row 285: align library and creative fixture credential data under B1 (mos-1581, mos-1582)

The fence sits near business.mjs:166, clear of row 287's :283-291. Its message
starts with the N10 text. An assistant-instance test keeps the no-gitea branch
covered, and a creative-instance test covers the fence. Nothing here has run.

BUILD-LOG.md

@@ -5476,3 +5476,13 @@ remain; no live state, schema or bus policy change.
 
 2026-10-24 | Goldie | Row265 / #1770 verified (mos-1567, sage-3942) | Approved correction adds solely address import pin + Row265 comment to project-runtime.test and one pure-source RUNNER_FILES mount; new block checks parser has no imports. Serialized fresh-short-TMP timeout-k10: unchanged sandbox10/10, parser15/15, rooms18/18, full bus957/957, twelve named refusal mutants killed (each Node1, driver0), restored parser15/15 + rooms18/18. All positives zero fail/skip/cancel; every mutation restored full broker SHA71b32ee4. Old first-red evidence retained, no other old-test change. Slot returned goldie-0034; Boyd packet explicitly includes mount-list review, candidate push next.
 2026-10-24T07:18:53Z | Sage | Row 327 (#1825, Bradford, Poe and Dewey) LANDED 68c08b4e7. Before: refactor at 94d9e90a6; the push guard was a scratch script with no reviewed-binary check. After: scripts/push-check.sh and scripts/test-push-check.sh on refactor, 3 commits cherry-picked onto 6a5e12511 with blobs equal to the round 3 tip d858c9f8b, plus doc commits 76f84465f and 68c08b4e7. Binaries are found by numstat or a NUL in the first 8000 committed bytes, regardless of attributes; each needs its sha256 and path in an approved latest-round candidate; an unconfirmed queue tail exits 2. Reviews: Poe c31525 rev 3882, Dewey c31526 rev 3883. Gate: 1st run 06:57Z RED, not the candidate: canonical node_modules was empty from 05:45:15Z (sage-4023). Rerun with its own root npm ci GREEN 07:15:49Z: 17 package suites 0 failures (cli 986, plugins 119, webui 418), 11 scripts exit 0, push-check 6 mutants KILLED; skips are the queue canonical-root check and the row 244 live provider cases. The landed push-check.sh passed its own push (NO_BINARY, NO_ATTRIBUTION, PUSH_READY). mos-1575: gates install their own node_modules; canonical restored with npm ci (128 packages).
+
+2026-10-24T10:02Z | Magica | Row 285 / #1790 r3 before/after (sage-4039, mos-1542) | Before: assigned magica/row285-r3 at b19ffa04f, Scrooge r2 untested at 53db6b7ca. After: seven commits cherry-picked through 644bcaa16; five named overlaps auto-merge preserving newer base changes. Range-diff six '=', one context-only '!'; six patch IDs identical, fixture patch ID differs with upstream import context, exact test added/removed-line comparison identical for all changed tests. business.mjs equals base; Scrooge BUILD equals r2. CREATIVE_KINDS absent in packages/roles/scripts; no 64-hex changed-path pin; 291 conservative reader candidates recorded. No npm or tests before Sage CLEAR; N1 remains follow-up. Own-branch evidence push next, not accepted/green or landed.
+
+2026-10-24T09:58:36Z | Magica | Row 285 timestamp correction | The preceding Magica entry marked 10:02Z used an incorrect timestamp; replay/evidence commit 87b7547f8 occurred before the measured 09:58:22Z push start. Technical evidence is unchanged.
+
+2026-10-24T10:32:02Z | Magica | Row285 / #1790 gate STOP (sage-4048) | Before: pushed66a800e15, no tests. After: own root/webui npm ci, short scratch TMPDIR, whole files serial timeout-k10; bus958/958 green (108 files), business partial80pass/4fail, first red old row323 case1-business-file tests57/86/95/105 because committed Case1 chief lacks required gitea ref. No more tests/mutants or source edits. Static diagnosis also finds old empty-credential assertions81/112/114, requiring a specific owner ruling. Sage notified magica-0002. No in-review move or green claim.
+
+2026-10-24T10:42:28Z | Magica | Row285 / #1790 Amendment1 before/after | Before: unconditional chief gitea broke row323. After: chief-only library conditional plus named required-reference refusal, checkCredentialMap unchanged; new three-case test file; own helper/resolve fixture hunks restored to base, own chief/business/identity hunks reconciled under sage-4060. Case1 doc/test byte-identical. M10 planned against new no-library positive and old Case1 doc test. No tests run under held slot; not green/accepted. Residual base library fixture references need authority alignment before re-CLEAR.
+
+2026-10-24T10:59:43Z | Magica | Row285 / #1790 B1 before/after | Before: Amendment1 candidatebabae6adc with missing refs in base library/creative fixtures. After: 26 data-only credential insertions across13 direct-reader files; original callback lines preserved, one expressly allowed credentials?.vikunja setup guard. Every other byte reconstructs prior candidate exactly; no base assertion edits. Base and candidate put role set is pm,cto,coder,reviewer; chief lacks vikunja. Literal e0c6142f3 word diffs and known preexisting r2 hunks recorded. No tests, green claim or queue move; next whole gate +M10 waits for Sage CLEAR.

