/usr/bin:/usr/local/bin:/bin"]);
-  assert.deepEqual(lines(bus, "ExecStart"), [`${copyDir(h)}/scripts/mosaic bus start %i`]);
-  assert.deepEqual(lines(bus, "EnvironmentFile"), [`-${h.home}/.config/mosaic-dev/secrets/claude-session.env`]);
-  assert.deepEqual(lines(webui, "ExecStart"), [`${USR_NODE} ${copyDir(h)}/packages/webui/src/cli.mjs serve ${libraryFlags(h).join(" ")}`]);
-  assert.deepEqual(lines(webui, "EnvironmentFile"), []);
-  for (const text of [bus, webui]) {
-    assert.deepEqual(lines(text, "WantedBy"), ["multi-user.target"]);
-    assert.deepEqual(lines(text, "User"), ["mosaic"]);
-    assert.deepEqual(lines(text, "Group"), ["mosaic"]);
-    assert.deepEqual(lines(text, "NoNewPrivileges"), ["yes"]);
-    const hardening = text.split("\n").filter((l) => /^(ProtectSystem|ReadWritePaths|ProtectHome|PrivateTmp)=/.test(l));
-    assert.deepEqual(hardening, HARDENING(h));
-    assert.doesNotMatch(text, /@[A-Z_]+@|%h|MOSAIC_CONFIG=|MOSAIC_CLAUDE_BIN|After=|Wants=/);
-  }
-  assert.deepEqual(lines(bus, "AmbientCapabilities"), []);
-  assert.deepEqual(lines(bus, "CapabilityBoundingSet"), []);
-  assert.deepEqual(lines(webui, "AmbientCapabilities"), ["CAP_NET_BIND_SERVICE"]);
-  assert.deepEqual(lines(webui, "CapabilityBoundingSet"), ["CAP_NET_BIND_SERVICE"]);
-  assert.match(r.out, /enabled and started mosaic-bus@acme\.service, then mosaic-webui\.service\n$/);
-  assert.deepEqual(read(h.log).trim().split("\n"), [
-    "is-active --quiet [email protected]",
-    "is-active --quiet mosaic-webui.service",
-    "daemon-reload",
-    "enable [email protected] mosaic-webui.service",
-    "start [email protected]",
-    "start mosaic-webui.service",
-  ]);
-});
-
-test("PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node", (t) => {
-  const h = hub(t);
-  const node = outsideNode();
-  assert.equal(unit(h, { node }).code, 0);
-  for (const f of [busFile(h), webuiFile(h)]) assert.deepEqual(lines(read(f), "Environment"), [`PATH=${dirname(node)}:/usr/local/bin:/usr/bin:/bin`]);
-  assert.match(lines(read(webuiFile(h)), "ExecStart")[0], new RegExp(`^${node} `));
-});
-
-test("a failed bus start refuses with the Console not started", (t) => {
-  const h = hub(t);
-  const r = unit(h, { env: { CASE2_TEST_FAIL: "start [email protected]" } });
-  refuses(r, /start mosaic-bus@acme\.service failed; the Console is not started/);
-  assert.deepEqual(read(h.log).trim().split("\n").slice(2), ["daemon-reload", "enable [email protected] mosaic-webui.service", "start [email protected]"]);
-});
-
-test("the script never links a unit file", () => {
-  assert.doesNotMatch(read(UNIT), /systemctl link/);
-});
-
-test("factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty", (t) => {
-  const h = hub(t);
-  assert.equal(unit(h, { profile: "factory", extra: ["--pm", "--claude", TRUE_BIN] }).code, 0);
-  const bus = read(busFile(h));
-  const exec = lines(bus, "ExecStart");
-  assert.equal(exec.length, 1);
-  assert.match(exec[0], / bus start %i --pm$/);
-  assert.equal(exec[0].split("--pm").length, 2);
-  assert.deepEqual(lines(bus, "Environment"), ["PATH=/usr/bin:/usr/local/bin:/bin", `MOSAIC_CLAUDE_BIN=${TRUE_BIN}`]);
-  assert.deepEqual(lines(read(webuiFile(h)), "ExecStart"), [`${USR_NODE} ${copyDir(h)}/packages/webui/src/cli.mjs serve ${factoryFlags().join(" ")}`]);
-
-  const plain = hub(t);
-  assert.equal(unit(plain, { profile: "factory" }).code, 0);
-  const text = read(busFile(plain));
-  assert.deepEqual(lines(text, "ExecStart"), [`${copyDir(plain)}/scripts/mosaic bus start %i`]);
-  assert.doesNotMatch(text, /MOSAIC_CLAUDE_BIN|@PM_FLAGS@|@CLAUDE_ENV@/);
-});
-
-test("a re-install over running units says they are still on the old copy and must restart together, never that it started them", (t) => {
-  const h = hub(t);
-  assert.equal(unit(h).code, 0);
-  const both = unit(h, { copy: COPY_B, env: { CASE2_TEST_ACTIVE: "[email protected] mosaic-webui.service" } });
-  assert.equal(both.code, 0, both.err);
-  assert.doesNotMatch(both.out, /started/);
-  assert.match(both.out, new RegExp(`mosaic-bus@acme\\.service was already running, so it is still on copy ${COPY_A}, not copy ${COPY_B}`));
-  assert.match(both.out, new RegExp(`mosaic-webui\\.service was already running, so it is still on copy ${COPY_A}, not copy ${COPY_B}`));
-  assert.match(both.out, new RegExp(`restart mosaic-bus@acme\\.service and mosaic-webui\\.service together to put both on copy ${COPY_B}`));
-  assert.deepEqual(read(h.log).trim().split("\n").slice(-2), ["start [email protected]", "start mosaic-webui.service"]);
-
-  // Only the Console ran (the bus had stopped): the bus starts on the new copy, the Console stays.
-  const one = unit(h, { copy: COPY_A, env: { CASE2_TEST_ACTIVE: "mosaic-webui.service" } });
-  assert.equal(one.code, 0, one.err);
-  assert.match(one.out, new RegExp(`started mosaic-bus@acme\\.service on copy ${COPY_A}`));
-  assert.match(one.out, new RegExp(`mosaic-webui\\.service was already running, so it is still on copy ${COPY_B}, not copy ${COPY_A}`));
-  assert.doesNotMatch(one.out, /started mosaic-webui/);
-  assert.match(one.out, /restart mosaic-bus@acme\.service and mosaic-webui\.service together/);
-});
-
-test("a re-install to another copy re-renders both units, and an edited installed unit refuses", (t) => {
-  const h = hub(t);
-  assert.equal(unit(h).code, 0);
-  assert.equal(unit(h, { copy: COPY_B }).code, 0);
-  assert.match(read(busFile(h)), new RegExp(`copies/${COPY_B}/scripts/mosaic`));
-  assert.doesNotMatch(read(busFile(h)) + read(webuiFile(h)), new RegExp(COPY_A));
-
-  const edits = [
-    [busFile, (s) => s.replace("User=mosaic", "User=root"), /User= must be exactly once in \[Service\], as User=mosaic/],
-    [webuiFile, (s) => s.replace(/^ExecStart=(.*)$/m, "ExecStart=$1 --board http://127.0.0.1:1"), /ExecStart= must be exactly once/],
-    [busFile, (s) => s.replace("ProtectHome=yes\n", ""), /ProtectHome= must be exactly once/],
-    [webuiFile, (s) => s.replace("PrivateTmp=yes\n", ""), /PrivateTmp= must be exactly once/],
-    [busFile, (s) => s.replace("Type=simple", "Type=simple\nX-Note=%h"), /%h is left/],
-  ];
-  for (const [file, edit, pattern] of edits) {
-    const before = read(file(h));
-    writeFileSync(file(h), edit(before));
-    refuses(unit(h, { copy: COPY_B }), pattern);
-    writeFileSync(file(h), before);
-  }
-  assert.equal(unit(h, { copy: COPY_B }).code, 0);
-});
-
-test("a template with a namespace, user or system call restriction refuses", (t) => {
-  const h = hub(t);
-  for (const line of ["RestrictNamespaces=yes", "PrivateUsers=yes", "SystemCallFilter=@system-service"]) {
-    const key = line.split("=")[0];
-    for (const [from, env] of [[BUS_TEMPLATE, "CASE2_BUS_TEMPLATE"], [WEBUI_TEMPLATE, "CASE2_WEBUI_TEMPLATE"]]) {
-      const file = template(h, from, `t-${key}.in`, (s) => s.replace("NoNewPrivileges=yes", `NoNewPrivileges=yes\n${line}`));
-      refuses(unit(h, { env: { [env]: file } }), new RegExp(`refusing ${key}=`));
-    }
-  }
-  assert.equal(existsSync(busFile(h)), false);
-});
-
-test("the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none", (t) => {
-  const h = hub(t);
-  const gone = template(h, BUS_TEMPLATE, "no-env.in", (s) => s.replace(/^EnvironmentFile=.*\n/m, ""));
-  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: gone } }), /EnvironmentFile= must be exactly once/);
-  const elsewhere = template(h, BUS_TEMPLATE, "env-elsewhere.in", (s) => s.replace("EnvironmentFile=-@SESSION_ENV@", "EnvironmentFile=-/etc/other.env"));
-  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: elsewhere } }), /EnvironmentFile= must be exactly once/);
-  const added = template(h, WEBUI_TEMPLATE, "webui-env.in", (s) => s.replace("NoNewPrivileges=yes", "NoNewPrivileges=yes\nEnvironmentFile=-/etc/other.env"));
-  refuses(unit(h, { env: { CASE2_WEBUI_TEMPLATE: added } }), /refusing EnvironmentFile=/);
-});
-
-test("a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses", (t) => {
-  const h = hub(t);
-  const token = template(h, BUS_TEMPLATE, "token.in", (s) => s.replace("Type=simple", "Type=simple\nX-Note=@SECRET@"));
-  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: token } }), /a token is left after the render: @SECRET@/);
-  const webuiToken = template(h, WEBUI_TEMPLATE, "wtoken.in", (s) => s.replace("Type=simple", "Type=simple\nX-Note=@SECRET@"));
-  refuses(unit(h, { env: { CASE2_WEBUI_TEMPLATE: webuiToken } }), /a token other than one @FLAGS@/);
-  const pso = template(h, BUS_TEMPLATE, "pso.in", (s) => s.replace("Type=simple", "Type=simple\nPermissionsStartOnly=yes"));
-  refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: pso } }), /refusing PermissionsStartOnly=/);
-  for (const pre of ["+/srv/mosaic/x", "-+/srv/mosaic/x"]) {
-    const file = template(h, BUS_TEMPLATE, "pre.in", (s) => s.replace("Type=simple", `Type=simple\nExecStartPre=${pre}`));
-    refuses(unit(h, { env: { CASE2_BUS_TEMPLATE: file } }), /an Exec line that runs with full privileges: ExecStartPre=/);
-  }
-});
-
-test("a symlink at either unit path refuses", (t) => {
-  for (const name of ["[email protected]", "mosaic-webui.service"]) {
-    const h = hub(t);
-    const target = join(h.root, "elsewhere");
-    writeFileSync(target, "");
-    symlinkSync(target, join(h.units, name));
-    refuses(unit(h), new RegExp(`${name.replace(".", "\\.")} is a symlink`));
-  }
-});
-
-test("a --node that is relative, not root-owned or under <home> refuses", (t) => {
-  const h = hub(t);
-  refuses(unit(h, { node: "bin/node" }), /--node must be an absolute path/);
-  const mine = script(join(h.root, "opt", "node"), "exit 0");
-  refuses(unit(h, { node: mine }), /--node: .* is not owned by root/);
-  const inside = script(join(h.home, "bin", "node"), "exit 0");
-  refuses(unit(h, { node: inside }), /--node must be outside/);
-});
-
-test("a re-install with a different --node or different serve flags refuses", (t) => {
-  const h = hub(t);
-  assert.equal(unit(h).code, 0);
-  // A new node moves PATH too, so the installed unit fails its own Environment= check first.