agents/magica/work/queue-285/b1-base-diff.txt

@@ -0,0 +1,365 @@
+diff --git a/packages/bus/tests/reload.test.mjs b/packages/bus/tests/reload.test.mjs
+index 091b37b26..342d578d0 100644
+--- a/packages/bus/tests/reload.test.mjs
++++ b/packages/bus/tests/reload.test.mjs
+@@ -194,7 +194,7 @@ test('T14 a file whose project root differs from the boot copy is not reloaded,
+ });
+ 
+ test('T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start', async (t) => {
+-  const f = await setup(t, doc => { doc.projects.books = mappingEntry(); });
++  const f = await setup(t, doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects.books = mappingEntry(); });
+   const doc = JSON.parse(readFileSync(f.file, 'utf8'));
+   doc.projects.books.branch = 'other';
+   writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
+@@ -202,7 +202,7 @@ test('T14 a file whose library mapping differs from the boot copy is not reloade
+   assert.equal(added.restart, true);
+   assert.equal(f.reloads.length, 0);
+   // The same library entry reloads.
+-  const g = await setup(t, doc => { doc.projects.books = mappingEntry(); });
++  const g = await setup(t, doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects.books = mappingEntry(); });
+   assert.equal(g.ask('instances.set', { revision: g.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer' }).restart, false);
+   assert.equal(g.reloads.length, 1);
+ });
+diff --git a/packages/business/tests/business.test.mjs b/packages/business/tests/business.test.mjs
+index 9d4eda831..f78789250 100644
+--- a/packages/business/tests/business.test.mjs
++++ b/packages/business/tests/business.test.mjs
+@@ -6,6 +6,7 @@ import { join } from "node:path";
+ import { pathToFileURL } from "node:url";
+ import { BusinessError, businessFilePath, configDir, loadBusiness, validateBusinessDocument } from "../src/index.mjs";
+ import { THREAD_IDLE_SECONDS } from "../src/business.mjs";
++import { CREATIVE_DEFINITIONS } from "../src/vocabulary.mjs";
+ import { launchDoc, businessDoc, REPO, REPO_ROLES, rolesCopy, tmp, writeJson } from "./helpers.mjs";
+ 
+ test('C2-04: library mappings load without roots, remain frozen, and retain mapping refusals', async t => {
+@@ -14,6 +15,7 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+   const doc = businessDoc(root), file = join(root, 'businesses/acme.json');
+   doc.projects = { books: mappingEntry(), ...doc.projects };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   const loaded = validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES });
+   const { checkMapping } = await import('../../library/src/mapping.mjs');
+   assert.deepEqual(loaded.projects.books, checkMapping(mappingEntry()));
+@@ -41,6 +43,7 @@ test('C2-04: an otherwise valid publish grant cannot name a library repo', async
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+   const doc = businessDoc(root);
+   doc.projects.books = { ...mappingEntry(), remote: 'https://git.example/writer/books' };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   doc.roles.coder.identity = { name: 'Coder', email: '[email protected]', gitea: { url: 'https://git.example', user: 'acme-coder' } };
+   doc.roles.coder.publish = ['books'];
+   refuses(() => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir: REPO_ROLES }), /publish.*library/);
+@@ -273,28 +276,58 @@ test("the shipped example refuses as written and validates once filled in", () =
+   assert.equal(id, 15);
+ });
+ 
++// Row 285 (C2-08b, #1790, mos-1330): a creative definition declares gitea, so its instance names
++// the reference. The store form needs no token file, and the bus reads a missing one as no token.
++const CREATIVE_GITEA = Object.freeze({ gitea: Object.freeze({ store: true, rotateBy: "2099-01-01" }) });
++
+ // Row 213 (C2-08, #1714), deviation D1: the persona vars sit on a creative instance only, and
+ // both or neither. The var checks themselves are vars.mjs's.
+ test("persona vars: agent layer, creative definition only, both or neither", () => {
+   const sha = "a".repeat(64);
+   const persona = { "persona.name": "Bean", "persona.sha256": sha };
+-  const business = check((d) => { d.roles.bean = { definition: "companion", vars: { ...persona } }; });
++  const business = check((d) => { d.roles.bean = { definition: "companion", credentials: CREATIVE_GITEA, vars: { ...persona } }; });
+   assert.deepEqual({ ...business.roles.bean.vars }, persona);
+-  assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition: "ideas" }; }));
++  assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition: "ideas", credentials: CREATIVE_GITEA }; }));
+   refuses(() => check((d) => { d.vars["persona.name"] = "Bean"; }), /persona\.name can't be set at the business layer/);
+   refuses(() => check((d) => { d.roles.pm.vars = { ...d.roles.pm.vars, ...persona }; }),
+     /roles\.pm\.vars: persona vars need a creative definition \(pm isn't one\)/);
+   refuses(() => check((d) => { d.roles.chief.vars = { ...persona }; }), /chief-of-staff isn't one/);
+   for (const key of Object.keys(persona)) {
+-    refuses(() => check((d) => { d.roles.bean = { definition: "research", vars: { [key]: persona[key] } }; }),
++    refuses(() => check((d) => { d.roles.bean = { definition: "research", credentials: CREATIVE_GITEA, vars: { [key]: persona[key] } }; }),
+       /roles\.bean\.vars: persona\.name and persona\.sha256 are set together or not at all/);
+   }
+   for (const [key, value] of [["persona.name", "x".repeat(41)], ["persona.name", "Be\nan"], ["persona.name", "Be\u0007an"], ["persona.name", "Be\u2028an"], ["persona.name", "Be\u2029an"], ["persona.name", 7],
+     ["persona.sha256", "A".repeat(64)], ["persona.sha256", sha.slice(1)], ["persona.sha256", `${sha}0`]]) {
+-    refuses(() => check((d) => { d.roles.bean = { definition: "companion", vars: { ...persona, [key]: value } }; }), new RegExp(`variable ${key.replace(".", "\\.")}`), 2);
++    refuses(() => check((d) => { d.roles.bean = { definition: "companion", credentials: CREATIVE_GITEA, vars: { ...persona, [key]: value } }; }), new RegExp(`variable ${key.replace(".", "\\.")}`), 2);
++  }
++});
++
++// Row 285 (C2-08b, #1790, mos-1330): the chief and each creative definition declare gitea, so an
++// instance without the reference refuses. Amendment 1 (mos-1580, sage-4060): the chief
++// requires its reference only in a library business; creative definitions always require it.
++test("row 285: a chief or creative instance without credentials.gitea refuses at load", async () => {
++  const { mappingEntry } = await import("../../library/tests/helpers.mjs");
++  refuses(() => check((d) => { d.projects.books = mappingEntry(); delete d.roles.chief.credentials; }),
++    /chief-library-gitea-required: .*roles\.chief\.credentials/);
++  for (const definition of CREATIVE_DEFINITIONS) {
++    refuses(() => check((d) => { d.roles.bean = { definition }; }),
++      /roles\.bean\.credentials must reference exactly the services its role definition needs \(gitea; got none\)/);
++    assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition, credentials: CREATIVE_GITEA }; }), definition);
+   }
+ });
+ 
++// Row 285 (C2-08b, brief): a creative instance may carry identity and publish, under the rules at
++// business.mjs:155-166, which the grant path reads. The grant itself still refuses it (#giteaRole).
++test("row 285: a creative instance with identity and publish loads", () => {
++  const identity = { name: "Bean", email: "[email protected]", gitea: { url: "https://git.example", user: "acme-bean" } };
++  const business = check((d) => {
++    d.projects.stack.remote = "https://git.example/acme/stack";
++    d.roles.bean = { definition: "companion", credentials: CREATIVE_GITEA, identity, publish: ["stack"] };
++  });
++  assert.deepEqual({ ...business.roles.bean.identity, gitea: { ...business.roles.bean.identity.gitea } }, identity);
++  assert.deepEqual([...business.roles.bean.publish], ["stack"]);
++});
++
+ // Row 194 (#1692, D2.5, T17): the per-agent forbid and the retired list.
+ test("row 194 keep, noHire and retired validate, and a file without them loads as before", () => {
+   const plain = check();
+diff --git a/packages/business/tests/cli.test.mjs b/packages/business/tests/cli.test.mjs
+index 3aa1d52ee..beb367f8c 100644
+--- a/packages/business/tests/cli.test.mjs
++++ b/packages/business/tests/cli.test.mjs
+@@ -11,7 +11,7 @@ const CLI = join(REPO, "packages", "business", "src", "cli.mjs");
+ test('C2-04: business validate and resolve skip a library before code projects and credential checks', async t => {
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+   const { rmSync } = await import('node:fs');
+-  const s = setup(doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; });
++  const s = setup(doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects = { books: mappingEntry(), ...doc.projects }; });
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+   writeJson(projectFilePath(s.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+   const checked = run(s, 'validate', 'acme');
+diff --git a/packages/business/tests/instance-settings.test.mjs b/packages/business/tests/instance-settings.test.mjs
+index e85366562..54c22e0e0 100644
+--- a/packages/business/tests/instance-settings.test.mjs
++++ b/packages/business/tests/instance-settings.test.mjs
+@@ -9,7 +9,7 @@ import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync }
+ import { join } from "node:path";
+ import { instanceSettings } from "../src/instance-settings.mjs";
+ import { projectFilePath } from "../src/project.mjs";
+-import { businessDoc, REPO, rolesCopy, systemConfig, systemFor, tmp, writeJson } from "./helpers.mjs";
++import { businessDoc, FAR_DATE, REPO, rolesCopy, systemConfig, systemFor, tmp, writeJson } from "./helpers.mjs";
+ 
+ const CLI = join(REPO, "packages", "business", "src", "cli.mjs");
+ const roots = [];
+@@ -22,7 +22,7 @@ const LEVELS = { pi: ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
+ 
+ test('C2-04: instance settings skip a library while checking a later code project', async () => {
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+-  const f = fixture(doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; });
++  const f = fixture(doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects = { books: mappingEntry(), ...doc.projects }; });
+   writeJson(projectFilePath(f.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+   const before = f.settings.read('acme');
+   f.settings.set('acme', { revision: before.revision, instance: 'gate-215', op: 'add', definition: 'merge-gate' }, 'jason');
+@@ -286,7 +286,8 @@ test("row 213 a creative instance is the human's: add, vars and definition chang
+   writeFileSync(join(f.root, "config", "personas", "acme", "bean.md"), text, { mode: 0o600 });
+   const persona = { "persona.name": "Bean", "persona.sha256": createHash("sha256").update(text).digest("hex") };
+   const view = f.settings.read("acme");
+-  assert.deepEqual(view.definitions.companion, { services: [], accepted: true });
++  // Row 285 (mos-1332 item 4): the companion definition declares gitea.
++  assert.deepEqual(view.definitions.companion, { services: ["gitea"], accepted: true });
+   const add = { instance: "bean", op: "add", definition: "companion", vars: persona };
+   for (const actor of ["chief-of-staff.chief", "tester"]) {
+     assert.throws(() => f.settings.set("acme", { revision: view.revision, ...add }, actor), e => e.code === "organization-creative-human-only", actor);
+@@ -331,8 +332,8 @@ test("row 213 a creative instance is the human's: add, vars and definition chang
+ // every actor, the human included. The listing's endProtected is that same check for its reader.
+ test("row 256 T1-T3, T5 the human deletes a creative instance, no other actor does, and the assistant stays", () => {
+   const f = fixture(doc => {
+-    doc.roles.bean = { definition: "companion" };
+-    doc.roles.muse = { definition: "ideas" };
++    doc.roles.bean = { definition: "companion", credentials: { gitea: { store: true, rotateBy: FAR_DATE } } };
++    doc.roles.muse = { definition: "ideas", credentials: { gitea: { store: true, rotateBy: FAR_DATE } } };
+     doc.roles.assistant = { definition: "assistant", holder: "mos" };
+   });