-  refuses(unit(h, { node: outsideNode() }), /installed .*: the Environment= lines must be exactly/);
-  const flags = libraryFlags(h).map((f) => (f === "melanie" ? "someone" : f));
-  refuses(unit(h, { flags }), /installed .*: ExecStart= must be exactly once/);
-  // A line check_unit doesn't fix still has to equal the render.
-  writeFileSync(busFile(h), read(busFile(h)).replace(/^Description=.*$/m, "Description=edited"));
-  refuses(unit(h), /differs from the render in more than the copy id/);
-});
-
-test("an installed pair whose units name different copies refuses", (t) => {
-  const h = hub(t);
-  assert.equal(unit(h).code, 0);
-  writeFileSync(webuiFile(h), read(webuiFile(h)).replaceAll(COPY_A, COPY_B));
-  refuses(unit(h), new RegExp(`the installed units name different copies, ${COPY_A} and ${COPY_B}`));
-});
-
-test("a copy id that is short, uppercase, holds / or .., or names no directory refuses", (t) => {
-  const h = hub(t);
-  for (const copy of ["a".repeat(39), "A".repeat(40), `${"a".repeat(19)}/${"a".repeat(20)}`, `..${"a".repeat(38)}`]) {
-    refuses(unit(h, { copy }), /--copy must be a full 40-character lower-case commit id/);
-  }
-  refuses(unit(h, { copy: "c".repeat(40) }), /no copy directory/);
-});
-
-test("library refuses a privileged-floor miss, a bad proof pair and every flag outside its set", (t) => {
-  const h = hub(t);
-  const base = libraryFlags(h);
-  const without = (...names) => {
-    const out = [];
-    for (let i = 0; i < base.length; i++) {
-      if (names.includes(base[i])) { if (base[i] !== "--send") i++; continue; }
-      out.push(base[i]);
-    }
-    return out;
-  };
-  refuses(unit(h, { flags: base.map((f) => (f === "443" ? "7332" : f)) }), /--port must be 1\.\.1023/);
-  refuses(unit(h, { flags: without("--proof-header", "--proof-file") }), /serve flag --proof-header is required/);
-  refuses(unit(h, { flags: base.map((f) => (f === "X-Auth-User" ? "X-Authentik-Uid" : f)) }), /must be an Authentik uid/);
-  assert.equal(unit(h, { flags: base.map((f) => (f === "X-Auth-User" ? "X-Authentik-Uid" : f === "melanie" ? "0".repeat(64) : f)) }).code, 0);
-  rmSync(busFile(h));
-  rmSync(webuiFile(h));
-  for (const [flag, value, pattern] of [
-    ["--tester-port", "7333", /the library profile refuses --tester-port/],
-    ["--checkout", "/srv/x", /refusing --checkout/],
-    ["--board", "http://127.0.0.1:7331", /refusing --board/],
-    ["--sso", null, /refusing --sso/],
-    ["--nonsense", "1", /unknown serve flag: --nonsense/],
-  ]) {
-    refuses(unit(h, { flags: [...base, flag, ...(value === null ? [] : [value])] }), pattern);
-  }
-  refuses(unit(h, { flags: base.map((f) => (f === "acme" ? "other" : f)) }), /serve --business other is not the unit's business acme/);
-  refuses(unit(h, { extra: ["--pm"] }), /the library profile refuses --pm/);
-  refuses(unit(h, { extra: ["--claude", TRUE_BIN] }), /the library profile refuses --claude/);
-
-  chmodSync(h.proof, 0o644);
-  refuses(unit(h), /mode 0600 or 0400, not 644/);
-  chmodSync(h.proof, 0o600);
-  const link = join(h.secrets, "proof-link");
-  symlinkSync(h.proof, link);
-  refuses(unit(h, { flags: base.map((f) => (f === h.proof ? link : f)) }), /must not be a symlink/);
-  const dataRoot = join(h.home, ".mosaic-dev");
-  mkdirSync(dataRoot);
-  const outside = join(dataRoot, "proof");
-  writeFileSync(outside, "made-up-proof\n");
-  chmodSync(outside, 0o600);
-  refuses(unit(h, { flags: base.map((f) => (f === h.proof ? outside : f)) }), /must be under .*secrets, outside the data root/);
-  assert.equal(existsSync(busFile(h)), false);
-});
-
-// A non-root test can't make a root-owned file under the scratch home, so the
-// owner case names another uid in the passwd database instead.
-test("library refuses a proof file not owned by <user>'s uid", (t) => {
-  const h = hub(t, { uid: UID + 4242 });
-  refuses(unit(h), new RegExp(`proxy proof file must be owned by mosaic \\(uid ${UID + 4242}\\)`));
-});
-
-test("factory refuses a tester port on --port, a missing --port or --business, and each proxy flag", (t) => {
-  const h = hub(t);
-  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "443"] }), /--tester-port must be 1024\.\.65535|--tester-port must differ from --port/);
-  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "1443", "--port", "1443"] }), /given twice/);
-  refuses(unit(h, { profile: "factory", flags: ["--business", "acme"] }), /serve flag --port is required/);
-  refuses(unit(h, { profile: "factory", flags: ["--port", "443"] }), /serve flag --business is required/);
-  for (const [flag, value] of [["--public-host", "x.example"], ["--auth-header", "X-A"], ["--allow-user", "u"], ["--proof-header", "X-P"], ["--proof-file", h.proof], ["--send", null]]) {
-    refuses(unit(h, { profile: "factory", flags: [...factoryFlags(), flag, ...(value === null ? [] : [value])] }), new RegExp(`the factory profile refuses ${flag}`));
-  }
-  for (const [flag, value, pattern] of [["--checkout", "/srv/x", /refusing --checkout/], ["--board", "http://127.0.0.1:7331", /refusing --board/], ["--sso", null, /refusing --sso/], ["--nonsense", "1", /unknown serve flag/]]) {
-    refuses(unit(h, { profile: "factory", flags: [...factoryFlags(), flag, ...(value === null ? [] : [value])] }), pattern);
-  }
-});
-
-test("factory: the tester port equal to --port refuses", (t) => {
-  const h = hub(t);
-  refuses(unit(h, { profile: "factory", flags: ["--port", "443", "--business", "acme", "--tester-port", "443"] }), /--tester-port must be 1024\.\.65535/);
-  // Ports 1024 and up can't be the Console's, so the equality check is reached only through a port below 1024; it stays as a guard.
-  assert.match(read(UNIT), /--tester-port must differ from --port/);
-});
-
-test("factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude", (t) => {
-  const h = hub(t);
-  refuses(unit(h, { profile: "factory", extra: ["--claude", "bin/claude"] }), /--claude must be an absolute path/);
-  const mine = script(join(h.root, "opt", "claude"), "exit 0");
-  refuses(unit(h, { profile: "factory", extra: ["--claude", mine] }), /--claude: .* is not owned by root/);
-  const inside = script(join(h.home, "bin", "claude"), "exit 0");
-  refuses(unit(h, { profile: "factory", extra: ["--claude", inside] }), /--claude must be outside/);
-
-  assert.equal(unit(h, { profile: "factory", extra: ["--pm", "--claude", TRUE_BIN] }).code, 0);
-  refuses(unit(h, { profile: "factory", extra: ["--claude", TRUE_BIN] }), /--pm and --claude must equal the installed ones|ExecStart= must be exactly once/);
-  refuses(unit(h, { profile: "factory", extra: ["--pm"] }), /Environment= lines must be exactly|differs from the render/);
-  refuses(unit(h, { profile: "factory", extra: ["--pm", "--claude", USR_NODE] }), /Environment= lines must be exactly|differs from the render/);
-});
-
-// ---- case2-precheck.sh ----
-
-// A scratch user for the precheck: a config, a business file, an installed Console unit,
-// fakes on PATH and a fake /proc/sys.
-function host(t, { roles = {}, vars = {}, keyFile = `ZAI_API_KEY=${FIXTURE_KEY}\n`, port = "443", busClaude = null } = {}) {
-  const root = tmp(t, "case2-pre-");
-  const home = join(root, "home");
-  const configDir = join(home, ".config", "mosaic-dev");
-  const config = writeJson(join(configDir, "config.json"), {
-    configVersion: 1,
-    environment: "production",
-    dataRoot: join(home, ".mosaic-dev"),
-    execution: { backend: "docker", provider: "zai", model: "glm-5.3-flash", adapter: "pi" },
-  });
-  const doc = businessDoc(root);
-  doc.roles.cto.vars = { harness: "pi" };
-  for (const [name, v] of Object.entries(roles)) doc.roles[name].vars = v;
-  Object.assign(doc.vars, vars);
-  writeJson(join(configDir, "businesses", "acme.json"), doc);
-  const secrets = join(configDir, "secrets");
-  mkdirSync(secrets, { recursive: true, mode: 0o700 });
-  if (keyFile !== null) {
-    writeFileSync(join(secrets, "claude-session.env"), keyFile);
-    chmodSync(join(secrets, "claude-session.env"), 0o600);
-  }
-  const units = join(root, "units");
-  mkdirSync(units);
-  writeFileSync(join(units, "mosaic-webui.service"), `[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --port ${port} --business acme\n`);
-  writeFileSync(join(units, "[email protected]"), `[Service]\nEnvironment=PATH=/usr/bin\n${busClaude ? `Environment=MOSAIC_CLAUDE_BIN=${busClaude}\n` : ""}`);
-  const sys = join(root, "sys");
-  mkdirSync(join(sys, "net", "ipv4"), { recursive: true });
-  mkdirSync(join(sys, "kernel"), { recursive: true });
-  writeFileSync(join(sys, "net", "ipv4", "ip_unprivileged_port_start"), "1024\n");
-  writeFileSync(join(sys, "kernel", "apparmor_restrict_unprivileged_userns"), "1\n");
-  const bin = join(root, "bin");
-  const me = spawnSync("id", ["-un"], { encoding: "utf8" }).stdout.trim();
-  script(join(bin, "getent"), `[ "$1" = passwd ] && [ "$2" = '${me}' ] && echo '${me}:x:${UID}:${GID}::${home}:/bin/bash'`);
-  script(join(bin, "sudo"), "exit 1");
-  script(join(bin, "id"), `if [ "$1" = -G ]; then echo "\${CASE2_TEST_GROUPS:-${GID}}"; else exec /usr/bin/id "$@"; fi`);
-  script(join(bin, "node"), `if [ "$1" = --version ]; then echo "\${CASE2_TEST_NODE:-v24.3.0}"; exit 0; fi\nexec '${process.execPath}' "$@"`);
-  script(join(bin, "bwrap"), `exit "\${CASE2_TEST_BWRAP:-0}"`);
-  return { root, home, configDir, config, secrets, units, sys, bin, dataRoot: join(home, ".mosaic-dev") };
-}
-
-// A fake claude: replace answers with the marker and a small prompt; append answers with a large one;
-// nomarker answers with a small prompt and no marker; text answers with plain text, not JSON.