+   const del = (instance, actor) => () => f.settings.set("acme", { revision: f.settings.read("acme").revision, instance, op: "delete" }, actor);
+@@ -377,7 +378,7 @@ test("row 256 T1-T3, T5 the human deletes a creative instance, no other actor do
+ // instance can't be kept, launch.by or an arbiter, so the check it reaches is the last-listed one.
+ test("row 256 T4 the human's delete of the only listed instance, a creative one, is the last-listed refusal", () => {
+   const f = fixture(doc => {
+-    doc.roles.bean = { definition: "companion" };
++    doc.roles.bean = { definition: "companion", credentials: { gitea: { store: true, rotateBy: FAR_DATE } } };
+     doc.launch.instances = ["bean"];
+   });
+   const bytes = readFileSync(f.file, "utf8");
+diff --git a/packages/business/tests/library-projects-protected.test.mjs b/packages/business/tests/library-projects-protected.test.mjs
+index 51672bd7b..d4d09d94f 100644
+--- a/packages/business/tests/library-projects-protected.test.mjs
++++ b/packages/business/tests/library-projects-protected.test.mjs
+@@ -14,6 +14,7 @@ function fixture(t) {
+   books.universes.hybrid = { kind: 'hybrid', name: 'An invented crossover',
+     sources: ['harbor', 'second'], books: ['Hybrid Book'], playground: [], constraints: [], notes: 'Fixture only' };
+   doc.projects = { books, ...doc.projects };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   const dir = join(root, 'config'), file = writeJson(join(dir, 'businesses/acme.json'), doc);
+   const writer = organizationWriter({ dir, rolesDir: rolesCopy(root) });
+   // Give both snapshots an existing ordinary committed receipt to preserve.
+diff --git a/packages/business/tests/library-seats.test.mjs b/packages/business/tests/library-seats.test.mjs
+index 3cd0f86cf..da76fdbc7 100644
+--- a/packages/business/tests/library-seats.test.mjs
++++ b/packages/business/tests/library-seats.test.mjs
+@@ -27,7 +27,9 @@ test("M7/M8: library seats come from library businesses, creative seats from the
+   const { root, dir } = fixture(t);
+   const doc = businessDoc(root, "acme");
+   doc.projects = { books: mappingEntry(), ...doc.projects };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   doc.roles.bean = { definition: "companion" };
++  doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+   const found = sets(dir);
+   assert.deepEqual([...found.librarySeats].sort(), ["bean", "chief", "coder", "cto", "pm", "reviewer"]);
+@@ -39,6 +41,7 @@ test("M8: a business with no library project puts no seat in either set", (t) =>
+   const { root, dir } = fixture(t);
+   const doc = businessDoc(root, "other");
+   doc.roles.bean = { definition: "companion" };
++  doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   writeJson(join(dir, "businesses", "other.json"), doc);
+   const found = sets(dir);
+   assert.equal(found.librarySeats.size, 0);
+diff --git a/packages/business/tests/resolve.test.mjs b/packages/business/tests/resolve.test.mjs
+index b1e50f349..2fa106053 100644
+--- a/packages/business/tests/resolve.test.mjs
++++ b/packages/business/tests/resolve.test.mjs
+@@ -31,7 +31,7 @@ const resolve = (s, instance) => resolveInstance({ system: s.system, business: s
+ test('C2-04: a library first in projects does not hide a later project layer', async t => {
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+   const { rmSync } = await import('node:fs');
+-  const s = setup(doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; }, { vars: { 'tracker.project': 7 } });
++  const s = setup(doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects = { books: mappingEntry(), ...doc.projects }; }, { vars: { 'tracker.project': 7 } });
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+   const result = resolve(s, 'coder');
+   assert.equal(result.project, 'stack');
+diff --git a/packages/cli/tests/case2-install.test.mjs b/packages/cli/tests/case2-install.test.mjs
+index cc1142510..51b606bda 100644
+--- a/packages/cli/tests/case2-install.test.mjs
++++ b/packages/cli/tests/case2-install.test.mjs
+@@ -51,8 +51,11 @@ function world(t, { profile = "library" } = {}) {
+   for (const r of Object.values(doc.roles)) r.vars = { ...r.vars, harness: "pi" };
+   if (profile === "library") {
+     doc.projects.books = { ...mappingEntry(), user: "writer" };
++    doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.roles.bean = { definition: "companion", vars: { harness: "pi" } };
++    doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.roles.chet = { definition: "companion", vars: { harness: "pi" } };
++    doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   } else doc.vars["bus.tester"] = true;
+   const input = writeJson(join(root, "input", "acme.json"), doc);
+   const staging = join(root, "staging");
+@@ -212,6 +215,7 @@ test("the factory install refuses a library project and bus.tester off, before a
+   const x = world(t, { profile: "factory" });
+   const doc = JSON.parse(readFileSync(x.input, "utf8"));
+   doc.projects.books = { ...mappingEntry(), user: "writer" };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   writeJson(x.input, doc);
+   refused(install(x, { profile: "factory" }), /profile-library-business/);
+   delete doc.projects.books;
+diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
+index baabd843e..eeca18eb0 100644
+--- a/packages/cli/tests/launcher.test.mjs
++++ b/packages/cli/tests/launcher.test.mjs
+@@ -1,4 +1,4 @@
+-import { launchDoc } from "../../business/tests/helpers.mjs";
++import { FAR_DATE, launchDoc } from "../../business/tests/helpers.mjs";
+ // The S6 launcher inside a real bus host: real broker child, real runners
+ // in the bwrap sandbox, the fake adapter from packages/harness standing in for the
+ // harness. The chief of staff launches a coder through its `launch` tool (row 119: the
+@@ -32,7 +32,7 @@ const skip = sandboxProblem() ?? false;
+ 
+ test('C2-04: launcher workspace clones code but never the library', { skip, timeout: 30000 }, async t => {
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+-  const f = await setup(t, doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
++  const f = await setup(t, doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
+   await f.launcher.launchPm();
+   const workspace = workspaceDir(f.f.dataRoot, 'acme', 'chief');
+   assert.equal(existsSync(join(workspace, 'stack', '.git')), true);
+@@ -766,7 +766,7 @@ test("row 64 a role skill that isn't enabled refuses skill-not-enabled, and one
+ test("row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason", { timeout: 30000 }, async (t) => {
+   const text = "Warm. PERSONA-MARKER-d2\n";
+   const given = prepare(t, (doc) => {
+-    doc.roles.bean = { definition: "companion", vars: { harness: "pi", model: "claude-sonnet-5-5", thinking: "high", "persona.name": "Bean", "persona.sha256": createHash("sha256").update(text).digest("hex") } };
++    doc.roles.bean = { definition: "companion", credentials: { gitea: { store: true, rotateBy: FAR_DATE } }, vars: { harness: "pi", model: "claude-sonnet-5-5", thinking: "high", "persona.name": "Bean", "persona.sha256": createHash("sha256").update(text).digest("hex") } };
+     doc.launch.instances.push("bean");
+     return doc;
+   });
+diff --git a/packages/cli/tests/thread-launch.test.mjs b/packages/cli/tests/thread-launch.test.mjs
+index fa3adb866..3e313e49d 100644
+--- a/packages/cli/tests/thread-launch.test.mjs
++++ b/packages/cli/tests/thread-launch.test.mjs
+@@ -400,6 +400,7 @@ test("REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a t
+ test('C2-09a: fromSession refuses a creative instance outside a thread without a sandbox', { timeout: 30000 }, async t => {
+   const prepared = prepare(t, { edit: doc => {
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
++    doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.launch.instances.push('bean');
+     return doc;
+   } });
+@@ -465,7 +466,9 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+     const vars = { ...doc.roles.assistant.vars };
+     delete doc.roles.assistant;
+     doc.roles.bean = { definition: 'companion', vars: { ...vars } };
++    doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.roles.chet = { definition: 'continuity', vars: { ...vars } };
++    doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.launch.instances = ['coder', 'bean', 'chet'];
+     return doc;
+   } });
+@@ -501,6 +504,7 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+ test('C2-09a: terminating one creative thread does not signal an unselected peer of the same instance', { skip, timeout: 90000 }, async t => {
+   const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
++    doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     delete doc.roles.assistant;
+     doc.launch.instances = ['coder', 'bean'];
+     return doc;
+diff --git a/packages/cli/tests/trackers-boot.test.mjs b/packages/cli/tests/trackers-boot.test.mjs
+index 8d1a407c6..e7f50c947 100644
+--- a/packages/cli/tests/trackers-boot.test.mjs
++++ b/packages/cli/tests/trackers-boot.test.mjs
+@@ -14,7 +14,7 @@ import { fixture, tmp } from "./helpers.mjs";
+ 
+ test('C2-04: a library-only business with tracker.baseUrl boots without a project tracker', async t => {
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+-  const f = fixture(tmp(t), 'acme', doc => { doc.projects = { books: mappingEntry() }; return doc; });
++  const f = fixture(tmp(t), 'acme', doc => { doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } }; doc.projects = { books: mappingEntry() }; return doc; });
+   const warnings = [];
+   const boot = bootConfig({ system: loadSystem({ env: f.env }), businessId: 'acme', env: f.env, warn: text => warnings.push(text) });
+   assert.equal(boot.trackers, undefined);
+@@ -40,6 +40,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+ 
+   const f = fixture(root, "acme", (doc) => {
+     doc.projects = { books: mappingEntry(), ...doc.projects };
++    doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+     doc.vars["tracker.baseUrl"] = srv.url;
+     doc.tracker.sync.botId = bots.sync;
+     // The chief of staff (row 119) has no tracker bot.
+@@ -51,7 +52,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+     chmodSync(file, 0o600);
+   };
+   put(f.doc.tracker.sync.credentials.vikunja.file, fake.token(bots.sync, SCOPES.sync));
+-  for (const r of Object.keys(f.doc.roles)) if (f.doc.roles[r].credentials) put(f.doc.roles[r].credentials.vikunja.file, fake.token(bots[r], r === "pm" ? SCOPES.pm : SCOPES.worker));
++  for (const r of Object.keys(f.doc.roles)) if (f.doc.roles[r].credentials?.vikunja) put(f.doc.roles[r].credentials.vikunja.file, fake.token(bots[r], r === "pm" ? SCOPES.pm : SCOPES.worker));
+   writeJson(join(root, "project", ".mosaic", "project.json"), { projectVersion: 1, id: "stack", vars: { "tracker.project": project } });
+ 
+   mkdirSync(f.dataRoot, { recursive: true, mode: 0o700 });
+diff --git a/packages/control-board/tests/creative-hidden.test.mjs b/packages/control-board/tests/creative-hidden.test.mjs
+index c2abd348e..12e16866e 100644
+--- a/packages/control-board/tests/creative-hidden.test.mjs
++++ b/packages/control-board/tests/creative-hidden.test.mjs
+@@ -20,7 +20,9 @@ function fixture(t) {
+   const dir = join(root, "config");
+   const doc = businessDoc(root, "acme");
+   doc.projects = { books: mappingEntry(), ...doc.projects };
++  doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   doc.roles.bean = { definition: "companion" };
++  doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+   const threadDir = join(root, "data", "threads", "acme", "t1", "session");
+   mkdirSync(threadDir, { recursive: true });
+diff --git a/packages/discord/tests/library-seat.test.mjs b/packages/discord/tests/library-seat.test.mjs
+index 315f69698..a7ac869e5 100644
+--- a/packages/discord/tests/library-seat.test.mjs
++++ b/packages/discord/tests/library-seat.test.mjs
+@@ -31,7 +31,9 @@ function setup(overrides = {}) {
+ function business(s, { library, role = "sage", definition = "companion" }) {
+   const doc = businessDoc(s.root, "acme");
+   if (library) doc.projects = { books: mappingEntry(), ...doc.projects };
++  if (library) doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   doc.roles[role] = { definition };
++  doc.roles[role].credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+   writeJson(join(s.root, "businesses", "acme.json"), doc);
+ }
+ 