-function fakeClaude(dir, kind) {
-  return script(join(dir, "claude"), `[ "$1" = --version ] && { echo "9.9.9 (Claude Code, ${kind} fake)"; exit 0; }
-file=''
-while [ $# -gt 0 ]; do [ "$1" = --system-prompt-file ] && file="$2"; shift; done
-marker="$(awk '{ print $NF }' "$file")"
-${kind === "nomarker" ? "marker=something-else" : ""}
-${kind === "text" ? 'echo "$marker"; exit 0' : ""}
-tokens=${kind === "append" ? 9000 : 40}
-printf '{"result":"%s","usage":{"input_tokens":%s,"cache_read_input_tokens":0}}\\n' "$marker" "$tokens"`);
-}
-
-// This host may have a claude in /usr/bin, so this PATH links every /usr/bin entry but that one.
-function pathWithoutClaude(x) {
-  const usr = join(x.root, "usr-bin");
-  mkdirSync(usr);
-  for (const name of readdirSync("/usr/bin")) if (name !== "claude") symlinkSync(join("/usr/bin", name), join(usr, name));
-  return `${x.bin}:${usr}`;
-}
-
-function precheck(x, { profile = "library", env = {}, path } = {}) {
-  const r = spawnSync(PRECHECK, ["--business", "acme", "--profile", profile], {
-    encoding: "utf8",
-    timeout: 60000,
-    env: {
-      PATH: path ?? `${x.bin}:/usr/bin:/bin`,
-      HOME: x.home,
-      MOSAIC_CONFIG: x.config,
-      CASE2_UNIT_DIR: x.units,
-      CASE2_PROC_SYS: x.sys,
-      CASE2_GETENT: join(x.bin, "getent"),
-      ...env,
-    },
-  });
-  const out = r.stdout + r.stderr;
-  assert.doesNotMatch(out, new RegExp(FIXTURE_KEY), "the precheck printed the fixture key");
-  return { code: r.status, out };
-}
-
-function blocked(r, pattern) {
-  assert.equal(r.code, 1, r.out);
-  assert.match(r.out, pattern);
-}
-
-test("the precheck passes on a good host and prints free memory, without the key", (t) => {
-  const x = host(t);
-  const r = precheck(x);
-  assert.equal(r.code, 0, r.out);
-  assert.match(r.out, /ok {6}config validates/);
-  assert.match(r.out, /ok {6}bus\.tester is off/);
-  assert.match(r.out, /ok {6}net\.ipv4\.ip_unprivileged_port_start 1024 is above the Console's port 443/);
-  assert.match(r.out, /claude-session\.env sets ZAI_API_KEY/);
-  assert.match(r.out, /free memory: \d+ MiB/);
-  assert.doesNotMatch(r.out, /claude .*fake|marker/);
-});
-
-test("the precheck refuses each failed host check", (t) => {
-  blocked(precheck(host(t), { env: { CASE2_TEST_NODE: "v22.22.2" } }), /REFUSED node v22\.22\.2 is older than 24/);
-  blocked(precheck(host(t), { env: { CASE2_TEST_GROUPS: `${GID} 998` } }), /REFUSED id -G prints more than one group/);
-  const sudo = host(t);
-  script(join(sudo.bin, "sudo"), "exit 0");
-  blocked(precheck(sudo), /REFUSED sudo -n true succeeds/);
-  blocked(precheck(host(t), { env: { XDG_DATA_HOME: "/elsewhere" } }), /REFUSED XDG_DATA_HOME is \/elsewhere/);
-  const home = host(t);
-  assert.equal(precheck(home, { env: { XDG_DATA_HOME: `${home.home}/.local/share` } }).code, 0);
-  blocked(precheck(host(t), { env: { HOME: "/tmp" } }), /REFUSED HOME is \/tmp/);
-
-  const runs = host(t);
-  mkdirSync(join(runs.dataRoot, "launches", "acme"), { recursive: true, mode: 0o755 });
-  chmodSync(join(runs.dataRoot, "launches", "acme"), 0o755);
-  blocked(precheck(runs), /REFUSED run root .* is not a 0700 directory \(mode 755\)/);
-  chmodSync(join(runs.dataRoot, "launches", "acme"), 0o700);
-  assert.match(precheck(runs).out, /ok {6}run root .* is 0700/);
-
-  const bad = host(t);
-  writeFileSync(bad.config, "{ not json");
-  blocked(precheck(bad), /REFUSED config:/);
-});
-
-test("the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root", (t) => {
-  const nouser = host(t);
-  script(join(nouser.bin, "getent"), "exit 2");
-  blocked(precheck(nouser), /REFUSED user: no .* in the passwd database/);
-
-  const unparsed = host(t);
-  writeFileSync(join(unparsed.configDir, "businesses", "acme.json"), "{ not json");
-  blocked(precheck(unparsed), /REFUSED business file: cannot read .*acme\.json/);
-  const gone = host(t);
-  rmSync(join(gone.configDir, "businesses", "acme.json"));
-  blocked(precheck(gone), /REFUSED business file: cannot read .*acme\.json: ENOENT/);
-  const invalid = host(t);
-  const file = join(invalid.configDir, "businesses", "acme.json");
-  const doc = JSON.parse(read(file));
-  doc.notAField = true;
-  writeJson(file, doc);
-  const r = precheck(invalid);
-  blocked(r, /REFUSED business file: /);
-  assert.doesNotMatch(r.out, /REFUSED business file: cannot read/);
-
-  // stat follows a link, so a link to a 0700 directory would read as 0700.
-  const link = host(t);
-  const target = join(link.root, "elsewhere");
-  mkdirSync(target, { mode: 0o700 });
-  chmodSync(target, 0o700);
-  mkdirSync(join(link.dataRoot, "launches"), { recursive: true });
-  symlinkSync(target, join(link.dataRoot, "launches", "acme"));
-  blocked(precheck(link), /REFUSED run root .* is a symlink/);
-});
-
-test("a bwrap that fails refuses and prints the sysctl and where bwrap is", (t) => {
-  const x = host(t);
-  blocked(precheck(x, { env: { CASE2_TEST_BWRAP: "1" } }), new RegExp(`REFUSED bwrap .* failed; bwrap: ${join(x.bin, "bwrap")}; kernel\\.apparmor_restrict_unprivileged_userns: 1`));
-});
-
-test("an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit", (t) => {
-  for (const floor of ["443", "80"]) {
-    const x = host(t);
-    writeFileSync(join(x.sys, "net", "ipv4", "ip_unprivileged_port_start"), `${floor}\n`);
-    blocked(precheck(x), new RegExp(`REFUSED net\\.ipv4\\.ip_unprivileged_port_start is ${floor}, at or below the Console's port 443`));
-  }
-  const x = host(t);
-  rmSync(join(x.units, "mosaic-webui.service"));
-  blocked(precheck(x), /REFUSED no installed Console unit/);
-  const noPort = host(t);
-  writeFileSync(join(noPort.units, "mosaic-webui.service"), "[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --business acme\n");
-  blocked(precheck(noPort), /REFUSED .*mosaic-webui\.service has no --port in its ExecStart/);
-  const noFloor = host(t);
-  rmSync(join(noFloor.sys, "net", "ipv4", "ip_unprivileged_port_start"));
-  blocked(precheck(noFloor), /REFUSED cannot read net\.ipv4\.ip_unprivileged_port_start/);
-});
-
-test("bus.tester: library refuses it on, factory needs it on, and factory refuses a library business", (t) => {
-  blocked(precheck(host(t, { vars: { "bus.tester": true } })), /REFUSED bus\.tester is on; the library profile needs it off/);
-  blocked(precheck(host(t), { profile: "factory" }), /REFUSED bus\.tester is off; the factory profile needs it on/);
-  const on = precheck(host(t, { vars: { "bus.tester": true } }), { profile: "factory" });
-  assert.equal(on.code, 0, on.out);
-  const lib = host(t, { vars: { "bus.tester": true } });
-  const file = join(lib.configDir, "businesses", "acme.json");
-  const doc = JSON.parse(read(file));
-  doc.projects.stack.kind = "library";
-  writeJson(file, doc);
-  blocked(precheck(lib, { profile: "factory" }), /REFUSED profile-library-business: .* projects stack are library projects/);
-});
-
-test("the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong", (t) => {
-  // No claude-code instance and no claude anywhere on PATH: the precheck passes.