agents/magica/work/queue-285/b1-base-word-diff.txt

@@ -0,0 +1,698 @@
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/bus/tests/reload.test.mjs
+diff --git a/packages/bus/tests/reload.test.mjs b/packages/bus/tests/reload.test.mjs
+index 091b37b26..342d578d0 100644
+--- a/packages/bus/tests/reload.test.mjs
++++ b/packages/bus/tests/reload.test.mjs
+@@ -194,7 +194,7 @@ test('T14 a file whose project root differs from the boot copy is not reloaded,
+ });
+~
+ 
+~
+ test('T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start', async (t) => {
+~
+   const f = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects.books = mappingEntry(); });
+~
+   const doc = JSON.parse(readFileSync(f.file, 'utf8'));
+~
+   doc.projects.books.branch = 'other';
+~
+   writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
+~
+@@ -202,7 +202,7 @@ test('T14 a file whose library mapping differs from the boot copy is not reloade
+   assert.equal(added.restart, true);
+~
+   assert.equal(f.reloads.length, 0);
+~
+   // The same library entry reloads.
+~
+   const g = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects.books = mappingEntry(); });
+~
+   assert.equal(g.ask('instances.set', { revision: g.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer' }).restart, false);
+~
+   assert.equal(g.reloads.length, 1);
+~
+ });
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/business.test.mjs
+diff --git a/packages/business/tests/business.test.mjs b/packages/business/tests/business.test.mjs
+index 9d4eda831..f78789250 100644
+--- a/packages/business/tests/business.test.mjs
++++ b/packages/business/tests/business.test.mjs
+@@ -6,6 +6,7 @@ import { join } from "node:path";
+ import { pathToFileURL } from "node:url";
+~
+ import { BusinessError, businessFilePath, configDir, loadBusiness, validateBusinessDocument } from "../src/index.mjs";
+~
+ import { THREAD_IDLE_SECONDS } from "../src/business.mjs";
+~
++import { CREATIVE_DEFINITIONS } from "../src/vocabulary.mjs";
+~
+ import { launchDoc, businessDoc, REPO, REPO_ROLES, rolesCopy, tmp, writeJson } from "./helpers.mjs";
+~
+ 
+~
+ test('C2-04: library mappings load without roots, remain frozen, and retain mapping refusals', async t => {
+~
+@@ -14,6 +15,7 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+~
+   const doc = businessDoc(root), file = join(root, 'businesses/acme.json');
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   const loaded = validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES });
+~
+   const { checkMapping } = await import('../../library/src/mapping.mjs');
+~
+   assert.deepEqual(loaded.projects.books, checkMapping(mappingEntry()));
+~
+@@ -41,6 +43,7 @@ test('C2-04: an otherwise valid publish grant cannot name a library repo', async
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+~
+   const doc = businessDoc(root);
+~
+   doc.projects.books = { ...mappingEntry(), remote: 'https://git.example/writer/books' };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.coder.identity = { name: 'Coder', email: '[email protected]', gitea: { url: 'https://git.example', user: 'acme-coder' } };
+~
+   doc.roles.coder.publish = ['books'];
+~
+   refuses(() => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir: REPO_ROLES }), /publish.*library/);
+~
+@@ -273,28 +276,58 @@ test("the shipped example refuses as written and validates once filled in", () =
+   assert.equal(id, 15);
+~
+ });
+~
+ 
+~
++// Row 285 (C2-08b, #1790, mos-1330): a creative definition declares gitea, so its instance names
+~
++// the reference. The store form needs no token file, and the bus reads a missing one as no token.
+~
++const CREATIVE_GITEA = Object.freeze({ gitea: Object.freeze({ store: true, rotateBy: "2099-01-01" }) });
+~
+~
+ // Row 213 (C2-08, #1714), deviation D1: the persona vars sit on a creative instance only, and
+~
+ // both or neither. The var checks themselves are vars.mjs's.
+~
+ test("persona vars: agent layer, creative definition only, both or neither", () => {
+~
+   const sha = "a".repeat(64);
+~
+   const persona = { "persona.name": "Bean", "persona.sha256": sha };
+~
+   const business = check((d) => { d.roles.bean = { definition: "companion", 
++credentials: CREATIVE_GITEA,
+  vars: { ...persona } }; });
+~
+   assert.deepEqual({ ...business.roles.bean.vars }, persona);
+~
+   assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition: 
+-"ideas"
++"ideas", credentials: CREATIVE_GITEA
+  }; }));
+~
+   refuses(() => check((d) => { d.vars["persona.name"] = "Bean"; }), /persona\.name can't be set at the business layer/);
+~
+   refuses(() => check((d) => { d.roles.pm.vars = { ...d.roles.pm.vars, ...persona }; }),
+~
+     /roles\.pm\.vars: persona vars need a creative definition \(pm isn't one\)/);
+~
+   refuses(() => check((d) => { d.roles.chief.vars = { ...persona }; }), /chief-of-staff isn't one/);
+~
+   for (const key of Object.keys(persona)) {
+~
+     refuses(() => check((d) => { d.roles.bean = { definition: "research", 
++credentials: CREATIVE_GITEA,
+  vars: { [key]: persona[key] } }; }),
+~
+       /roles\.bean\.vars: persona\.name and persona\.sha256 are set together or not at all/);
+~
+   }
+~
+   for (const [key, value] of [["persona.name", "x".repeat(41)], ["persona.name", "Be\nan"], ["persona.name", "Be\u0007an"], ["persona.name", "Be\u2028an"], ["persona.name", "Be\u2029an"], ["persona.name", 7],
+~
+     ["persona.sha256", "A".repeat(64)], ["persona.sha256", sha.slice(1)], ["persona.sha256", `${sha}0`]]) {
+~
+     refuses(() => check((d) => { d.roles.bean = { definition: "companion", 
++credentials: CREATIVE_GITEA,
+  vars: { ...persona, [key]: value } }; }), new RegExp(`variable ${key.replace(".", "\\.")}`), 2);
+~
+   
++}
+~
++});
+~
+~
++// Row 285 (C2-08b, #1790, mos-1330): the chief and each creative definition declare gitea, so an
+~
++// instance without the reference refuses. Amendment 1 (mos-1580, sage-4060): the chief
+~
++// requires its reference only in a library business; creative definitions always require it.
+~
++test("row 285: a chief or creative instance without credentials.gitea refuses at load", async () => {
+~
++  const { mappingEntry } = await import("../../library/tests/helpers.mjs");
+~
++  refuses(() => check((d) => { d.projects.books = mappingEntry(); delete d.roles.chief.credentials; }),
+~
++    /chief-library-gitea-required: .*roles\.chief\.credentials/);
+~
++  for (const definition of CREATIVE_DEFINITIONS) {
+~
++    refuses(() => check((d) => { d.roles.bean = { definition }; }),
+~
++      /roles\.bean\.credentials must reference exactly the services its role definition needs \(gitea; got none\)/);
+~
++    assert.doesNotThrow(() => check((d) => { d.roles.bean = { definition, credentials: CREATIVE_GITEA }; }), definition);
+~
+   }
+~
+ });
+~
+ 
+~
++// Row 285 (C2-08b, brief): a creative instance may carry identity and publish, under the rules at
+~
++// business.mjs:155-166, which the grant path reads. The grant itself still refuses it (#giteaRole).
+~
++test("row 285: a creative instance with identity and publish loads", () => {
+~
++  const identity = { name: "Bean", email: "[email protected]", gitea: { url: "https://git.example", user: "acme-bean" } };
+~
++  const business = check((d) => {
+~
++    d.projects.stack.remote = "https://git.example/acme/stack";
+~
++    d.roles.bean = { definition: "companion", credentials: CREATIVE_GITEA, identity, publish: ["stack"] };
+~
++  });
+~
++  assert.deepEqual({ ...business.roles.bean.identity, gitea: { ...business.roles.bean.identity.gitea } }, identity);
+~
++  assert.deepEqual([...business.roles.bean.publish], ["stack"]);
+~
++});
+~
+~
+ // Row 194 (#1692, D2.5, T17): the per-agent forbid and the retired list.
+~
+ test("row 194 keep, noHire and retired validate, and a file without them loads as before", () => {
+~
+   const plain = check();
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/cli.test.mjs
+diff --git a/packages/business/tests/cli.test.mjs b/packages/business/tests/cli.test.mjs
+index 3aa1d52ee..beb367f8c 100644
+--- a/packages/business/tests/cli.test.mjs
++++ b/packages/business/tests/cli.test.mjs
+@@ -11,7 +11,7 @@ const CLI = join(REPO, "packages", "business", "src", "cli.mjs");
+ test('C2-04: business validate and resolve skip a library before code projects and credential checks', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const { rmSync } = await import('node:fs');
+~
+   const s = setup(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; });
+~
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+~
+   writeJson(projectFilePath(s.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+~
+   const checked = run(s, 'validate', 'acme');
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/instance-settings.test.mjs
+diff --git a/packages/business/tests/instance-settings.test.mjs b/packages/business/tests/instance-settings.test.mjs
+index e85366562..54c22e0e0 100644
+--- a/packages/business/tests/instance-settings.test.mjs
++++ b/packages/business/tests/instance-settings.test.mjs
+@@ -9,7 +9,7 @@ import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync }
+ import { join } from "node:path";
+~
+ import { instanceSettings } from "../src/instance-settings.mjs";
+~
+ import { projectFilePath } from "../src/project.mjs";
+~
+ import { businessDoc, 
++FAR_DATE,
+  REPO, rolesCopy, systemConfig, systemFor, tmp, writeJson } from "./helpers.mjs";
+~
+ 
+~
+ const CLI = join(REPO, "packages", "business", "src", "cli.mjs");
+~
+ const roots = [];
+~
+@@ -22,7 +22,7 @@ const LEVELS = { pi: ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
+ 
+~
+ test('C2-04: instance settings skip a library while checking a later code project', async () => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = fixture(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; });
+~
+   writeJson(projectFilePath(f.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+~
+   const before = f.settings.read('acme');
+~
+   f.settings.set('acme', { revision: before.revision, instance: 'gate-215', op: 'add', definition: 'merge-gate' }, 'jason');
+~
+@@ -286,7 +286,8 @@ test("row 213 a creative instance is the human's: add, vars and definition chang
+   writeFileSync(join(f.root, "config", "personas", "acme", "bean.md"), text, { mode: 0o600 });
+~
+   const persona = { "persona.name": "Bean", "persona.sha256": createHash("sha256").update(text).digest("hex") };
+~
+   const view = f.settings.read("acme");
+~
+   
++// Row 285 (mos-1332 item 4): the companion definition declares gitea.
+~
+   assert.deepEqual(view.definitions.companion, { services: 
+-[],
++["gitea"],
+  accepted: true });
+~
+   const add = { instance: "bean", op: "add", definition: "companion", vars: persona };
+~
+   for (const actor of ["chief-of-staff.chief", "tester"]) {
+~
+     assert.throws(() => f.settings.set("acme", { revision: view.revision, ...add }, actor), e => e.code === "organization-creative-human-only", actor);
+~
+@@ -331,8 +332,8 @@ test("row 213 a creative instance is the human's: add, vars and definition chang
+ // every actor, the human included. The listing's endProtected is that same check for its reader.
+~
+ test("row 256 T1-T3, T5 the human deletes a creative instance, no other actor does, and the assistant stays", () => {
+~
+   const f = fixture(doc => {
+~
+     doc.roles.bean = { definition: 
+-"companion"
++"companion", credentials: { gitea: { store: true, rotateBy: FAR_DATE } }
+  };
+~
+     doc.roles.muse = { definition: 
+-"ideas"
++"ideas", credentials: { gitea: { store: true, rotateBy: FAR_DATE } }
+  };
+~
+     doc.roles.assistant = { definition: "assistant", holder: "mos" };
+~
+   });
+~
+   const del = (instance, actor) => () => f.settings.set("acme", { revision: f.settings.read("acme").revision, instance, op: "delete" }, actor);
+~
+@@ -377,7 +378,7 @@ test("row 256 T1-T3, T5 the human deletes a creative instance, no other actor do
+ // instance can't be kept, launch.by or an arbiter, so the check it reaches is the last-listed one.
+~
+ test("row 256 T4 the human's delete of the only listed instance, a creative one, is the last-listed refusal", () => {
+~
+   const f = fixture(doc => {
+~
+     doc.roles.bean = { definition: 
+-"companion"
++"companion", credentials: { gitea: { store: true, rotateBy: FAR_DATE } }
+  };
+~
+     doc.launch.instances = ["bean"];
+~
+   });
+~
+   const bytes = readFileSync(f.file, "utf8");
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/library-projects-protected.test.mjs
+diff --git a/packages/business/tests/library-projects-protected.test.mjs b/packages/business/tests/library-projects-protected.test.mjs
+index 51672bd7b..d4d09d94f 100644
+--- a/packages/business/tests/library-projects-protected.test.mjs
++++ b/packages/business/tests/library-projects-protected.test.mjs
+@@ -14,6 +14,7 @@ function fixture(t) {
+   books.universes.hybrid = { kind: 'hybrid', name: 'An invented crossover',
+~
+     sources: ['harbor', 'second'], books: ['Hybrid Book'], playground: [], constraints: [], notes: 'Fixture only' };
+~
+   doc.projects = { books, ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   const dir = join(root, 'config'), file = writeJson(join(dir, 'businesses/acme.json'), doc);
+~
+   const writer = organizationWriter({ dir, rolesDir: rolesCopy(root) });
+~
+   // Give both snapshots an existing ordinary committed receipt to preserve.
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/library-seats.test.mjs
+diff --git a/packages/business/tests/library-seats.test.mjs b/packages/business/tests/library-seats.test.mjs
+index 3cd0f86cf..da76fdbc7 100644
+--- a/packages/business/tests/library-seats.test.mjs
++++ b/packages/business/tests/library-seats.test.mjs
+@@ -27,7 +27,9 @@ test("M7/M8: library seats come from library businesses, creative seats from the
+   const { root, dir } = fixture(t);
+~
+   const doc = businessDoc(root, "acme");
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+~
+   const found = sets(dir);
+~
+   assert.deepEqual([...found.librarySeats].sort(), ["bean", "chief", "coder", "cto", "pm", "reviewer"]);
+~
+@@ -39,6 +41,7 @@ test("M8: a business with no library project puts no seat in either set", (t) =>
+   const { root, dir } = fixture(t);
+~
+   const doc = businessDoc(root, "other");
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "other.json"), doc);
+~
+   const found = sets(dir);
+~
+   assert.equal(found.librarySeats.size, 0);
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/business/tests/resolve.test.mjs
+diff --git a/packages/business/tests/resolve.test.mjs b/packages/business/tests/resolve.test.mjs
+index b1e50f349..2fa106053 100644
+--- a/packages/business/tests/resolve.test.mjs
++++ b/packages/business/tests/resolve.test.mjs
+@@ -31,7 +31,7 @@ const resolve = (s, instance) => resolveInstance({ system: s.system, business: s
+ test('C2-04: a library first in projects does not hide a later project layer', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const { rmSync } = await import('node:fs');
+~
+   const s = setup(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; }, { vars: { 'tracker.project': 7 } });
+~
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+~
+   const result = resolve(s, 'coder');
+~
+   assert.equal(result.project, 'stack');
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/cli/tests/case2-install.test.mjs
+diff --git a/packages/cli/tests/case2-install.test.mjs b/packages/cli/tests/case2-install.test.mjs
+index cc1142510..51b606bda 100644
+--- a/packages/cli/tests/case2-install.test.mjs
++++ b/packages/cli/tests/case2-install.test.mjs
+@@ -51,8 +51,11 @@ function world(t, { profile = "library" } = {}) {
+   for (const r of Object.values(doc.roles)) r.vars = { ...r.vars, harness: "pi" };
+~
+   if (profile === "library") {
+~
+     doc.projects.books = { ...mappingEntry(), user: "writer" };
+~
+     
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.bean = { definition: "companion", vars: { harness: "pi" } };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.chet = { definition: "companion", vars: { harness: "pi" } };
+~
+     
++doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   } else doc.vars["bus.tester"] = true;
+~
+   const input = writeJson(join(root, "input", "acme.json"), doc);
+~
+   const staging = join(root, "staging");
+~
+@@ -212,6 +215,7 @@ test("the factory install refuses a library project and bus.tester off, before a
+   const x = world(t, { profile: "factory" });
+~
+   const doc = JSON.parse(readFileSync(x.input, "utf8"));
+~
+   doc.projects.books = { ...mappingEntry(), user: "writer" };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(x.input, doc);
+~
+   refused(install(x, { profile: "factory" }), /profile-library-business/);
+~
+   delete doc.projects.books;
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/cli/tests/launcher.test.mjs
+diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
+index baabd843e..eeca18eb0 100644
+--- a/packages/cli/tests/launcher.test.mjs
++++ b/packages/cli/tests/launcher.test.mjs
+@@ -1,4 +1,4 @@
+ import { 
++FAR_DATE,
+  launchDoc } from "../../business/tests/helpers.mjs";
+~
+ // The S6 launcher inside a real bus host: real broker child, real runners
+~
+ // in the bwrap sandbox, the fake adapter from packages/harness standing in for the
+~
+ // harness. The chief of staff launches a coder through its `launch` tool (row 119: the
+~
+@@ -32,7 +32,7 @@ const skip = sandboxProblem() ?? false;
+ 
+~
+ test('C2-04: launcher workspace clones code but never the library', { skip, timeout: 30000 }, async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
+~
+   await f.launcher.launchPm();
+~
+   const workspace = workspaceDir(f.f.dataRoot, 'acme', 'chief');
+~
+   assert.equal(existsSync(join(workspace, 'stack', '.git')), true);
+~
+@@ -766,7 +766,7 @@ test("row 64 a role skill that isn't enabled refuses skill-not-enabled, and one
+ test("row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason", { timeout: 30000 }, async (t) => {
+~
+   const text = "Warm. PERSONA-MARKER-d2\n";
+~
+   const given = prepare(t, (doc) => {
+~
+     doc.roles.bean = { definition: "companion", 
++credentials: { gitea: { store: true, rotateBy: FAR_DATE } },
+  vars: { harness: "pi", model: "claude-sonnet-5-5", thinking: "high", "persona.name": "Bean", "persona.sha256": createHash("sha256").update(text).digest("hex") } };
+~
+     doc.launch.instances.push("bean");
+~
+     return doc;
+~
+   });
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/cli/tests/thread-launch.test.mjs
+diff --git a/packages/cli/tests/thread-launch.test.mjs b/packages/cli/tests/thread-launch.test.mjs
+index fa3adb866..3e313e49d 100644
+--- a/packages/cli/tests/thread-launch.test.mjs
++++ b/packages/cli/tests/thread-launch.test.mjs
+@@ -400,6 +400,7 @@ test("REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a t
+ test('C2-09a: fromSession refuses a creative instance outside a thread without a sandbox', { timeout: 30000 }, async t => {
+~
+   const prepared = prepare(t, { edit: doc => {
+~
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.launch.instances.push('bean');
+~
+     return doc;
+~
+   } });
+~
+@@ -465,7 +466,9 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+     const vars = { ...doc.roles.assistant.vars };
+~
+     delete doc.roles.assistant;
+~
+     doc.roles.bean = { definition: 'companion', vars: { ...vars } };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.chet = { definition: 'continuity', vars: { ...vars } };
+~
+     
++doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.launch.instances = ['coder', 'bean', 'chet'];
+~
+     return doc;
+~
+   } });
+~
+@@ -501,6 +504,7 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+ test('C2-09a: terminating one creative thread does not signal an unselected peer of the same instance', { skip, timeout: 90000 }, async t => {
+~
+   const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
+~
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     delete doc.roles.assistant;
+~
+     doc.launch.instances = ['coder', 'bean'];
+~
+     return doc;
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/cli/tests/trackers-boot.test.mjs
+diff --git a/packages/cli/tests/trackers-boot.test.mjs b/packages/cli/tests/trackers-boot.test.mjs
+index 8d1a407c6..e7f50c947 100644
+--- a/packages/cli/tests/trackers-boot.test.mjs
++++ b/packages/cli/tests/trackers-boot.test.mjs
+@@ -14,7 +14,7 @@ import { fixture, tmp } from "./helpers.mjs";
+ 
+~
+ test('C2-04: a library-only business with tracker.baseUrl boots without a project tracker', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = fixture(tmp(t), 'acme', doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry() }; return doc; });
+~
+   const warnings = [];
+~
+   const boot = bootConfig({ system: loadSystem({ env: f.env }), businessId: 'acme', env: f.env, warn: text => warnings.push(text) });
+~
+   assert.equal(boot.trackers, undefined);
+~
+@@ -40,6 +40,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+ 
+~
+   const f = fixture(root, "acme", (doc) => {
+~
+     doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+     
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.vars["tracker.baseUrl"] = srv.url;
+~
+     doc.tracker.sync.botId = bots.sync;
+~
+     // The chief of staff (row 119) has no tracker bot.
+~
+@@ -51,7 +52,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+     chmodSync(file, 0o600);
+~
+   };
+~
+   put(f.doc.tracker.sync.credentials.vikunja.file, fake.token(bots.sync, SCOPES.sync));
+~
+   for (const r of Object.keys(f.doc.roles)) if 
+-(f.doc.roles[r].credentials)
++(f.doc.roles[r].credentials?.vikunja)
+  put(f.doc.roles[r].credentials.vikunja.file, fake.token(bots[r], r === "pm" ? SCOPES.pm : SCOPES.worker));
+~
+   writeJson(join(root, "project", ".mosaic", "project.json"), { projectVersion: 1, id: "stack", vars: { "tracker.project": project } });
+~
+ 
+~
+   mkdirSync(f.dataRoot, { recursive: true, mode: 0o700 });
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/control-board/tests/creative-hidden.test.mjs
+diff --git a/packages/control-board/tests/creative-hidden.test.mjs b/packages/control-board/tests/creative-hidden.test.mjs
+index c2abd348e..12e16866e 100644
+--- a/packages/control-board/tests/creative-hidden.test.mjs
++++ b/packages/control-board/tests/creative-hidden.test.mjs
+@@ -20,7 +20,9 @@ function fixture(t) {
+   const dir = join(root, "config");
+~
+   const doc = businessDoc(root, "acme");
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+~
+   const threadDir = join(root, "data", "threads", "acme", "t1", "session");
+~
+   mkdirSync(threadDir, { recursive: true });
+~
+
+Command: git diff --no-color --word-diff=porcelain e0c6142f3 -- packages/discord/tests/library-seat.test.mjs
+diff --git a/packages/discord/tests/library-seat.test.mjs b/packages/discord/tests/library-seat.test.mjs
+index 315f69698..a7ac869e5 100644
+--- a/packages/discord/tests/library-seat.test.mjs
++++ b/packages/discord/tests/library-seat.test.mjs
+@@ -31,7 +31,9 @@ function setup(overrides = {}) {
+ function business(s, { library, role = "sage", definition = "companion" }) {
+~
+   const doc = businessDoc(s.root, "acme");
+~
+   if (library) doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++if (library) doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles[role] = { definition };
+~
+   
++doc.roles[role].credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(s.root, "businesses", "acme.json"), doc);
+~
+ }
+~
+ 
+~