-  const none = host(t);
-  const r = precheck(none, { path: pathWithoutClaude(none) });
-  assert.equal(r.code, 0, r.out);
-  assert.doesNotMatch(r.out, /--system-prompt-file|claude is installed/);
-
-  const good = host(t, { roles: { cto: { harness: "claude-code" } } });
-  fakeClaude(good.bin, "replace");
-  const pass = precheck(good);
-  assert.equal(pass.code, 0, pass.out);
-  assert.match(pass.out, /claude .*9\.9\.9 \(Claude Code, replace fake\)/);
-  assert.match(pass.out, /ok {6}claude replaces its prompt with --system-prompt-file \(40 input tokens\)/);
-
-  const bad = host(t, { roles: { cto: { harness: "claude-code" } } });
-  fakeClaude(bad.bin, "append");
-  blocked(precheck(bad), /REFUSED claude adds to its own prompt with --system-prompt-file: 9000 input tokens/);
-
-  const nomarker = host(t, { roles: { cto: { harness: "claude-code" } } });
-  fakeClaude(nomarker.bin, "nomarker");
-  blocked(precheck(nomarker), /REFUSED claude's reply to the marker prompt lacks the marker \(40 input tokens\)/);
-
-  const text = host(t, { roles: { cto: { harness: "claude-code" } } });
-  fakeClaude(text.bin, "text");
-  blocked(precheck(text), /REFUSED claude gave no JSON reply to the marker prompt/);
-
-  const missing = host(t, { roles: { cto: { harness: "claude-code" } } });
-  blocked(precheck(missing, { path: pathWithoutClaude(missing) }), /REFUSED an instance runs claude-code and no claude is installed/);
-});
-
-test("the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH", (t) => {
-  const pinned = join(tmp(t, "case2-claude-"), "pinned");
-  const replace = fakeClaude(pinned, "replace");
-  const x = host(t, { roles: { cto: { harness: "claude-code" } }, busClaude: replace });
-  fakeClaude(x.bin, "append");
-  const r = precheck(x);
-  assert.equal(r.code, 0, r.out);
-  assert.match(r.out, /replace fake/);
-
-  const pinnedBad = join(tmp(t, "case2-claude-"), "pinned");
-  const append = fakeClaude(pinnedBad, "append");
-  const y = host(t, { roles: { cto: { harness: "claude-code" } }, busClaude: append });
-  fakeClaude(y.bin, "replace");
-  blocked(precheck(y), /REFUSED claude adds to its own prompt/);
-});
-
-test("the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line", (t) => {
-  blocked(precheck(host(t, { keyFile: null })), /REFUSED an instance's provider is zai and .*claude-session\.env is missing/);
-  const open = host(t);
-  chmodSync(join(open.secrets, "claude-session.env"), 0o644);
-  blocked(precheck(open), /REFUSED .*claude-session\.env must be owned by .* at 0600 \(mode 644\)/);
-  const link = host(t, { keyFile: null });
-  const real = join(link.root, "real.env");
-  writeFileSync(real, `ZAI_API_KEY=${FIXTURE_KEY}\n`);
-  chmodSync(real, 0o600);
-  symlinkSync(real, join(link.secrets, "claude-session.env"));
-  blocked(precheck(link), /REFUSED .*claude-session\.env is a symlink/);
-  blocked(precheck(host(t, { keyFile: "ZAI_API_KEY=\n" })), /REFUSED .*sets no nonempty ZAI_API_KEY/);
-  blocked(precheck(host(t, { keyFile: `ZAI_API_KEY=${FIXTURE_KEY}\nZAI_API_KEY=\n` })), /REFUSED .*sets no nonempty ZAI_API_KEY/);
-  const quoted = precheck(host(t, { keyFile: `ZAI_API_KEY=\nZAI_API_KEY="${FIXTURE_KEY}"\n` }));
-  assert.equal(quoted.code, 0, quoted.out);
-});
-
-// ---- the bind test (mos-1100) ----
-
-// A session can't take the Console's port: inside the sandbox a real session gets, a bind below
-// 1024 fails with EACCES, and the same bind on a free port of 1024 or above succeeds.
-const sandboxSkip = sandboxProblem() ?? false;
-const LOW_PORT = 980;
-test("inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds", { skip: sandboxSkip, timeout: 30000 }, async (t) => {
-  const floor = Number(read("/proc/sys/net/ipv4/ip_unprivileged_port_start").trim());
-  assert.ok(floor > LOW_PORT, `this host's net.ipv4.ip_unprivileged_port_start is ${floor}, at or below the test port ${LOW_PORT}, so the test can't show the sandbox refuses it`);
-  const root = tmp(t, "c2b-");
-  const runDir = join(root, "run");
-  const workspace = join(root, "ws");
-  mkdirSync(runDir);
-  mkdirSync(workspace);
-  mkdirSync(join(runDir, "bundle"));
-  writeFileSync(join(runDir, "session.json"), "{}");
-  const adapter = join(root, "adapter.sh");
-  const brokerSocket = join(root, "broker.sock");
-  writeFileSync(adapter, "");
-  writeFileSync(brokerSocket, "");
-  prepareRun(runDir);
-  const list = binds({ runDir, workspace, adapter, harnessMounts: [], brokerSocket });
-  const high = await new Promise((done) => {
-    const s = createServer().listen(0, "127.0.0.1", () => { const { port } = s.address(); s.close(() => done(port)); });
-  });
-  const bindIn = (port) => {
-    const code = `require("net").createServer().on("error", (e) => { console.log(e.code); process.exit(0); }).listen(${port}, "127.0.0.1", function () { console.log("bound"); this.close(); });`;
-    const argv = sandboxArgv(list, runDir, [process.execPath, "-e", code], { business: "acme", role: "coder" });
-    const r = spawnSync(argv[0], argv.slice(1), { encoding: "utf8", timeout: 10000 });
-    assert.equal(r.status, 0, r.stderr);
-    return r.stdout.trim();
-  };
-  assert.equal(bindIn(LOW_PORT), "EACCES");
-  assert.equal(bindIn(high), "bound");
-});
@@ -266,6 +266,25 @@ test("T3: a push recorded while the bus process pushes refuses decision-mismatch
  assert.ok(w.logs.some((l) => l.includes("wasn't recorded")));
 });

+test("row 237: two publishes race on one decision; the second refuses publish-busy and exactly one push reaches the fork", async (t) => {
+  const w = await setup(t);
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  const d = w.approve();
+  // The second publish, to another branch, runs while the first holds its ticket.
+  let second;
+  w.hooks.checkPublish = async (m, next) => {
+    const facts = await next();
+    if (m.args.branch === "feat") second = await w.publish(d, { branch: "other" });
+    return facts;
+  };
+  const first = await w.publish(d);
+  assert.deepEqual(second, { ok: false, error: "publish-busy" });
+  assert.equal(first.ok, true);
+  assert.equal(w.gitea.requests.filter((r) => r.path.endsWith("/git-receive-pack")).length, 1);
+  assert.equal(git(w.root, `--git-dir=${w.forkRepo}`, "for-each-ref", "--format=%(refname)", "refs/heads/coder/"), "refs/heads/coder/feat");
+  assert.equal(w.events("action.allowed").filter((e) => e.body.action === "git.push.remote" && e.body.operation !== "decision.raise").length, 1);
+});
+
 test("sage-1440: the publishResult poll is bounded: publish-timeout, filed once, and nothing recorded", async (t) => {
  const w = await setup(t, { publishDeadlineMs: 150 });
  let polls = 0;
@@ -2096,14 +2096,6 @@ test('T57 row 200: activate --sso, its refusals before any stop, and the rollbac
  assert.ok(stepText(a).includes(`Z drop --sso; ${B}'s Console does not support it, so the Console flags come from ${set}/${show}\n`));
  await noLeak(a);
 });
- await t.test('row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands',async(t)=>{
-  const e=await mk(t),a=await named(e,'alpha');await seed(a);
-  assert.equal(JSON.parse(readFileSync(a.cfg,'utf8')).console,undefined);
-  await refused(a,['activate',C1,'acme','--sso'],'sso-config',`${C1}'s Console would refuse its --sso start: there is no console.sso in the system config; activate ${C1} --instance alpha without --sso first, then write console.sso, then run activate ${C1} --instance alpha --sso`);
-  const out=await planOnly(a,3,'activate',C1,'acme','--sso');
-  assert.ok(out.includes(`refuses sso-config: ${C1}'s Console would refuse its --sso start: there is no console.sso in the system config; activate ${C1} --instance alpha without --sso first, then write console.sso, then run activate ${C1} --instance alpha --sso`),out.join('\n'));
-  await noLeak(a);
- });
 });

 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
@@ -1,241 +0,0 @@
-#!/usr/bin/env bash
-# Case 2 row C2-13a (design 10 step 8): the host checks a hub needs before
-# its units start. It runs as <user>, after root's 2c step, and changes
-# nothing. It runs every check, prints one line for each, and refuses if
-# any one failed.
-#
-#   case2-precheck.sh --business ID [--profile factory|library]
-#
-# Checks: the config and business file validate; `sudo -n true` fails and
-# `id -G` prints one group; bus.tester is off for library and on for factory,
-# and factory refuses a business file with a library project
-# (profile-library-business); the run root is 0700; XDG_DATA_HOME is unset or
-# <home>/.local/share; node is 24 or later; bwrap runs; the unprivileged port
-# floor is above the installed Console unit's --port; the host's claude
-# replaces its default prompt with --system-prompt-file, when some instance
-# runs claude-code; and claude-session.env sets ZAI_API_KEY, when some
-# instance's provider is zai. It prints free memory and checks that HOME is
-# <home>. It never prints a value from claude-session.env.
-#
-# Test seams, for packages/cli/tests/case2-unit.test.mjs only:
-#   CASE2_UNIT_DIR   the installed units, default /etc/systemd/system
-#   CASE2_PROC_SYS   default /proc/sys
-#   CASE2_GETENT     the getent command, default getent
-#
-# Exit 0 every check passed, 1 refused, 4 usage.
-set -uo pipefail
-REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-UNIT_DIR="${CASE2_UNIT_DIR:-/etc/systemd/system}"
-PROC_SYS="${CASE2_PROC_SYS:-/proc/sys}"
-GETENT="${CASE2_GETENT:-getent}"
-BUS_UNIT="$UNIT_DIR/[email protected]"
-WEBUI_UNIT="$UNIT_DIR/mosaic-webui.service"
-# The most input tokens a marker run may report with its prompt replaced.
-# Claude Code's own prompt is many times this.
-MARKER_TOKEN_CEILING=2000
-
-usage() { echo 'usage: case2-precheck.sh --business ID [--profile factory|library]' >&2; exit 4; }
-PROFILE=library BUSINESS=''
-while [ $# -gt 0 ]; do
-    case "$1" in
-        --profile) [ $# -ge 2 ] || usage; PROFILE="$2"; shift 2 ;;
-        --business) [ $# -ge 2 ] || usage; BUSINESS="$2"; shift 2 ;;
-        *) usage ;;
-    esac
-done
-[ -n "$BUSINESS" ] || usage
-case "$PROFILE" in factory|library) ;; *) echo "case2-precheck: --profile must be factory or library: $PROFILE" >&2; exit 4 ;; esac
-[[ "$BUSINESS" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]] || { echo "case2-precheck: --business must be a business id: $BUSINESS" >&2; exit 4; }
-
-FAILED=0
-ok() { echo "ok      $1"; }
-refuse() { echo "REFUSED $1"; FAILED=1; }
-
-# One setting's value from an installed unit: the last KEY= line in the file.
-unit_value() { [ -f "$1" ] && sed -n "s/^[[:space:]]*$2[[:space:]]*=[[:space:]]*//p" -- "$1" | tail -n 1; }
-
-# The last assignment of NAME in an EnvironmentFile, quotes removed, as
-# systemd reads it. Prints the value; the callers never echo it.