agents/magica/work/queue-285/b1-incremental-word-diff.txt

@@ -0,0 +1,452 @@
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/bus/tests/reload.test.mjs
+diff --git a/packages/bus/tests/reload.test.mjs b/packages/bus/tests/reload.test.mjs
+index 091b37b26..342d578d0 100644
+--- a/packages/bus/tests/reload.test.mjs
++++ b/packages/bus/tests/reload.test.mjs
+@@ -194,7 +194,7 @@ test('T14 a file whose project root differs from the boot copy is not reloaded,
+ });
+~
+ 
+~
+ test('T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start', async (t) => {
+~
+   const f = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects.books = mappingEntry(); });
+~
+   const doc = JSON.parse(readFileSync(f.file, 'utf8'));
+~
+   doc.projects.books.branch = 'other';
+~
+   writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
+~
+@@ -202,7 +202,7 @@ test('T14 a file whose library mapping differs from the boot copy is not reloade
+   assert.equal(added.restart, true);
+~
+   assert.equal(f.reloads.length, 0);
+~
+   // The same library entry reloads.
+~
+   const g = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects.books = mappingEntry(); });
+~
+   assert.equal(g.ask('instances.set', { revision: g.revision(), instance: 'sec-1', op: 'add', definition: 'security-reviewer' }).restart, false);
+~
+   assert.equal(g.reloads.length, 1);
+~
+ });
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/business.test.mjs
+diff --git a/packages/business/tests/business.test.mjs b/packages/business/tests/business.test.mjs
+index b79576af8..f78789250 100644
+--- a/packages/business/tests/business.test.mjs
++++ b/packages/business/tests/business.test.mjs
+@@ -15,6 +15,7 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+~
+   const doc = businessDoc(root), file = join(root, 'businesses/acme.json');
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   const loaded = validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES });
+~
+   const { checkMapping } = await import('../../library/src/mapping.mjs');
+~
+   assert.deepEqual(loaded.projects.books, checkMapping(mappingEntry()));
+~
+@@ -42,6 +43,7 @@ test('C2-04: an otherwise valid publish grant cannot name a library repo', async
+   const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+~
+   const doc = businessDoc(root);
+~
+   doc.projects.books = { ...mappingEntry(), remote: 'https://git.example/writer/books' };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.coder.identity = { name: 'Coder', email: '[email protected]', gitea: { url: 'https://git.example', user: 'acme-coder' } };
+~
+   doc.roles.coder.publish = ['books'];
+~
+   refuses(() => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir: REPO_ROLES }), /publish.*library/);
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/cli.test.mjs
+diff --git a/packages/business/tests/cli.test.mjs b/packages/business/tests/cli.test.mjs
+index 3aa1d52ee..beb367f8c 100644
+--- a/packages/business/tests/cli.test.mjs
++++ b/packages/business/tests/cli.test.mjs
+@@ -11,7 +11,7 @@ const CLI = join(REPO, "packages", "business", "src", "cli.mjs");
+ test('C2-04: business validate and resolve skip a library before code projects and credential checks', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const { rmSync } = await import('node:fs');
+~
+   const s = setup(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; });
+~
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+~
+   writeJson(projectFilePath(s.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+~
+   const checked = run(s, 'validate', 'acme');
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/instance-settings.test.mjs
+diff --git a/packages/business/tests/instance-settings.test.mjs b/packages/business/tests/instance-settings.test.mjs
+index 4b4860633..54c22e0e0 100644
+--- a/packages/business/tests/instance-settings.test.mjs
++++ b/packages/business/tests/instance-settings.test.mjs
+@@ -22,7 +22,7 @@ const LEVELS = { pi: ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
+ 
+~
+ test('C2-04: instance settings skip a library while checking a later code project', async () => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = fixture(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; });
+~
+   writeJson(projectFilePath(f.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
+~
+   const before = f.settings.read('acme');
+~
+   f.settings.set('acme', { revision: before.revision, instance: 'gate-215', op: 'add', definition: 'merge-gate' }, 'jason');
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/library-projects-protected.test.mjs
+diff --git a/packages/business/tests/library-projects-protected.test.mjs b/packages/business/tests/library-projects-protected.test.mjs
+index 51672bd7b..d4d09d94f 100644
+--- a/packages/business/tests/library-projects-protected.test.mjs
++++ b/packages/business/tests/library-projects-protected.test.mjs
+@@ -14,6 +14,7 @@ function fixture(t) {
+   books.universes.hybrid = { kind: 'hybrid', name: 'An invented crossover',
+~
+     sources: ['harbor', 'second'], books: ['Hybrid Book'], playground: [], constraints: [], notes: 'Fixture only' };
+~
+   doc.projects = { books, ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   const dir = join(root, 'config'), file = writeJson(join(dir, 'businesses/acme.json'), doc);
+~
+   const writer = organizationWriter({ dir, rolesDir: rolesCopy(root) });
+~
+   // Give both snapshots an existing ordinary committed receipt to preserve.
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/library-seats.test.mjs
+diff --git a/packages/business/tests/library-seats.test.mjs b/packages/business/tests/library-seats.test.mjs
+index 3cd0f86cf..da76fdbc7 100644
+--- a/packages/business/tests/library-seats.test.mjs
++++ b/packages/business/tests/library-seats.test.mjs
+@@ -27,7 +27,9 @@ test("M7/M8: library seats come from library businesses, creative seats from the
+   const { root, dir } = fixture(t);
+~
+   const doc = businessDoc(root, "acme");
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+~
+   const found = sets(dir);
+~
+   assert.deepEqual([...found.librarySeats].sort(), ["bean", "chief", "coder", "cto", "pm", "reviewer"]);
+~
+@@ -39,6 +41,7 @@ test("M8: a business with no library project puts no seat in either set", (t) =>
+   const { root, dir } = fixture(t);
+~
+   const doc = businessDoc(root, "other");
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "other.json"), doc);
+~
+   const found = sets(dir);
+~
+   assert.equal(found.librarySeats.size, 0);
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/business/tests/resolve.test.mjs
+diff --git a/packages/business/tests/resolve.test.mjs b/packages/business/tests/resolve.test.mjs
+index b1e50f349..2fa106053 100644
+--- a/packages/business/tests/resolve.test.mjs
++++ b/packages/business/tests/resolve.test.mjs
+@@ -31,7 +31,7 @@ const resolve = (s, instance) => resolveInstance({ system: s.system, business: s
+ test('C2-04: a library first in projects does not hide a later project layer', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const { rmSync } = await import('node:fs');
+~
+   const s = setup(doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; }, { vars: { 'tracker.project': 7 } });
+~
+   t.after(() => rmSync(s.root, { recursive: true, force: true }));
+~
+   const result = resolve(s, 'coder');
+~
+   assert.equal(result.project, 'stack');
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/cli/tests/case2-install.test.mjs
+diff --git a/packages/cli/tests/case2-install.test.mjs b/packages/cli/tests/case2-install.test.mjs
+index cc1142510..51b606bda 100644
+--- a/packages/cli/tests/case2-install.test.mjs
++++ b/packages/cli/tests/case2-install.test.mjs
+@@ -51,8 +51,11 @@ function world(t, { profile = "library" } = {}) {
+   for (const r of Object.values(doc.roles)) r.vars = { ...r.vars, harness: "pi" };
+~
+   if (profile === "library") {
+~
+     doc.projects.books = { ...mappingEntry(), user: "writer" };
+~
+     
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.bean = { definition: "companion", vars: { harness: "pi" } };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.chet = { definition: "companion", vars: { harness: "pi" } };
+~
+     
++doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   } else doc.vars["bus.tester"] = true;
+~
+   const input = writeJson(join(root, "input", "acme.json"), doc);
+~
+   const staging = join(root, "staging");
+~
+@@ -212,6 +215,7 @@ test("the factory install refuses a library project and bus.tester off, before a
+   const x = world(t, { profile: "factory" });
+~
+   const doc = JSON.parse(readFileSync(x.input, "utf8"));
+~
+   doc.projects.books = { ...mappingEntry(), user: "writer" };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(x.input, doc);
+~
+   refused(install(x, { profile: "factory" }), /profile-library-business/);
+~
+   delete doc.projects.books;
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/cli/tests/launcher.test.mjs
+diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
+index 9e7518ee5..eeca18eb0 100644
+--- a/packages/cli/tests/launcher.test.mjs
++++ b/packages/cli/tests/launcher.test.mjs
+@@ -32,7 +32,7 @@ const skip = sandboxProblem() ?? false;
+ 
+~
+ test('C2-04: launcher workspace clones code but never the library', { skip, timeout: 30000 }, async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = await setup(t, doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
+~
+   await f.launcher.launchPm();
+~
+   const workspace = workspaceDir(f.f.dataRoot, 'acme', 'chief');
+~
+   assert.equal(existsSync(join(workspace, 'stack', '.git')), true);
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/cli/tests/thread-launch.test.mjs
+diff --git a/packages/cli/tests/thread-launch.test.mjs b/packages/cli/tests/thread-launch.test.mjs
+index fa3adb866..3e313e49d 100644
+--- a/packages/cli/tests/thread-launch.test.mjs
++++ b/packages/cli/tests/thread-launch.test.mjs
+@@ -400,6 +400,7 @@ test("REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a t
+ test('C2-09a: fromSession refuses a creative instance outside a thread without a sandbox', { timeout: 30000 }, async t => {
+~
+   const prepared = prepare(t, { edit: doc => {
+~
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.launch.instances.push('bean');
+~
+     return doc;
+~
+   } });
+~
+@@ -465,7 +466,9 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+     const vars = { ...doc.roles.assistant.vars };
+~
+     delete doc.roles.assistant;
+~
+     doc.roles.bean = { definition: 'companion', vars: { ...vars } };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.roles.chet = { definition: 'continuity', vars: { ...vars } };
+~
+     
++doc.roles.chet.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.launch.instances = ['coder', 'bean', 'chet'];
+~
+     return doc;
+~
+   } });
+~
+@@ -501,6 +504,7 @@ test('C2-09a: creative thread messages start distinct runs and keep each instanc
+ test('C2-09a: terminating one creative thread does not signal an unselected peer of the same instance', { skip, timeout: 90000 }, async t => {
+~
+   const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
+~
+     doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+~
+     
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     delete doc.roles.assistant;
+~
+     doc.launch.instances = ['coder', 'bean'];
+~
+     return doc;
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/cli/tests/trackers-boot.test.mjs
+diff --git a/packages/cli/tests/trackers-boot.test.mjs b/packages/cli/tests/trackers-boot.test.mjs
+index 8d1a407c6..e7f50c947 100644
+--- a/packages/cli/tests/trackers-boot.test.mjs
++++ b/packages/cli/tests/trackers-boot.test.mjs
+@@ -14,7 +14,7 @@ import { fixture, tmp } from "./helpers.mjs";
+ 
+~
+ test('C2-04: a library-only business with tracker.baseUrl boots without a project tracker', async t => {
+~
+   const { mappingEntry } = await import('../../library/tests/helpers.mjs');
+~
+   const f = fixture(tmp(t), 'acme', doc => { 
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+  doc.projects = { books: mappingEntry() }; return doc; });
+~
+   const warnings = [];
+~
+   const boot = bootConfig({ system: loadSystem({ env: f.env }), businessId: 'acme', env: f.env, warn: text => warnings.push(text) });
+~
+   assert.equal(boot.trackers, undefined);
+~
+@@ -40,6 +40,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+ 
+~
+   const f = fixture(root, "acme", (doc) => {
+~
+     doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+     
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+     doc.vars["tracker.baseUrl"] = srv.url;
+~
+     doc.tracker.sync.botId = bots.sync;
+~
+     // The chief of staff (row 119) has no tracker bot.
+~
+@@ -51,7 +52,7 @@ test("bootConfig trackers reach the S3 adapter in the real broker child, which g
+     chmodSync(file, 0o600);
+~
+   };
+~
+   put(f.doc.tracker.sync.credentials.vikunja.file, fake.token(bots.sync, SCOPES.sync));
+~
+   for (const r of Object.keys(f.doc.roles)) if 
+-(f.doc.roles[r].credentials)
++(f.doc.roles[r].credentials?.vikunja)
+  put(f.doc.roles[r].credentials.vikunja.file, fake.token(bots[r], r === "pm" ? SCOPES.pm : SCOPES.worker));
+~
+   writeJson(join(root, "project", ".mosaic", "project.json"), { projectVersion: 1, id: "stack", vars: { "tracker.project": project } });
+~
+ 
+~
+   mkdirSync(f.dataRoot, { recursive: true, mode: 0o700 });
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/control-board/tests/creative-hidden.test.mjs
+diff --git a/packages/control-board/tests/creative-hidden.test.mjs b/packages/control-board/tests/creative-hidden.test.mjs
+index c2abd348e..12e16866e 100644
+--- a/packages/control-board/tests/creative-hidden.test.mjs
++++ b/packages/control-board/tests/creative-hidden.test.mjs
+@@ -20,7 +20,9 @@ function fixture(t) {
+   const dir = join(root, "config");
+~
+   const doc = businessDoc(root, "acme");
+~
+   doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles.bean = { definition: "companion" };
+~
+   
++doc.roles.bean.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(dir, "businesses", "acme.json"), doc);
+~
+   const threadDir = join(root, "data", "threads", "acme", "t1", "session");
+~
+   mkdirSync(threadDir, { recursive: true });
+~
+
+Command: git diff --no-color --word-diff=porcelain babae6adc -- packages/discord/tests/library-seat.test.mjs
+diff --git a/packages/discord/tests/library-seat.test.mjs b/packages/discord/tests/library-seat.test.mjs
+index 315f69698..a7ac869e5 100644
+--- a/packages/discord/tests/library-seat.test.mjs
++++ b/packages/discord/tests/library-seat.test.mjs
+@@ -31,7 +31,9 @@ function setup(overrides = {}) {
+ function business(s, { library, role = "sage", definition = "companion" }) {
+~
+   const doc = businessDoc(s.root, "acme");
+~
+   if (library) doc.projects = { books: mappingEntry(), ...doc.projects };
+~
+   
++if (library) doc.roles.chief.credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   doc.roles[role] = { definition };
+~
+   
++doc.roles[role].credentials = { gitea: { ...doc.roles.coder.credentials.gitea } };
+~
+   writeJson(join(s.root, "businesses", "acme.json"), doc);
+~
+ }
+~
+ 
+~