-env_value() {
-    awk -v name="$2" '
-        { sub(/^[ \t]+/, "") }
-        /^[#;]/ || $0 == "" { next }
-        {
-            i = index($0, "="); if (i == 0) next
-            k = substr($0, 1, i - 1); sub(/[ \t]+$/, "", k)
-            if (k != name) next
-            v = substr($0, i + 1); sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-            if (v ~ /^".*"$/ || v ~ /^\x27.*\x27$/) v = substr(v, 2, length(v) - 2)
-            last = v; found = 1
-        }
-        END { if (found) printf "%s", last }' "$1"
-}
-
-# The user and its home from the passwd database.
-ME="$(id -un)"
-ME_UID="$(id -u)"
-PW="$("$GETENT" passwd "$ME")" || { refuse "user: no $ME in the passwd database"; PW=''; }
-IFS=: read -r _ _ _ _ _ PW_HOME _ <<<"$PW"
-if [ -n "${PW_HOME:-}" ] && [ "${HOME:-}" = "$PW_HOME" ]; then ok "HOME is $PW_HOME"
-else refuse "HOME is ${HOME:-unset}, not $ME's home ${PW_HOME:-unknown}"; fi
-HOME_DIR="${PW_HOME:-$HOME}"
-
-# The config, then the business file through the same loaders the bus uses.
-# The helper prints tab-separated facts and never a credential.
-facts="$(cd "$REPO" && node --input-type=module -e '
-import { readFileSync } from "node:fs";
-const [repo, id] = process.argv.slice(1);
-const { loadSystem, rolesDir } = await import(`${repo}/packages/cli/src/config.mjs`);
-const { businessFilePath, configDir, loadBusiness, resolveInstance, systemVars } = await import(`${repo}/packages/business/src/index.mjs`);
-const say = (...f) => console.log(f.join("\t"));
-let system;
-try { system = loadSystem(); } catch (e) { say("CONFIG", "bad", e.message.split("\n")[0]); process.exit(0); }
-say("CONFIG", "ok", system.dataRoot, configDir());
-const file = businessFilePath(id);
-let raw;
-try { raw = JSON.parse(readFileSync(file, "utf8")); } catch (e) { say("BUSINESS", "bad", `cannot read ${file}: ${e.code ?? e.message}`); process.exit(0); }
-const library = Object.entries(raw?.projects ?? {}).filter(([, p]) => p && p.kind === "library").map(([k]) => k);
-if (library.length) say("LIBRARY", library.join(","));
-let b;
-try { b = loadBusiness(id, { rolesDir: rolesDir() }); } catch (e) { say("BUSINESS", "bad", e.message.split("\n")[0]); process.exit(0); }
-say("BUSINESS", "ok", file);
-say("TESTER", b.vars["bus.tester"] === true ? "on" : "off");
-const vars = systemVars(system);
-const models = b.launch?.models ?? null;
-for (const instance of Object.keys(b.roles)) {
-  const v = resolveInstance({ system: vars, business: b, instance }).vars;
-  for (const [h, m] of [["harness", "model"], ["fallback.harness", "fallback.model"]]) {
-    if (typeof v[h] !== "string") continue;
-    const provider = models && Object.hasOwn(models, v[m]) ? models[v[m]].provider : "";
-    say("ROUTE", instance, v[h], provider);
-  }
-}
-' "$REPO" "$BUSINESS" 2>&1)" || true
-
-line() { printf '%s\n' "$facts" | awk -F'\t' -v k="$1" '$1 == k' ; }
-cfg="$(line CONFIG)"
-DATA_ROOT='' CONFIG_DIR=''
-case "$cfg" in
-    "CONFIG	ok	"*) IFS=$'\t' read -r _ _ DATA_ROOT CONFIG_DIR <<<"$cfg"; ok "config validates (data root $DATA_ROOT)" ;;
-    "CONFIG	bad	"*) refuse "config: ${cfg#CONFIG	bad	}" ;;
-    *) refuse "config: the check did not run: $(printf '%s' "$facts" | head -n 1)" ;;
-esac
-
-# Tester and profile.
-library="$(line LIBRARY | cut -f2)"
-biz="$(line BUSINESS)"
-if [ "$PROFILE" = factory ] && [ -n "$library" ]; then
-    refuse "profile-library-business: the factory profile refuses business $BUSINESS, whose projects $library are library projects"
-elif [ -n "$cfg" ] && [ "${cfg#CONFIG	ok}" != "$cfg" ]; then
-    case "$biz" in
-        "BUSINESS	ok	"*)
-            ok "business file ${biz#BUSINESS	ok	} validates"
-            tester="$(line TESTER | cut -f2)"
-            if [ "$PROFILE" = library ] && [ "$tester" = on ]; then refuse "bus.tester is on; the library profile needs it off"
-            elif [ "$PROFILE" = factory ] && [ "$tester" != on ]; then refuse "bus.tester is off; the factory profile needs it on"
-            else ok "bus.tester is $tester"; fi ;;
-        *) refuse "business file: ${biz#BUSINESS	bad	}" ;;
-    esac
-fi
-
-# No sudo, and one group.
-if sudo -n true >/dev/null 2>&1; then refuse "sudo -n true succeeds as $ME"; else ok "sudo -n true fails as $ME"; fi
-groups="$(id -G)"
-if [ "$(printf '%s\n' "$groups" | wc -w)" -eq 1 ]; then ok "id -G prints one group ($groups)"
-else refuse "id -G prints more than one group: $groups"; fi
-
-# The run root (packages/seat/src/session.mjs runsDir). newRun makes it
-# 0700, so before the first launch it may not exist yet.
-if [ -n "$DATA_ROOT" ]; then
-    runs="$DATA_ROOT/launches/$BUSINESS"
-    if [ -L "$runs" ]; then refuse "run root $runs is a symlink"
-    elif [ ! -e "$runs" ]; then ok "run root $runs does not exist yet; the first launch makes it 0700"
-    elif [ "$(stat -c '%a' -- "$runs")" = 700 ] && [ -d "$runs" ]; then ok "run root $runs is 0700"
-    else refuse "run root $runs is not a 0700 directory (mode $(stat -c '%a' -- "$runs"))"; fi
-fi
-
-# XDG_DATA_HOME, which copy_root reads (scripts/stack-copy.sh:8).
-if [ -z "${XDG_DATA_HOME+x}" ] || [ "$XDG_DATA_HOME" = "$HOME_DIR/.local/share" ]; then ok "XDG_DATA_HOME is ${XDG_DATA_HOME:-unset}"
-else refuse "XDG_DATA_HOME is $XDG_DATA_HOME; the unit runs the copy under $HOME_DIR/.local/share"; fi
-
-# node 24 or later, every package's engines field.
-nv="$(node --version 2>/dev/null)" || nv=''
-major="${nv#v}"; major="${major%%.*}"
-if [[ "$major" =~ ^[0-9]+$ ]] && [ "$major" -ge 24 ]; then ok "node $nv"
-else refuse "node ${nv:-not found} is older than 24"; fi
-
-# bwrap, as a session needs it.
-if bwrap --unshare-all --ro-bind / / true >/dev/null 2>&1; then ok "bwrap --unshare-all runs"
-else
-    userns="$(cat "$PROC_SYS/kernel/apparmor_restrict_unprivileged_userns" 2>/dev/null || echo absent)"
-    where="$(command -v bwrap || echo 'not on PATH')"
-    refuse "bwrap --unshare-all --ro-bind / / true failed; bwrap: $where; kernel.apparmor_restrict_unprivileged_userns: $userns"
-fi
-
-# The port floor, against the installed Console unit's --port (design 9.3).
-floor="$(cat "$PROC_SYS/net/ipv4/ip_unprivileged_port_start" 2>/dev/null)" || floor=''
-port="$(unit_value "$WEBUI_UNIT" ExecStart | awk '{ for (i = 1; i < NF; i++) if ($i == "--port") p = $(i + 1) } END { print p }')"
-if [ ! -f "$WEBUI_UNIT" ]; then refuse "no installed Console unit $WEBUI_UNIT"
-elif ! [[ "$port" =~ ^[0-9]+$ ]]; then refuse "$WEBUI_UNIT has no --port in its ExecStart"
-elif ! [[ "$floor" =~ ^[0-9]+$ ]]; then refuse "cannot read net.ipv4.ip_unprivileged_port_start"
-elif [ "$floor" -le "$port" ]; then refuse "net.ipv4.ip_unprivileged_port_start is $floor, at or below the Console's port $port, so any $ME process can bind it"
-else ok "net.ipv4.ip_unprivileged_port_start $floor is above the Console's port $port"; fi
-
-routes="$(line ROUTE)"
-SESSION_ENV="${CONFIG_DIR:-$HOME_DIR/.config/mosaic-dev}/secrets/claude-session.env"
-# The session env file, checked as the bus unit's EnvironmentFile.
-env_file_ok() {
-    [ ! -L "$SESSION_ENV" ] && [ -f "$SESSION_ENV" ] && [ "$(stat -c '%u' -- "$SESSION_ENV")" = "$ME_UID" ] && [ "$(stat -c '%a' -- "$SESSION_ENV")" = 600 ]
-}
-
-# Claude Code replaces its prompt with --system-prompt-file.
-if printf '%s\n' "$routes" | awk -F'\t' '$3 == "claude-code" { f = 1 } END { exit !f }'; then
-    claude="$(unit_value "$BUS_UNIT" Environment | sed -n 's/^MOSAIC_CLAUDE_BIN=//p')"
-    claude="${claude:-$(command -v claude || true)}"
-    if [ -z "$claude" ] || [ ! -x "$claude" ]; then refuse "an instance runs claude-code and no claude is installed"
-    else
-        echo "        claude $claude: $("$claude" --version 2>/dev/null | head -n 1)"
-        work="$(mktemp -d)"
-        marker="case2-marker-$(od -An -N6 -tx1 /dev/urandom | tr -d ' \n')"
-        printf 'Reply with exactly this text and nothing else: %s\n' "$marker" >"$work/prompt.md"
-        out="$(cd "$work" && (
-            if env_file_ok; then
-                while IFS= read -r l; do
-                    case "$l" in [A-Za-z_]*=*) k="${l%%=*}"; [[ "$k" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] && export "$k=$(env_value "$SESSION_ENV" "$k")" ;; esac
-                done <"$SESSION_ENV"
-            fi
-            timeout 180 "$claude" -p --system-prompt-file "$work/prompt.md" --tools "" --setting-sources "" \
-                --no-session-persistence --output-format json "Reply now." 2>/dev/null
-        ))" || out=''
-        rm -rf -- "$work"
-        verdict="$(printf '%s' "$out" | node -e '
-            let s = ""; process.stdin.on("data", (d) => (s += d)).on("end", () => {
-              const [marker, ceiling] = process.argv.slice(1);
-              let r; try { r = JSON.parse(s); } catch { console.log("noreply"); return; }
-              const u = r.usage ?? {};
-              const n = (u.input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0);
-              if (!String(r.result ?? "").includes(marker)) console.log(`nomarker ${n}`);
-              else console.log(`${n <= Number(ceiling) ? "replaced" : "appended"} ${n}`);
-            });' "$marker" "$MARKER_TOKEN_CEILING")"
-        case "$verdict" in
-            replaced\ *) ok "claude replaces its prompt with --system-prompt-file (${verdict#replaced } input tokens)" ;;
-            appended\ *) refuse "claude adds to its own prompt with --system-prompt-file: ${verdict#appended } input tokens, more than $MARKER_TOKEN_CEILING" ;;
-            nomarker\ *) refuse "claude's reply to the marker prompt lacks the marker (${verdict#nomarker } input tokens)" ;;
-            *) refuse "claude gave no JSON reply to the marker prompt" ;;
-        esac
-    fi
-fi
-
-# ZAI_API_KEY, when some instance's provider is zai (design 10 step 2d).
-if printf '%s\n' "$routes" | awk -F'\t' '$4 == "zai" { f = 1 } END { exit !f }'; then
-    if [ -L "$SESSION_ENV" ]; then refuse "$SESSION_ENV is a symlink"
-    elif [ ! -f "$SESSION_ENV" ]; then refuse "an instance's provider is zai and $SESSION_ENV is missing"
-    elif ! env_file_ok; then refuse "$SESSION_ENV must be owned by $ME at 0600 (mode $(stat -c '%a' -- "$SESSION_ENV"))"
-    elif [ -z "$(env_value "$SESSION_ENV" ZAI_API_KEY)" ]; then refuse "$SESSION_ENV sets no nonempty ZAI_API_KEY"
-    else ok "$SESSION_ENV sets ZAI_API_KEY"; fi
-fi
-
-echo "        free memory: $(awk '$1 == "MemAvailable:" { printf "%d MiB", $2 / 1024 }' /proc/meminfo)"
-if [ "$FAILED" = 0 ]; then echo "case2-precheck: every check passed"; exit 0; fi
-echo "case2-precheck: refused"
-exit 1
@@ -1,425 +0,0 @@
-#!/usr/bin/env bash
-# Case 2 row C2-13a (design 9.3, 10 step 2c): render and install the two
-# system units a hub runs as, [email protected] (enabled as
-# mosaic-bus@<business>.service) and mosaic-webui.service, from the existing
-# templates, which it doesn't change.
-#
-#   case2-unit.sh --user NAME --home DIR --business ID --copy ID --node PATH
-#                 [--profile factory|library] [--pm] [--claude PATH]
-#                 -- SERVE FLAGS
-#
-# Root runs it from a root-owned checkout of the reviewed commit outside
-# <home>, never from the release, because <user> can write the release. It
-# writes both units under /etc/systemd/system as root:root 0644, runs
-# `systemctl daemon-reload`, enables both, then starts the bus and then the
-# Console (Q189). Both come back after a boot on their own. It never links
-# a unit file into place, and it opens no file under <home>: it only stats the
-# copy, its scripts/mosaic and the proof file. It renders the default
-# instance only.
-#
-# The library profile takes exactly these serve flags, each once:
-#   --port N (1..1023)  --business ID (the unit's)  --public-host NAME
-#   --auth-header HEADER  --allow-user ID  --send
-#   --proof-header NAME  --proof-file PATH
-# The factory profile takes --port N (1..1023) and --business ID, and an
-# optional --tester-port N (1024..65535, never --port). Only factory takes
-# --pm and --claude.
-#
-# On a re-install the installed units must equal the render in everything
-# but the copy id, and both must name one copy, so a re-pin or rollback
-# re-renders the pair together. A unit that was already running stays on its
-# old copy, since `systemctl start` leaves it alone; the script says so and
-# that the bus and Console must restart together, and restarts nothing.
-#
-# Test seams, for packages/cli/tests/case2-unit.test.mjs only:
-#   CASE2_UNIT_DIR        the unit directory, default /etc/systemd/system;
-#                         the root and root-owned checks apply only there
-#   CASE2_SYSTEMCTL       the systemctl command, default systemctl
-#   CASE2_GETENT          the getent command, default getent
-#   CASE2_BUS_TEMPLATE    default packages/cli/systemd/mosaic-bus.service.in
-#   CASE2_WEBUI_TEMPLATE  default packages/webui/systemd/mosaic-webui.service.in
-#
-# Exit 0 done, 1 refused, 4 usage.
-set -euo pipefail
-REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-DEFAULT_UNIT_DIR=/etc/systemd/system
-UNIT_DIR="${CASE2_UNIT_DIR:-$DEFAULT_UNIT_DIR}"
-SYSTEMCTL="${CASE2_SYSTEMCTL:-systemctl}"
-GETENT="${CASE2_GETENT:-getent}"
-BUS_TEMPLATE="${CASE2_BUS_TEMPLATE:-$REPO/packages/cli/systemd/mosaic-bus.service.in}"
-WEBUI_TEMPLATE="${CASE2_WEBUI_TEMPLATE:-$REPO/packages/webui/systemd/mosaic-webui.service.in}"
-BUS_UNIT=[email protected]
-WEBUI_UNIT=mosaic-webui.service
-
-usage() { echo 'usage: case2-unit.sh --user NAME --home DIR --business ID --copy ID --node PATH [--profile factory|library] [--pm] [--claude PATH] -- SERVE FLAGS' >&2; exit 4; }
-die() { echo "case2-unit: $*" >&2; exit 1; }
-# A value the unit carries as itself: no space, %, $, quote, backslash, & or |.
-plain() { case "$1" in *[!A-Za-z0-9/._+-]*) return 1 ;; esac; }
-abs_plain() {
-    case "$1" in /*) ;; *) die "$2 must be an absolute path: $1" ;; esac
-    plain "$1" || die "$2 contains a character the unit cannot carry: $1"
-    case "$1/" in */./*|*/../*|?*//*) die "$2 must be a normalized path: $1" ;; esac
-    [ "$1" = / ] || [ "${1%/}" = "$1" ] || die "$2 must not end in /: $1"
-}
-
-PROFILE=library USER_NAME='' HOME_DIR='' BUSINESS='' COPY_ID='' NODE='' PM=0 CLAUDE='' CLAUDE_SET=0
-while [ $# -gt 0 ]; do
-    case "$1" in
-        --profile|--user|--home|--business|--copy|--node|--claude)
-            [ $# -ge 2 ] || usage
-            case "$1" in
-                --profile) PROFILE="$2" ;; --user) USER_NAME="$2" ;; --home) HOME_DIR="$2" ;;
-                --business) BUSINESS="$2" ;; --copy) COPY_ID="$2" ;; --node) NODE="$2" ;;
-                --claude) CLAUDE="$2"; CLAUDE_SET=1 ;;
-            esac
-            shift 2 ;;
-        --pm) PM=1; shift ;;
-        --) shift; break ;;
-        *) usage ;;
-    esac
-done
-SERVE=("$@")
-[ -n "$USER_NAME" ] && [ -n "$HOME_DIR" ] && [ -n "$BUSINESS" ] && [ -n "$COPY_ID" ] && [ -n "$NODE" ] || usage
-case "$PROFILE" in factory|library) ;; *) die "--profile must be factory or library: $PROFILE" ;; esac
-if [ "$PROFILE" = library ]; then
-    [ "$PM" = 0 ] || die "the library profile refuses --pm"
-    [ "$CLAUDE_SET" = 0 ] || die "the library profile refuses --claude"
-fi
-
-if [ "$UNIT_DIR" = "$DEFAULT_UNIT_DIR" ]; then
-    [ "$(id -u)" = 0 ] || die "writing $DEFAULT_UNIT_DIR needs root"
-fi
-
-# The user, its uid, primary group and home, from the passwd database.
-[[ "$USER_NAME" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || die "--user must be a user name: $USER_NAME"
-PW="$("$GETENT" passwd "$USER_NAME")" || die "no user $USER_NAME in the passwd database"
-IFS=: read -r _ _ USER_UID USER_GID _ PW_HOME _ <<<"$PW"
-[[ "$USER_UID" =~ ^[0-9]+$ ]] && [ "$USER_UID" -ne 0 ] || die "--user must not be root: $USER_NAME"
-abs_plain "$HOME_DIR" '--home'
-[ "$HOME_DIR" = "$PW_HOME" ] || die "--home $HOME_DIR is not $USER_NAME's home in the passwd database ($PW_HOME)"
-GR="$("$GETENT" group "$USER_GID")" || die "no group $USER_GID in the group database"
-GROUP="${GR%%:*}"
-[[ "$GROUP" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || die "the primary group of $USER_NAME is not a group name: $GROUP"
-
-case "$BUSINESS" in [a-z0-9]*) ;; *) die "--business must be a business id: $BUSINESS" ;; esac
-case "$BUSINESS" in *[!a-z0-9._-]*) die "--business must be a business id: $BUSINESS" ;; esac
-[ "${#BUSINESS}" -le 64 ] || die "--business must be a business id: $BUSINESS"
-
-# The copy: copy_root's rule (scripts/stack-copy.sh:8, :22), under <home>.
-COPIES="$HOME_DIR/.local/share/mosaic-stack/copies"
-[[ "$COPY_ID" =~ ^[0-9a-f]{40}$ ]] || die "--copy must be a full 40-character lower-case commit id: $COPY_ID"
-COPY="$COPIES/$COPY_ID"
-[ -d "$COPY" ] && [ ! -L "$COPY" ] || die "no copy directory $COPY"
-[ -f "$COPY/scripts/mosaic" ] || die "no copy $COPY_ID in $COPIES: $COPY/scripts/mosaic is missing"
-
-# Owned by root and writable by no one else, the file and every directory above it.
-root_only() {
-    local p="$1" what="$2" owner mode
-    while :; do
-        owner="$(stat -c '%u' -- "$p")" || die "cannot stat $p"
-        mode="$(stat -c '%a' -- "$p")" || die "cannot stat $p"
-        [ "$owner" = 0 ] || die "$what: $p is not owned by root"
-        (( (8#$mode & 8#022) == 0 )) || die "$what: $p is writable by its group or others"
-        [ "$p" = / ] && break
-        p="$(dirname -- "$p")"
-    done
-}
-
-# --node: an absolute path to a root-owned regular file outside <home>.
-abs_plain "$NODE" '--node'
-case "$NODE/" in "$HOME_DIR"/*) die "--node must be outside $HOME_DIR: $NODE" ;; esac
-[ ! -L "$NODE" ] || die "--node must not be a symlink; pass its target: $NODE"
-[ -f "$NODE" ] && [ -x "$NODE" ] || die "--node must be an executable regular file: $NODE"
-root_only "$NODE" '--node'
-
-# --claude follows the --node rule, so nothing running as <user> can replace
-# the binary the bus runs.