agents/magica/work/queue-285/gate/bus/access-revoke.test.mjs.log

@@ -0,0 +1,70 @@
+TAP version 13
+# Subtest: R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked
+ok 1 - R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked
+  ---
+  duration_ms: 33.626648
+  type: 'test'
+  ...
+# Subtest: R4: an expiry with no write and no request ends the run at the next timer sweep
+ok 2 - R4: an expiry with no write and no request ends the run at the next timer sweep
+  ---
+  duration_ms: 24.298035
+  type: 'test'
+  ...
+# Subtest: R4: a downgrade to viewer is a loss
+ok 3 - R4: a downgrade to viewer is a loss
+  ---
+  duration_ms: 22.57153
+  type: 'test'
+  ...
+# Subtest: R4: another user's request after a hand edit ends the lost user's run, and its own run stays
+ok 4 - R4: another user's request after a hand edit ends the lost user's run, and its own run stays
+  ---
+  duration_ms: 23.569539
+  type: 'test'
+  ...
+# Subtest: R4: a request reads the access file only when its stamp changed, once per change
+ok 5 - R4: a request reads the access file only when its stamp changed, once per change
+  ---
+  duration_ms: 21.657022
+  type: 'test'
+  ...
+# Subtest: R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused
+ok 6 - R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused
+  ---
+  duration_ms: 28.239912
+  type: 'test'
+  ...
+# Subtest: R4: threadsState marks revoked: true on the lost user's thread only, a pending message included
+ok 7 - R4: threadsState marks revoked: true on the lost user's thread only, a pending message included
+  ---
+  duration_ms: 19.026173
+  type: 'test'
+  ...
+# Subtest: R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked
+ok 8 - R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked
+  ---
+  duration_ms: 23.579436
+  type: 'test'
+  ...
+# Subtest: R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed
+ok 9 - R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed
+  ---
+  duration_ms: 18.706671
+  type: 'test'
+  ...
+# Subtest: R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer
+ok 10 - R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer
+  ---
+  duration_ms: 51.190176
+  type: 'test'
+  ...
+1..10
+# tests 10
+# suites 0
+# pass 10
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 403.444104

agents/magica/work/queue-285/gate/bus/account-migration.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
+ok 1 - REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
+  ---
+  duration_ms: 83.317074
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
+ok 2 - REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
+  ---
+  duration_ms: 99.893076
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
+ok 3 - REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 88.767524
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 336.91479

agents/magica/work/queue-285/gate/bus/address.test.mjs.log

@@ -0,0 +1,100 @@
+TAP version 13
+# Subtest: parseAddress: one
+ok 1 - parseAddress: one
+  ---
+  duration_ms: 1.215726
+  type: 'test'
+  ...
+# Subtest: parseAddress: many
+ok 2 - parseAddress: many
+  ---
+  duration_ms: 0.109567
+  type: 'test'
+  ...
+# Subtest: parseAddress: repeat
+ok 3 - parseAddress: repeat
+  ---
+  duration_ms: 0.113433
+  type: 'test'
+  ...
+# Subtest: parseAddress: plain
+ok 4 - parseAddress: plain
+  ---
+  duration_ms: 0.086429
+  type: 'test'
+  ...
+# Subtest: parseAddress: stop
+ok 5 - parseAddress: stop
+  ---
+  duration_ms: 0.094831
+  type: 'test'
+  ...
+# Subtest: parseAddress: EOF tag
+ok 6 - parseAddress: EOF tag
+  ---
+  duration_ms: 0.084473
+  type: 'test'
+  ...
+# Subtest: parseAddress: EOF last tag
+ok 7 - parseAddress: EOF last tag
+  ---
+  duration_ms: 0.093228
+  type: 'test'
+  ...
+# Subtest: parseAddress: leading whitespace
+ok 8 - parseAddress: leading whitespace
+  ---
+  duration_ms: 0.082522
+  type: 'test'
+  ...
+# Subtest: parseAddress: tags only
+ok 9 - parseAddress: tags only
+  ---
+  duration_ms: 0.101877
+  type: 'test'
+  ...
+# Subtest: parseAddress: empty
+ok 10 - parseAddress: empty
+  ---
+  duration_ms: 0.147787
+  type: 'test'
+  ...
+# Subtest: parseAddress: whitespace
+ok 11 - parseAddress: whitespace
+  ---
+  duration_ms: 0.070537
+  type: 'test'
+  ...
+# Subtest: parseAddress: bare at
+ok 12 - parseAddress: bare at
+  ---
+  duration_ms: 0.058675
+  type: 'test'
+  ...
+# Subtest: parseAddress: punctuation is a name
+ok 13 - parseAddress: punctuation is a name
+  ---
+  duration_ms: 0.053762
+  type: 'test'
+  ...
+# Subtest: parseAddress rejects non-text without coercion
+ok 14 - parseAddress rejects non-text without coercion
+  ---
+  duration_ms: 0.305883
+  type: 'test'
+  ...
+# Subtest: the mounted address parser has no import dependency
+ok 15 - the mounted address parser has no import dependency
+  ---
+  duration_ms: 0.182326
+  type: 'test'
+  ...
+1..15
+# tests 15
+# suites 0
+# pass 15
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 50.77204

agents/magica/work/queue-285/gate/bus/agents.test.mjs.log

@@ -0,0 +1,76 @@
+TAP version 13
+# Subtest: agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
+ok 1 - agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
+  ---
+  duration_ms: 23.039682
+  type: 'test'
+  ...
+# Subtest: agents: working counts what the holder received and has not read; routed alone is not working
+ok 2 - agents: working counts what the holder received and has not read; routed alone is not working
+  ---
+  duration_ms: 20.838861
+  type: 'test'
+  ...
+# Subtest: agents: input needed is the role's open decisions routed to the human, gated first, then oldest
+ok 3 - agents: input needed is the role's open decisions routed to the human, gated first, then oldest
+  ---
+  duration_ms: 33.753622
+  type: 'test'
+  ...
+# Subtest: agents: working wins over waiting, and Input needed still shows
+ok 4 - agents: working wins over waiting, and Input needed still shows
+  ---
+  duration_ms: 16.123908
+  type: 'test'
+  ...
+# Subtest: agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
+ok 5 - agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
+  ---
+  duration_ms: 19.19964
+  type: 'test'
+  ...
+# Subtest: agents: state reads only its own business, even for a run name both use
+ok 6 - agents: state reads only its own business, even for a run name both use
+  ---
+  duration_ms: 18.006766
+  type: 'test'
+  ...
+# Subtest: agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
+ok 7 - agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
+  ---
+  duration_ms: 20.989914
+  type: 'test'
+  ...
+# Subtest: agents: a message the holder read is not stranded; one the current holder has not read is not listed
+ok 8 - agents: a message the holder read is not stranded; one the current holder has not read is not listed
+  ---
+  duration_ms: 19.359359
+  type: 'test'
+  ...
+# Subtest: agents: stranded is oldest first and capped at 50 for a role
+ok 9 - agents: stranded is oldest first and capped at 50 for a role
+  ---
+  duration_ms: 83.800358
+  type: 'test'
+  ...
+# Subtest: agents: stranded is per role and per business
+ok 10 - agents: stranded is per role and per business
+  ---
+  duration_ms: 30.675778
+  type: 'test'
+  ...
+# Subtest: agents: a message routed to a held role and not yet received is not stranded
+ok 11 - agents: a message routed to a held role and not yet received is not stranded
+  ---
+  duration_ms: 12.903845
+  type: 'test'
+  ...
+1..11
+# tests 11
+# suites 0
+# pass 11
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 380.772119

agents/magica/work/queue-285/gate/bus/approval-binding.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
+ok 1 - REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
+  ---
+  duration_ms: 32.600196
+  type: 'test'
+  ...
+# Subtest: REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
+ok 2 - REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
+  ---
+  duration_ms: 17.073437
+  type: 'test'
+  ...
+# Subtest: REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
+ok 3 - REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
+  ---
+  duration_ms: 24.142504
+  type: 'test'
+  ...
+# Subtest: REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
+ok 4 - REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
+  ---
+  duration_ms: 20.191503
+  type: 'test'
+  ...
+# Subtest: REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
+ok 5 - REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
+  ---
+  duration_ms: 22.772926
+  type: 'test'
+  ...
+# Subtest: REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
+ok 6 - REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
+  ---
+  duration_ms: 29.561496
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 220.181783

agents/magica/work/queue-285/gate/bus/broker.test.mjs.log

@@ -0,0 +1,106 @@
+TAP version 13
+# Subtest: launch identity is stamped, payload identity is refused and stale holder cannot send
+ok 1 - launch identity is stamped, payload identity is refused and stale holder cannot send
+  ---
+  duration_ms: 23.464381
+  type: 'test'
+  ...
+# Subtest: decision classes route from policy; gated resolution is human-only, choice and target must match
+ok 2 - decision classes route from policy; gated resolution is human-only, choice and target must match
+  ---
+  duration_ms: 23.610753
+  type: 'test'
+  ...
+# Subtest: claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
+ok 3 - claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
+  ---
+  duration_ms: 24.082258
+  type: 'test'
+  ...
+# Subtest: launch events require a human CLI capability; generic emit cannot forge authority events
+ok 4 - launch events require a human CLI capability; generic emit cannot forge authority events
+  ---
+  duration_ms: 15.235739
+  type: 'test'
+  ...
+# Subtest: within-role decisions close atomically and invalid options or blocking omissions refuse
+ok 5 - within-role decisions close atomically and invalid options or blocking omissions refuse
+  ---
+  duration_ms: 15.402932
+  type: 'test'
+  ...
+# Subtest: a recommendation that is not exactly one option key refuses invalid-recommendation after the options
+ok 6 - a recommendation that is not exactly one option key refuses invalid-recommendation after the options
+  ---
+  duration_ms: 24.02956
+  type: 'test'
+  ...
+# Subtest: observer capabilities read human inbox but cannot mutate or forge launch identity
+ok 7 - observer capabilities read human inbox but cannot mutate or forge launch identity
+  ---
+  duration_ms: 14.88234
+  type: 'test'
+  ...
+# Subtest: task action subjects and linked decision trail are complete and ordered
+ok 8 - task action subjects and linked decision trail are complete and ordered
+  ---
+  duration_ms: 21.87516
+  type: 'test'
+  ...
+# Subtest: launch binding is durable and reconnecting requires the identical trusted record
+ok 9 - launch binding is durable and reconnecting requires the identical trusted record
+  ---
+  duration_ms: 11.288413
+  type: 'test'
+  ...
+# Subtest: business isolation includes inherited object names and cross-business message references
+ok 10 - business isolation includes inherited object names and cross-business message references
+  ---
+  duration_ms: 18.569538
+  type: 'test'
+  ...
+# Subtest: authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
+ok 11 - authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
+  ---
+  duration_ms: 25.257868
+  type: 'test'
+  ...
+# Subtest: task projection uses schema current view, skipping earlier and equal-start polls
+ok 12 - task projection uses schema current view, skipping earlier and equal-start polls
+  ---
+  duration_ms: 13.819347
+  type: 'test'
+  ...
+# Subtest: revocation permanently bars the old run from reclaiming first, including after broker restart
+ok 13 - revocation permanently bars the old run from reclaiming first, including after broker restart
+  ---
+  duration_ms: 19.708118
+  type: 'test'
+  ...
+# Subtest: empty message references refuse before storage; refusal-evidence failure stays a typed error
+ok 14 - empty message references refuse before storage; refusal-evidence failure stays a typed error
+  ---
+  duration_ms: 14.074236
+  type: 'test'
+  ...
+# Subtest: both arbiters require human resolution when their cross-role route is themselves
+ok 15 - both arbiters require human resolution when their cross-role route is themselves
+  ---
+  duration_ms: 21.790465
+  type: 'test'
+  ...
+# Subtest: the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
+ok 16 - the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
+  ---
+  duration_ms: 21.104151
+  type: 'test'
+  ...
+1..16
+# tests 16
+# suites 0
+# pass 16
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 393.064499

agents/magica/work/queue-285/gate/bus/business.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
+ok 1 - S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
+  ---
+  duration_ms: 1.244776
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 53.912851

agents/magica/work/queue-285/gate/bus/channel-proof.test.mjs.log

@@ -0,0 +1,22 @@
+TAP version 13
+# Subtest: channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
+ok 1 - channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
+  ---
+  duration_ms: 0.81546
+  type: 'test'
+  ...
+# Subtest: channel recovery still requires the same shim path and rejects an absent or forged proof
+ok 2 - channel recovery still requires the same shim path and rejects an absent or forged proof
+  ---
+  duration_ms: 364.837355
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 461.413513