-if [ "$CLAUDE_SET" = 1 ]; then
-    abs_plain "$CLAUDE" '--claude'
-    case "$CLAUDE/" in "$HOME_DIR"/*) die "--claude must be outside $HOME_DIR: $CLAUDE" ;; esac
-    [ ! -L "$CLAUDE" ] || die "--claude must not be a symlink; pass its target: $CLAUDE"
-    [ -f "$CLAUDE" ] && [ -x "$CLAUDE" ] || die "--claude must be an executable regular file: $CLAUDE"
-    root_only "$CLAUDE" '--claude'
-fi
-
-# The checkout the templates come from, when installing for real.
-if [ "$UNIT_DIR" = "$DEFAULT_UNIT_DIR" ]; then
-    case "$REPO/" in "$HOME_DIR"/*) die "run this from a root-owned checkout outside $HOME_DIR, not $REPO" ;; esac
-    root_only "$BUS_TEMPLATE" 'bus template'
-    root_only "$WEBUI_TEMPLATE" 'Console template'
-fi
-
-# The serve flags, checked as scripts/webui-service.sh serve_flags checks
-# them (:201-264), and kept in the order given. That script compares the
-# proof file's owner to `id -u`, which is root here, so this copy has its own.
-serve_flags() {
-    local -A seen=()
-    local flags='' name value
-    local port='' public_host='' auth_header='' allow_user='' proof_header='' proof_file='' tester_port=''
-    local i=0 n=${#SERVE[@]}
-    while [ "$i" -lt "$n" ]; do
-        name="${SERVE[$i]}"
-        case "$name" in
-            --tester-port) [ "$PROFILE" = factory ] || die "the library profile refuses --tester-port: the tester listener takes writes from loopback with no sign-in" ;;
-            --checkout) die "refusing --checkout: Case 2 has no queue panel" ;;
-            --board) die "refusing --board: Case 2 runs no control board" ;;
-            --sso) die "refusing --sso: the Console signs people in through the proxy, with the preview set and the proof pair (Q175 phase 2 is a follow-up)" ;;
-            --port|--business) ;;
-            --public-host|--auth-header|--allow-user|--proof-header|--proof-file|--send)
-                [ "$PROFILE" = library ] || die "the factory profile refuses $name: its host has no proxy" ;;
-            *) die "unknown serve flag: $name" ;;
-        esac
-        [ -z "${seen[$name]:-}" ] || die "serve flag $name given twice"
-        seen[$name]=1
-        if [ "$name" = --send ]; then flags="$flags --send"; i=$((i + 1)); continue; fi
-        [ $((i + 1)) -lt "$n" ] || die "serve flag $name needs a value"
-        value="${SERVE[$((i + 1))]}"
-        case "$name" in
-            --port) port="$value"
-                [[ "$port" =~ ^[1-9][0-9]{0,3}$ ]] && [ "$port" -le 1023 ] || die "--port must be 1..1023, so only the unit's capability can bind it: $port" ;;
-            --business) [ "$value" = "$BUSINESS" ] || die "serve --business $value is not the unit's business $BUSINESS" ;;
-            --public-host) public_host="$value"
-                case "$value" in [A-Za-z0-9]*) ;; *) die "public host must be a hostname, no port or scheme: $value" ;; esac
-                case "$value" in *[!A-Za-z0-9.-]*) die "public host must be a hostname, no port or scheme: $value" ;; esac ;;
-            --auth-header) auth_header="$value"
-                case "$value" in [A-Za-z0-9]*) ;; *) die "auth header must be a header name: $value" ;; esac
-                case "$value" in *[!A-Za-z0-9-]*) die "auth header must be a header name: $value" ;; esac ;;
-            --allow-user) allow_user="$value"
-                case "$value" in [A-Za-z0-9]*) ;; *) die "allowed user must start with a letter or digit: $value" ;; esac
-                case "$value" in *[!A-Za-z0-9._@+-]*) die "allowed user contains a character the unit cannot carry: $value" ;; esac ;;
-            --proof-header) proof_header="$value"
-                [[ "$value" =~ ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$ ]] || die "invalid proxy proof header" ;;
-            --proof-file) proof_file="$value" ;;
-            --tester-port) tester_port="$value"
-                [[ "$value" =~ ^[1-9][0-9]{3,4}$ ]] && [ "$value" -ge 1024 ] && [ "$value" -le 65535 ] || die "--tester-port must be 1024..65535: $value" ;;
-        esac
-        flags="$flags $name $value"
-        i=$((i + 2))
-    done
-    local required=(--port --business)
-    [ "$PROFILE" = factory ] || required+=(--public-host --auth-header --allow-user --send --proof-header --proof-file)
-    for name in "${required[@]}"; do
-        [ -n "${seen[$name]:-}" ] || die "serve flag $name is required"
-    done
-    [ -z "$tester_port" ] || [ "$tester_port" -ne "$port" ] || die "--tester-port must differ from --port"
-    if [ "$PROFILE" = factory ]; then echo "${flags# }"; return 0; fi
-    # Lead decision 101: the uid header carries the Authentik uid.
-    if [ "${auth_header,,}" = x-authentik-uid ] && ! [[ "$allow_user" =~ ^[0-9a-f]{64}$ ]]; then
-        die "with --auth-header $auth_header the allowed user must be an Authentik uid, 64 lower-case hex characters (lead decision 101): $allow_user"
-    fi
-    case "${proof_header,,}" in host|origin|x-mosaic-tester|"${auth_header,,}") die "proxy proof header must differ from Host, Origin, tester and auth headers" ;; esac
-    # The proof file: metadata only, never opened (design 9.3).
-    local secrets="$HOME_DIR/.config/mosaic-dev/secrets" real owner mode
-    abs_plain "$proof_file" 'proxy proof file'
-    [ ! -L "$proof_file" ] || die "proxy proof file must not be a symlink: $proof_file"
-    [ -f "$proof_file" ] || die "proxy proof file must be a regular file: $proof_file"
-    real="$(realpath -e -- "$proof_file")" || die "cannot resolve proxy proof file: $proof_file"
-    [ "$real" = "$proof_file" ] || die "proxy proof file path must have no symlink in it: $proof_file"
-    case "$proof_file" in "$secrets"/*) ;; *) die "proxy proof file must be under $secrets, outside the data root: $proof_file" ;; esac
-    owner="$(stat -c '%u' -- "$proof_file")" || die "cannot stat proxy proof file"
-    mode="$(stat -c '%a' -- "$proof_file")" || die "cannot stat proxy proof file"
-    [ "$owner" = "$USER_UID" ] || die "proxy proof file must be owned by $USER_NAME (uid $USER_UID): $proof_file"
-    [ "$mode" = 600 ] || [ "$mode" = 400 ] || die "proxy proof file must be mode 0600 or 0400, not $mode: $proof_file"
-    echo "${flags# }"
-}
-FLAGS="$(serve_flags)" || exit 1
-
-# PATH: the node's directory first, then the default list without it. Unlike
-# scripts/webui-service.sh:303-305 this always puts node's directory first,
-# so the bus's `exec node` (scripts/mosaic) finds the same node.
-NODE_DIR="$(dirname -- "$NODE")"
-UNIT_PATH="$NODE_DIR"
-for d in /usr/local/bin /usr/bin /bin; do [ "$d" = "$NODE_DIR" ] || UNIT_PATH="$UNIT_PATH:$d"; done
-
-HARDENING="ProtectSystem=strict
-ReadWritePaths=$HOME_DIR
-ProtectHome=yes
-PrivateTmp=yes"
-CAPS="AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE"
-# The default instance, as scripts/instance.sh:85-107 renders it: no
-# MOSAIC_CONFIG line, and the session env under %h, which becomes <home>.
-SESSION_ENV='%h/.config/mosaic-dev/secrets/claude-session.env'
-ENV_FILE="-$HOME_DIR/.config/mosaic-dev/secrets/claude-session.env"
-PM_FLAGS=''
-[ "$PM" = 0 ] || PM_FLAGS=' --pm'
-CLAUDE_ENV=''
-[ "$CLAUDE_SET" = 0 ] || CLAUDE_ENV="Environment=MOSAIC_CLAUDE_BIN=$CLAUDE"
-
-# One unit from its template. kind is bus or webui.
-render() {
-    local kind="$1" template="$2" text tokens
-    [ -f "$template" ] && [ ! -L "$template" ] || die "template missing or not a regular file: $template"
-    text="$(sed -e "s|@REPO@|$COPY|g" -e "s|@PATH@|$UNIT_PATH|g" -e "s|@NODE@|$NODE|g" \
-        -e "s|@PM_FLAGS@|$PM_FLAGS|g" -e "s|^@CLAUDE_ENV@\$|$CLAUDE_ENV|" \
-        -e '/^@CONFIG_ENV@$/d' -e "s|@SESSION_ENV@|$SESSION_ENV|g" \
-        -e "s|%h|$HOME_DIR|g" -- "$template")"
-    # Checked before @FLAGS@ goes in, since an allowed user may hold @.
-    tokens="$(printf '%s\n' "$text" | grep -oE '@[A-Z_]+@' || true)"
-    if [ "$kind" = webui ]; then
-        [ "$tokens" = @FLAGS@ ] || die "$template: a token other than one @FLAGS@ is left after the render: $(echo $tokens)"
-        text="${text//@FLAGS@/$FLAGS}"
-    else
-        [ -z "$tokens" ] || die "$template: a token is left after the render: $(echo $tokens)"
-    fi
-    if printf '%s\n' "$text" | grep -q '%h'; then die "$template: %h is left after the render"; fi
-    local add="User=$USER_NAME\nGroup=$GROUP\n${HARDENING//$'\n'/\\n}\n"
-    [ "$kind" = bus ] || add="$add${CAPS//$'\n'/\\n}\n"
-    # The added lines go at the end of [Service], before its trailing blank
-    # lines. In [Install], WantedBy=multi-user.target replaces
-    # WantedBy=default.target in both units, so both start at boot (Q189).
-    printf '%s\n' "$text" | awk -v add="$add" '
-        function blanks_out() { for (; blanks > 0; blanks--) print "" }
-        /^\[.*\]$/ {
-            if (sec == "[Service]") printf "%s", add
-            sec = $0
-            blanks_out(); print; next
-        }
-        $0 == "" { blanks++; next }
-        { blanks_out() }
-        sec == "[Install]" && $0 == "WantedBy=default.target" { $0 = "WantedBy=multi-user.target" }
-        { print }
-        END { if (sec == "[Service]") printf "%s", add; blanks_out() }'
-}
-
-# The unit's settings as section<TAB>key<TAB>value, one per line, keys
-# trimmed as systemd trims them. A continued line refuses, so no setting
-# hides in one.