agents/magica/work/queue-285/gate/bus/chief-of-staff.test.mjs.log

@@ -0,0 +1,271 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
+ok 1 - REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
+  ---
+  duration_ms: 32.365947
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
+ok 2 - REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
+  ---
+  duration_ms: 29.293804
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
+ok 3 - REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
+  ---
+  duration_ms: 22.737912
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
+ok 4 - REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
+  ---
+  duration_ms: 22.512309
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
+ok 5 - REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
+  ---
+  duration_ms: 25.131069
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
+ok 6 - REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
+  ---
+  duration_ms: 26.203055
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
+ok 7 - REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
+  ---
+  duration_ms: 27.940645
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
+ok 8 - REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
+  ---
+  duration_ms: 20.825985
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
+ok 9 - REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
+  ---
+  duration_ms: 26.695586
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
+ok 10 - REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
+  ---
+  duration_ms: 28.257
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
+ok 11 - REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
+  ---
+  duration_ms: 33.750075
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
+ok 12 - REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
+  ---
+  duration_ms: 25.22416
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
+ok 13 - REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
+  ---
+  duration_ms: 27.765739
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
+ok 14 - REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
+  ---
+  duration_ms: 85.366594
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
+ok 15 - REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
+  ---
+  duration_ms: 72.298444
+  type: 'test'
+  ...
+# Subtest: Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
+ok 16 - Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
+  ---
+  duration_ms: 75.387333
+  type: 'test'
+  ...
+# Subtest: row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
+ok 17 - row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
+  ---
+  duration_ms: 56.118435
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
+ok 18 - REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
+  ---
+  duration_ms: 71.976768
+  type: 'test'
+  ...
+# Subtest: row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
+ok 19 - row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
+  ---
+  duration_ms: 20.972885
+  type: 'test'
+  ...
+# Subtest: row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
+ok 20 - row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
+  ---
+  duration_ms: 22.072714
+  type: 'test'
+  ...
+# Subtest: row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
+ok 21 - row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
+  ---
+  duration_ms: 22.589401
+  type: 'test'
+  ...
+# Subtest: row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
+ok 22 - row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
+  ---
+  duration_ms: 25.565738
+  type: 'test'
+  ...
+# Subtest: row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
+ok 23 - row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
+  ---
+  duration_ms: 24.557985
+  type: 'test'
+  ...
+# Subtest: row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
+ok 24 - row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
+  ---
+  duration_ms: 20.204671
+  type: 'test'
+  ...
+# Subtest: row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
+ok 25 - row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
+  ---
+  duration_ms: 18.369659
+  type: 'test'
+  ...
+# Subtest: row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
+ok 26 - row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
+  ---
+  duration_ms: 29.924403
+  type: 'test'
+  ...
+# Subtest: row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
+ok 27 - row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
+  ---
+  duration_ms: 26.990661
+  type: 'test'
+  ...
+# Subtest: row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
+ok 28 - row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
+  ---
+  duration_ms: 43.256375
+  type: 'test'
+  ...
+# Subtest: row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
+ok 29 - row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
+  ---
+  duration_ms: 24.900921
+  type: 'test'
+  ...
+# Subtest: row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
+ok 30 - row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
+  ---
+  duration_ms: 727.24594
+  type: 'test'
+  ...
+# Subtest: row 194 T8b: a hire without the role files configured refuses not-configured
+ok 31 - row 194 T8b: a hire without the role files configured refuses not-configured
+  ---
+  duration_ms: 20.021601
+  type: 'test'
+  ...
+# Subtest: row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
+ok 32 - row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
+  ---
+  duration_ms: 26.010883
+  type: 'test'
+  ...
+# Subtest: row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
+ok 33 - row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
+  ---
+  duration_ms: 25.678267
+  type: 'test'
+  ...
+# Subtest: row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
+ok 34 - row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
+  ---
+  duration_ms: 22.699001
+  type: 'test'
+  ...
+# Subtest: row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
+ok 35 - row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
+  ---
+  duration_ms: 24.331575
+  type: 'test'
+  ...
+# Subtest: row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
+ok 36 - row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
+  ---
+  duration_ms: 26.607146
+  type: 'test'
+  ...
+# Subtest: row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
+ok 37 - row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
+  ---
+  duration_ms: 23.386743
+  type: 'test'
+  ...
+# Subtest: row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
+ok 38 - row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
+  ---
+  duration_ms: 21.68831
+  type: 'test'
+  ...
+# Subtest: row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
+ok 39 - row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
+  ---
+  duration_ms: 21.118953
+  type: 'test'
+  ...
+# Subtest: row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
+ok 40 - row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
+  ---
+  duration_ms: 28.682139
+  type: 'test'
+  ...
+# Subtest: row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
+ok 41 - row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
+  ---
+  duration_ms: 72.426182
+  type: 'test'
+  ...
+# Subtest: row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
+ok 42 - row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
+  ---
+  duration_ms: 25.98699
+  type: 'test'
+  ...
+1..42
+# tests 42
+# suites 0
+# pass 42
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 2185.248238

agents/magica/work/queue-285/gate/bus/comment-cursors.test.mjs.log

@@ -0,0 +1,22 @@
+TAP version 13
+# Subtest: comment cursors isolate businesses, move only forward and remain append-only
+ok 1 - comment cursors isolate businesses, move only forward and remain append-only
+  ---
+  duration_ms: 31.616209
+  type: 'test'
+  ...
+# Subtest: only trusted sync writes validated cursors; events and cursor share rollback
+ok 2 - only trusted sync writes validated cursors; events and cursor share rollback
+  ---
+  duration_ms: 11.454417
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 122.444165

agents/magica/work/queue-285/gate/bus/comment-migration.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
+ok 1 - explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
+  ---
+  duration_ms: 68.302978
+  type: 'test'
+  ...
+# Subtest: migration refuses active writers and drifted legacy schemas, with no partial upgrade
+ok 2 - migration refuses active writers and drifted legacy schemas, with no partial upgrade
+  ---
+  duration_ms: 87.993331
+  type: 'test'
+  ...
+# Subtest: named migration registry chains 3b through 3g to a fixture-only future version in order
+ok 3 - named migration registry chains 3b through 3g to a fixture-only future version in order
+  ---
+  duration_ms: 83.420299
+  type: 'test'
+  ...
+# Subtest: migration refuses mismatched source metadata without changing schema or evidence
+ok 4 - migration refuses mismatched source metadata without changing schema or evidence
+  ---
+  duration_ms: 31.223627
+  type: 'test'
+  ...
+# Subtest: offline command migrates only the supplied fixture root and reports usage errors
+ok 5 - offline command migrates only the supplied fixture root and reports usage errors
+  ---
+  duration_ms: 171.783675
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 515.777793

agents/magica/work/queue-285/gate/bus/console-decide.test.mjs.log

@@ -0,0 +1,82 @@
+TAP version 13
+# Subtest: N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one
+ok 1 - N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one
+  ---
+  duration_ms: 1.226413
+  type: 'test'
+  ...
+# Subtest: bindConsole takes only the business human and a three-string owner subject
+ok 2 - bindConsole takes only the business human and a three-string owner subject
+  ---
+  duration_ms: 38.054856
+  type: 'test'
+  ...
+# Subtest: J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else
+ok 3 - J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else
+  ---
+  duration_ms: 40.390974
+  type: 'test'
+  ...
+# Subtest: preview: the two real answers, a grant summary and the digest, for an open grant request only
+ok 4 - preview: the two real answers, a grant summary and the digest, for an open grant request only
+  ---
+  duration_ms: 29.326401
+  type: 'test'
+  ...
+# Subtest: J1, J2: a decision that is not an eligible grant request refuses both console verbs
+ok 5 - J1, J2: a decision that is not an eligible grant request refuses both console verbs
+  ---
+  duration_ms: 33.699567
+  type: 'test'
+  ...
+# Subtest: N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once
+ok 6 - N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once
+  ---
+  duration_ms: 101.893948
+  type: 'test'
+  ...
+# Subtest: J15: a Console deny closes with the other key and starts nothing
+ok 7 - J15: a Console deny closes with the other key and starts nothing
+  ---
+  duration_ms: 137.287624
+  type: 'test'
+  ...
+# Subtest: J2: approve and deny come from approvalChoice and the options, not a fixed yes and no
+ok 8 - J2: approve and deny come from approvalChoice and the options, not a fixed yes and no
+  ---
+  duration_ms: 216.963508
+  type: 'test'
+  ...
+# Subtest: J11: a stale digest or a key outside the two refuses decision-stale and writes nothing
+ok 9 - J11: a stale digest or a key outside the two refuses decision-stale and writes nothing
+  ---
+  duration_ms: 96.590479
+  type: 'test'
+  ...
+# Subtest: J14: a via console close with no matching human.input approves nothing
+ok 10 - J14: a via console close with no matching human.input approves nothing
+  ---
+  duration_ms: 127.724952
+  type: 'test'
+  ...
+# Subtest: recordEvent keeps human.input reserved, so no agent forges a console answer
+ok 11 - recordEvent keeps human.input reserved, so no agent forges a console answer
+  ---
+  duration_ms: 67.510451
+  type: 'test'
+  ...
+# Subtest: J7: a console proof over the socket binds a cap for its one call and the reply releases it
+ok 12 - J7: a console proof over the socket binds a cap for its one call and the reply releases it
+  ---
+  duration_ms: 134.563522
+  type: 'test'
+  ...
+1..12
+# tests 12
+# suites 0
+# pass 12
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1108.142847

agents/magica/work/queue-285/gate/bus/creative.test.mjs.log

@@ -0,0 +1,36 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
+ok 1 - M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
+  ---
+  duration_ms: 46.582838
+  type: 'test'
+  ...
+# Subtest: a creative instance sends only to the user and hears only from the user
+ok 2 - a creative instance sends only to the user and hears only from the user
+  ---
+  duration_ms: 41.398175
+  type: 'test'
+  ...
+# Subtest: M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
+ok 3 - M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
+  ---
+  duration_ms: 75.936029
+  type: 'test'
+  ...
+# Subtest: row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
+ok 4 - row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
+  ---
+  duration_ms: 65.593668
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 336.170763

agents/magica/work/queue-285/gate/bus/credential-claim.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: X4: register adds a store reference to the running bus, and issue then writes the key
+ok 1 - X4: register adds a store reference to the running bus, and issue then writes the key
+  ---
+  duration_ms: 12.733334
+  type: 'test'
+  ...
+# Subtest: X4: register runs the constructor's reference checks
+ok 2 - X4: register runs the constructor's reference checks
+  ---
+  duration_ms: 0.634437
+  type: 'test'
+  ...
+# Subtest: X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
+ok 3 - X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
+  ---
+  duration_ms: 7.923231
+  type: 'test'
+  ...
+# Subtest: X3, X4: unregister drops an entry with no token and refuses one with a live token
+ok 4 - X3, X4: unregister drops an entry with no token and refuses one with a live token
+  ---
+  duration_ms: 7.631188
+  type: 'test'
+  ...
+# Subtest: X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
+ok 5 - X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
+  ---
+  duration_ms: 4.620921
+  type: 'test'
+  ...
+# Subtest: X5: a claim made while a host.run is in flight refuses host-busy
+ok 6 - X5: a claim made while a host.run is in flight refuses host-busy
+  ---
+  duration_ms: 4.517207
+  type: 'test'
+  ...
+# Subtest: X5: a stale release leaves a later claim in place
+ok 7 - X5: a stale release leaves a later claim in place
+  ---
+  duration_ms: 0.404873
+  type: 'test'
+  ...
+# Subtest: X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
+ok 8 - X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
+  ---
+  duration_ms: 4.515245
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 96.657011

agents/magica/work/queue-285/gate/bus/credential-status.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: credentials gives human and reader sessions service, account, role, date and state, and nothing else
+ok 1 - credentials gives human and reader sessions service, account, role, date and state, and nothing else
+  ---
+  duration_ms: 25.773164
+  type: 'test'
+  ...
+# Subtest: credentials refuses a role session and any argument
+ok 2 - credentials refuses a role session and any argument
+  ---
+  duration_ms: 15.55684
+  type: 'test'
+  ...
+# Subtest: credentials reads the status on each request, and a broker without one lists none
+ok 3 - credentials reads the status on each request, and a broker without one lists none
+  ---
+  duration_ms: 20.068395
+  type: 'test'
+  ...
+# Subtest: the broker process answers credentials without a token, path or variable in its output, log or store
+ok 4 - the broker process answers credentials without a token, path or variable in its output, log or store
+  ---
+  duration_ms: 147.252349
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 285.765836

agents/magica/work/queue-285/gate/bus/credential-store.test.mjs.log

@@ -0,0 +1,82 @@
+TAP version 13
+# Subtest: T1: a store reference with no file yet starts, and the agent is not-issued until issue
+ok 1 - T1: a store reference with no file yet starts, and the agent is not-issued until issue
+  ---
+  duration_ms: 4.550369
+  type: 'test'
+  ...
+# Subtest: T1: a store path the reference does not own, or no store root, refuses the reference
+ok 2 - T1: a store path the reference does not own, or no store root, refuses the reference
+  ---
+  duration_ms: 0.513372
+  type: 'test'
+  ...
+# Subtest: T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
+ok 3 - T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
+  ---
+  duration_ms: 1.961044
+  type: 'test'
+  ...
+# Subtest: T1: a missing store root refuses start; a missing {file} reference still refuses start
+ok 4 - T1: a missing store root refuses start; a missing {file} reference still refuses start
+  ---
+  duration_ms: 0.527569
+  type: 'test'
+  ...
+# Subtest: T1: a store file that is a directory or a symlink refuses start
+ok 5 - T1: a store file that is a directory or a symlink refuses start
+  ---
+  duration_ms: 0.735641
+  type: 'test'
+  ...
+# Subtest: T2: useFor keys from the session only
+ok 6 - T2: useFor keys from the session only
+  ---
+  duration_ms: 1.589245
+  type: 'test'
+  ...
+# Subtest: T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
+ok 7 - T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
+  ---
+  duration_ms: 3.38055
+  type: 'test'
+  ...
+# Subtest: T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
+ok 8 - T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
+  ---
+  duration_ms: 1.426566
+  type: 'test'
+  ...
+# Subtest: T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
+ok 9 - T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
+  ---
+  duration_ms: 1.406987
+  type: 'test'
+  ...
+# Subtest: T5: revoke of a {file} reference forgets the token and never unlinks the file
+ok 10 - T5: revoke of a {file} reference forgets the token and never unlinks the file
+  ---
+  duration_ms: 0.500836
+  type: 'test'
+  ...
+# Subtest: T5: delete refuses an agent dir holding anything but tokens
+ok 11 - T5: delete refuses an agent dir holding anything but tokens
+  ---
+  duration_ms: 1.394648
+  type: 'test'
+  ...
+# Subtest: D5: every credentials use( call site is on the allowlist
+ok 12 - D5: every credentials use( call site is on the allowlist
+  ---
+  duration_ms: 29.743201
+  type: 'test'
+  ...
+1..12
+# tests 12
+# suites 0
+# pass 12
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 102.485385