-settings() {
-    awk '
-        { sub(/^[ \t]+/, ""); sub(/[ \t]+$/, "") }
-        $0 == "" || /^[#;]/ { next }
-        /\\$/ { print "CONTINUED"; exit }
-        /^\[.*\]$/ { sec = $0; next }
-        {
-            i = index($0, "="); if (i == 0) { print "NOKEY\t" $0; next }
-            k = substr($0, 1, i - 1); v = substr($0, i + 1)
-            sub(/[ \t]+$/, "", k); sub(/^[ \t]+/, "", v)
-            print sec "\t" k "\t" v
-        }'
-}
-
-# Refuses unless one unit's fixed lines hold. what names the unit in messages,
-# copy is the copy directory it should run from.
-check_unit() {
-    local kind="$1" text="$2" what="$3" copy="$4" s
-    s="$(printf '%s\n' "$text" | settings)"
-    ! printf '%s\n' "$s" | grep -qx CONTINUED || die "$what: a line continues onto the next"
-    ! printf '%s\n' "$s" | grep -q '^NOKEY' || die "$what: a line is neither a section, a comment nor a setting"
-    # %h in a system unit is root's home, not <user>'s.
-    ! printf '%s\n' "$text" | grep -q '%h' || die "$what: %h is left; a system unit reads it as root's home"
-    local key
-    for key in RestrictNamespaces PrivateUsers SystemCallFilter PermissionsStartOnly; do
-        ! printf '%s\n' "$s" | awk -F'\t' -v k="$key" '$2 == k { found = 1 } END { exit !found }' \
-            || die "$what: refusing $key=, which the hub's units must not hold"
-    done
-    # An Exec*= value whose leading prefix characters hold + or ! runs with
-    # full privileges, whatever User= says.
-    local bad
-    bad="$(printf '%s\n' "$s" | awk -F'\t' '$2 ~ /^Exec/ { p = $3; sub(/[^-@:+!].*$/, "", p); if (p ~ /[+!]/) print $2 "=" $3 }')"
-    [ -z "$bad" ] || die "$what: refusing an Exec line that runs with full privileges: $bad"
-    # The fixed lines, each exactly once, in [Service].
-    one() {
-        local k="$1" v="$2" got
-        got="$(printf '%s\n' "$s" | awk -F'\t' -v k="$k" '$2 == k { print $1 "\t" $3 }')"
-        [ "$got" = "[Service]	$v" ] || die "$what: $k= must be exactly once in [Service], as $k=$v"
-    }
-    none() {
-        ! printf '%s\n' "$s" | awk -F'\t' -v k="$1" '$2 == k { found = 1 } END { exit !found }' || die "$what: refusing $1=, which this unit must not hold"
-    }
-    one User "$USER_NAME"
-    one Group "$GROUP"
-    one WorkingDirectory "$copy"
-    # Environment= lines: PATH, and MOSAIC_CLAUDE_BIN only with --claude.
-    local envs want_envs="[Service]	PATH=$UNIT_PATH"
-    [ "$kind" = webui ] || [ -z "$CLAUDE_ENV" ] || want_envs="$want_envs
-[Service]	MOSAIC_CLAUDE_BIN=$CLAUDE"
-    envs="$(printf '%s\n' "$s" | awk -F'\t' '$2 == "Environment" { print $1 "\t" $3 }')"
-    [ "$envs" = "$want_envs" ] || die "$what: the Environment= lines must be exactly: $(printf '%s' "$want_envs" | cut -f2 | tr '\n' ' ')"
-    one NoNewPrivileges yes
-    one ProtectSystem strict
-    one ReadWritePaths "$HOME_DIR"
-    one ProtectHome yes
-    one PrivateTmp yes
-    local order
-    order="$(printf '%s\n' "$s" | awk -F'\t' '$2 ~ /^(ProtectSystem|ReadWritePaths|ProtectHome|PrivateTmp)$/ { printf "%s ", $2 }')"
-    [ "$order" = "ProtectSystem ReadWritePaths ProtectHome PrivateTmp " ] || die "$what: the hardening lines must be in the order ProtectSystem, ReadWritePaths, ProtectHome, PrivateTmp"
-    local wanted
-    wanted="$(printf '%s\n' "$s" | awk -F'\t' '$2 == "WantedBy" { print $1 "\t" $3 }')"
-    [ "$wanted" = "[Install]	multi-user.target" ] || die "$what: WantedBy= must be exactly once, as WantedBy=multi-user.target"
-    if [ "$kind" = bus ]; then
-        one ExecStart "$copy/scripts/mosaic bus start %i$PM_FLAGS"
-        one EnvironmentFile "$ENV_FILE"
-        none AmbientCapabilities
-        none CapabilityBoundingSet
-    else
-        one ExecStart "$NODE $copy/packages/webui/src/cli.mjs serve $FLAGS"
-        none EnvironmentFile
-        one AmbientCapabilities CAP_NET_BIND_SERVICE
-        one CapabilityBoundingSet CAP_NET_BIND_SERVICE
-    fi
-}
-
-BUS_TEXT="$(render bus "$BUS_TEMPLATE")" || exit 1
-WEBUI_TEXT="$(render webui "$WEBUI_TEMPLATE")" || exit 1
-check_unit bus "$BUS_TEXT" "rendered $BUS_UNIT" "$COPY"
-check_unit webui "$WEBUI_TEXT" "rendered $WEBUI_UNIT" "$COPY"
-
-# A re-install: each installed unit passes the same checks, both name one
-# copy, and each equals the render once its copy id is the new one.
-[ -d "$UNIT_DIR" ] && [ ! -L "$UNIT_DIR" ] || die "no unit directory $UNIT_DIR"
-installed_ids=''
-for pair in "bus:$BUS_UNIT:BUS_TEXT" "webui:$WEBUI_UNIT:WEBUI_TEXT"; do
-    IFS=: read -r kind name var <<<"$pair"
-    path="$UNIT_DIR/$name"
-    [ ! -L "$path" ] || die "refusing: $path is a symlink"
-    [ -e "$path" ] || continue
-    [ -f "$path" ] || die "refusing: $path is not a regular file"
-    text="$(cat -- "$path")"
-    old="$(printf '%s\n' "$text" | settings | awk -F'\t' -v c="$COPIES/" '$2 == "WorkingDirectory" && index($3, c) == 1 { print substr($3, length(c) + 1) }')"
-    [[ "$old" =~ ^[0-9a-f]{40}$ ]] || die "installed $path names no copy under $COPIES"
-    check_unit "$kind" "$text" "installed $path" "$COPIES/$old"
-    [ "$text" = "$(printf '%s\n' "${!var}" | sed "s|$COPY|$COPIES/$old|g")" ] \
-        || die "installed $path differs from the render in more than the copy id; the node path, serve flags, --pm and --claude must equal the installed ones"
-    installed_ids="$installed_ids $old"
-done
-read -r -a ids <<<"$installed_ids"
-[ "${#ids[@]}" -lt 2 ] || [ "${ids[0]}" = "${ids[1]}" ] || die "the installed units name different copies, ${ids[0]} and ${ids[1]}"
-
-# `systemctl start` leaves a running unit on the copy it started from, so
-# note which units run before the write (row 195 owns the restart).
-BUS_NAME="mosaic-bus@$BUSINESS.service"
-running=''
-for name in "$BUS_NAME" "$WEBUI_UNIT"; do
-    if "$SYSTEMCTL" is-active --quiet "$name"; then running="$running $name"; fi
-done
-
-# Write each unit to a temp file in the unit directory, then rename.
-write_unit() {
-    local name="$1" text="$2" tmp
-    tmp="$(mktemp "$UNIT_DIR/.case2-unit.XXXXXX")"
-    printf '%s\n' "$text" >"$tmp"
-    chmod 0644 "$tmp"
-    [ "$(id -u)" != 0 ] || chown root:root "$tmp"
-    mv -fT -- "$tmp" "$UNIT_DIR/$name"
-}
-write_unit "$BUS_UNIT" "$BUS_TEXT"
-write_unit "$WEBUI_UNIT" "$WEBUI_TEXT"
-# Enable both, then start the bus, then the Console (design 10 step 2c).
-# serve calls the bus per request, so the units carry no After= or Wants=.
-"$SYSTEMCTL" daemon-reload || die "systemctl daemon-reload failed; the units are written, nothing is enabled or started"
-"$SYSTEMCTL" enable "$BUS_NAME" "$WEBUI_UNIT" || die "systemctl enable $BUS_NAME $WEBUI_UNIT failed; nothing is started"
-"$SYSTEMCTL" start "$BUS_NAME" || die "systemctl start $BUS_NAME failed; the Console is not started"
-"$SYSTEMCTL" start "$WEBUI_UNIT" || die "systemctl start $WEBUI_UNIT failed; the bus is running"
-if [ -z "$running" ]; then
-    echo "case2-unit: wrote $UNIT_DIR/$BUS_UNIT and $UNIT_DIR/$WEBUI_UNIT from copy $COPY_ID; enabled and started $BUS_NAME, then $WEBUI_UNIT"
-    exit 0
-fi
-echo "case2-unit: wrote $UNIT_DIR/$BUS_UNIT and $UNIT_DIR/$WEBUI_UNIT from copy $COPY_ID and enabled both"
-for name in "$BUS_NAME" "$WEBUI_UNIT"; do
-    case " $running " in
-        *" $name "*) echo "case2-unit: $name was already running, so it is still on ${ids[0]:+copy }${ids[0]:-the copy it started from}, not copy $COPY_ID" ;;
-        *) echo "case2-unit: started $name on copy $COPY_ID" ;;
-    esac
-done
-echo "case2-unit: restart $BUS_NAME and $WEBUI_UNIT together to put both on copy $COPY_ID; until then they may run different copies"
@@ -836,13 +836,12 @@ sso_checks() {
    sso_supported || { check_refuse sso-target "$TO's Console does not support --sso"; return 0; }
    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out id slot path why
    # N4 (webby-0019, sage-1403): a pre-phase-1 loader refuses a console key, so with the key not yet
-    # written and the stack on another copy, the first step is the re-pin without --sso. On a named
-    # instance both commands carry --instance NAME (row 238).
-    local first="" inst="${INSTANCE_FLAGS[*]:+ ${INSTANCE_FLAGS[*]}}"
+    # written and the stack on another copy, the first step is the re-pin without --sso.
+    local first=""
    if ! out="$(node -e "$SSO_JS" -- "$COPIES/$TO" "$cfg" 2>&1)"; then
        out="${out%%$'\n'*}"
        [ "$out" != "there is no console.sso in the system config" ] || [ "$P_COPY" = "$TO" ] ||
-            first="; activate $TO$inst without --sso first, then write console.sso, then run activate $TO$inst --sso"
+            first="; activate $TO without --sso first, then write console.sso, then run activate $TO --sso"
        check_refuse sso-config "$TO's Console would refuse its --sso start: $out$first"
        return 0
    fi