agents/magica/work/queue-285/gate/bus/credential-verbs.test.mjs.log

@@ -0,0 +1,22 @@
+TAP version 13
+# Subtest: row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
+ok 1 - row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
+  ---
+  duration_ms: 47.008468
+  type: 'test'
+  ...
+# Subtest: T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
+ok 2 - T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
+  ---
+  duration_ms: 91.104329
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 251.679699

agents/magica/work/queue-285/gate/bus/credentials.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: only validated broker references load; returned data and exceptions cannot expose a known token
+ok 1 - only validated broker references load; returned data and exceptions cannot expose a known token
+  ---
+  duration_ms: 2.603082
+  type: 'test'
+  ...
+# Subtest: bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
+ok 2 - bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
+  ---
+  duration_ms: 1.455167
+  type: 'test'
+  ...
+# Subtest: expiry refuses use and env references never become client data
+ok 3 - expiry refuses use and env references never become client data
+  ---
+  duration_ms: 0.469711
+  type: 'test'
+  ...
+# Subtest: S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
+ok 4 - S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
+  ---
+  duration_ms: 1.098781
+  type: 'test'
+  ...
+# Subtest: opaque tokens shorter than 16 characters refuse before use
+ok 5 - opaque tokens shorter than 16 characters refuse before use
+  ---
+  duration_ms: 0.270185
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 64.643476

agents/magica/work/queue-285/gate/bus/csuite-messaging.test.mjs.log

@@ -0,0 +1,106 @@
+TAP version 13
+# Subtest: each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
+ok 1 - each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
+  ---
+  duration_ms: 1.312352
+  type: 'test'
+  ...
+# Subtest: chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
+ok 2 - chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
+  ---
+  duration_ms: 54.864743
+  type: 'test'
+  ...
+# Subtest: chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+ok 3 - chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+  ---
+  duration_ms: 39.426586
+  type: 'test'
+  ...
+# Subtest: chief-executive-officer: another C-suite role isn't on the lists either
+ok 4 - chief-executive-officer: another C-suite role isn't on the lists either
+  ---
+  duration_ms: 32.872239
+  type: 'test'
+  ...
+# Subtest: chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
+ok 5 - chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
+  ---
+  duration_ms: 39.87281
+  type: 'test'
+  ...
+# Subtest: chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+ok 6 - chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+  ---
+  duration_ms: 37.285713
+  type: 'test'
+  ...
+# Subtest: chief-financial-officer: another C-suite role isn't on the lists either
+ok 7 - chief-financial-officer: another C-suite role isn't on the lists either
+  ---
+  duration_ms: 29.64681
+  type: 'test'
+  ...
+# Subtest: chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
+ok 8 - chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
+  ---
+  duration_ms: 37.244398
+  type: 'test'
+  ...
+# Subtest: chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+ok 9 - chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+  ---
+  duration_ms: 37.01834
+  type: 'test'
+  ...
+# Subtest: chief-information-officer: another C-suite role isn't on the lists either
+ok 10 - chief-information-officer: another C-suite role isn't on the lists either
+  ---
+  duration_ms: 29.933447
+  type: 'test'
+  ...
+# Subtest: chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
+ok 11 - chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
+  ---
+  duration_ms: 38.734733
+  type: 'test'
+  ...
+# Subtest: chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+ok 12 - chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+  ---
+  duration_ms: 38.084336
+  type: 'test'
+  ...
+# Subtest: chief-information-security-officer: another C-suite role isn't on the lists either
+ok 13 - chief-information-security-officer: another C-suite role isn't on the lists either
+  ---
+  duration_ms: 33.331877
+  type: 'test'
+  ...
+# Subtest: chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
+ok 14 - chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
+  ---
+  duration_ms: 38.619317
+  type: 'test'
+  ...
+# Subtest: chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+ok 15 - chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
+  ---
+  duration_ms: 36.99243
+  type: 'test'
+  ...
+# Subtest: chief-marketing-officer: another C-suite role isn't on the lists either
+ok 16 - chief-marketing-officer: another C-suite role isn't on the lists either
+  ---
+  duration_ms: 31.908678
+  type: 'test'
+  ...
+1..16
+# tests 16
+# suites 0
+# pass 16
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 640.907986

agents/magica/work/queue-285/gate/bus/daily-quota-runtime.test.mjs.log

@@ -0,0 +1,38 @@
+TAP version 13
+# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
+# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"783f9fb9-cb01-4614-a9e5-4e58de0edc47","source":"@none","code":"baseline-unknown"}
+# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
+# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"054da5e0-bddc-42f8-8ff1-9163a693f5de","source":"@none","code":"baseline-unknown"}
+# Subtest: REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
+ok 1 - REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
+  ---
+  duration_ms: 130.635393
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
+ok 2 - REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
+  ---
+  duration_ms: 55.467888
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
+ok 3 - REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
+  ---
+  duration_ms: 49.392456
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
+ok 4 - REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
+  ---
+  duration_ms: 14.081215
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 329.792565

agents/magica/work/queue-285/gate/bus/decision-close.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: a human resolve sends the raising role one message from the human, and its request is the answer
+ok 1 - a human resolve sends the raising role one message from the human, and its request is the answer
+  ---
+  duration_ms: 41.952568
+  type: 'test'
+  ...
+# Subtest: a cross-role decision resolved by its arbiter comes from that role and run, with no request
+ok 2 - a cross-role decision resolved by its arbiter comes from that role and run, with no request
+  ---
+  duration_ms: 20.366527
+  type: 'test'
+  ...
+# Subtest: a human withdraw sends one message with the note
+ok 3 - a human withdraw sends one message with the note
+  ---
+  duration_ms: 19.568305
+  type: 'test'
+  ...
+# Subtest: a human seen before the close leaves the request on the close's answer, not the seen
+ok 4 - a human seen before the close leaves the request on the close's answer, not the seen
+  ---
+  duration_ms: 23.902003
+  type: 'test'
+  ...
+# Subtest: the raising run's withdraw, a supersede, a within-role raise and seen send nothing
+ok 5 - the raising run's withdraw, a supersede, a within-role raise and seen send nothing
+  ---
+  duration_ms: 23.922097
+  type: 'test'
+  ...
+# Subtest: refused closes send nothing: invalid-choice, decision-closed, not-resolver
+ok 6 - refused closes send nothing: invalid-choice, decision-closed, not-resolver
+  ---
+  duration_ms: 24.900287
+  type: 'test'
+  ...
+# Subtest: a raising role nobody holds at the close gets the message on the next claim
+ok 7 - a raising role nobody holds at the close gets the message on the next claim
+  ---
+  duration_ms: 21.59873
+  type: 'test'
+  ...
+# Subtest: a human DECISION send keeps its own instruction as the request, not a close's answer
+ok 8 - a human DECISION send keeps its own instruction as the request, not a close's answer
+  ---
+  duration_ms: 20.57458
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 269.975152

agents/magica/work/queue-285/gate/bus/decision-route.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
+ok 1 - a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
+  ---
+  duration_ms: 32.482629
+  type: 'test'
+  ...
+# Subtest: a gated raise by a role that does not hear from the human is refused and stores nothing
+ok 2 - a gated raise by a role that does not hear from the human is refused and stores nothing
+  ---
+  duration_ms: 25.371753
+  type: 'test'
+  ...
+# Subtest: a route the raiser hears from is allowed, checked from the route to the raiser
+ok 3 - a route the raiser hears from is allowed, checked from the route to the raiser
+  ---
+  duration_ms: 29.243181
+  type: 'test'
+  ...
+# Subtest: a refused supersede withdraws nothing
+ok 4 - a refused supersede withdraws nothing
+  ---
+  duration_ms: 24.305093
+  type: 'test'
+  ...
+# Subtest: the assistant's within-role and gated raises still work
+ok 5 - the assistant's within-role and gated raises still work
+  ---
+  duration_ms: 25.782782
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 211.213541

agents/magica/work/queue-285/gate/bus/decisions.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: roles lists open decisions routed to a role, and never the human inbox
+ok 1 - roles lists open decisions routed to a role, and never the human inbox
+  ---
+  duration_ms: 35.070302
+  type: 'test'
+  ...
+# Subtest: recent lists closed decisions of every route, newest close first, with how each closed
+ok 2 - recent lists closed decisions of every route, newest close first, with how each closed
+  ---
+  duration_ms: 27.765623
+  type: 'test'
+  ...
+# Subtest: recent gives the closing event as closed when the decision was seen first
+ok 3 - recent gives the closing event as closed when the decision was seen first
+  ---
+  duration_ms: 26.27781
+  type: 'test'
+  ...
+# Subtest: recent stops at RECENT rows
+ok 4 - recent stops at RECENT rows
+  ---
+  duration_ms: 78.134842
+  type: 'test'
+  ...
+# Subtest: every row is what trail already gives the same session for that id
+ok 5 - every row is what trail already gives the same session for that id
+  ---
+  duration_ms: 35.718697
+  type: 'test'
+  ...
+# Subtest: a role session can't list decisions, so it can't read another role's open decisions
+ok 6 - a role session can't list decisions, so it can't read another role's open decisions
+  ---
+  duration_ms: 36.183484
+  type: 'test'
+  ...
+# Subtest: decisions is a read: one business, strict arguments, nothing written
+ok 7 - decisions is a read: one business, strict arguments, nothing written
+  ---
+  duration_ms: 39.756474
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 356.946622

agents/magica/work/queue-285/gate/bus/end-launch.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: endLaunch writes session.ended, releases the run claim and kills its capabilities
+ok 1 - endLaunch writes session.ended, releases the run claim and kills its capabilities
+  ---
+  duration_ms: 28.833722
+  type: 'test'
+  ...
+# Subtest: endLaunch refuses an unknown run, a second end and a rebind of the ended run
+ok 2 - endLaunch refuses an unknown run, a second end and a rebind of the ended run
+  ---
+  duration_ms: 14.013821
+  type: 'test'
+  ...
+# Subtest: a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
+ok 3 - a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
+  ---
+  duration_ms: 14.00076
+  type: 'test'
+  ...
+# Subtest: endLaunch leaves a claim another run took alone
+ok 4 - endLaunch leaves a claim another run took alone
+  ---
+  duration_ms: 15.011188
+  type: 'test'
+  ...
+# Subtest: refuse records action.refused against the caller with the code only
+ok 5 - refuse records action.refused against the caller with the code only
+  ---
+  duration_ms: 11.575429
+  type: 'test'
+  ...
+# Subtest: launches off refuses role.launch with launch-revoked until launches on
+ok 6 - launches off refuses role.launch with launch-revoked until launches on
+  ---
+  duration_ms: 16.820239
+  type: 'test'
+  ...
+# Subtest: broker process: launch ops authorize role.launch, record refusals and end runs
+ok 7 - broker process: launch ops authorize role.launch, record refusals and end runs
+  ---
+  duration_ms: 158.400836
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 335.496597

agents/magica/work/queue-285/gate/bus/fire-revokes-grants.test.mjs.log

@@ -0,0 +1,154 @@
+TAP version 13
+# Subtest: row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
+ok 1 - row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
+  ---
+  duration_ms: 236.650762
+  type: 'test'
+  ...
+# Subtest: row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
+ok 2 - row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
+  ---
+  duration_ms: 211.933934
+  type: 'test'
+  ...
+# Subtest: row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
+ok 3 - row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
+  ---
+  duration_ms: 200.544987
+  type: 'test'
+  ...
+# Subtest: row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
+ok 4 - row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
+  ---
+  duration_ms: 200.69229
+  type: 'test'
+  ...
+# Subtest: row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
+ok 5 - row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
+  ---
+  duration_ms: 54.366426
+  type: 'test'
+  ...
+# Subtest: row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
+ok 6 - row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
+  ---
+  duration_ms: 190.143795
+  type: 'test'
+  ...
+# Subtest: row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
+ok 7 - row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
+  ---
+  duration_ms: 85.215699
+  type: 'test'
+  ...
+# Subtest: row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
+ok 8 - row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
+  ---
+  duration_ms: 86.635331
+  type: 'test'
+  ...
+# Subtest: row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
+ok 9 - row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
+  ---
+  duration_ms: 120.538599
+  type: 'test'
+  ...
+# Subtest: row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
+ok 10 - row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
+  ---
+  duration_ms: 285.663654
+  type: 'test'
+  ...
+# Subtest: row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
+ok 11 - row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
+  ---
+  duration_ms: 63.174476
+  type: 'test'
+  ...
+# Subtest: row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
+ok 12 - row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
+  ---
+  duration_ms: 74.58714
+  type: 'test'
+  ...
+# Subtest: row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
+ok 13 - row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
+  ---
+  duration_ms: 229.811152
+  type: 'test'
+  ...
+# Subtest: row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
+ok 14 - row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
+  ---
+  duration_ms: 94.297023
+  type: 'test'
+  ...
+# Subtest: row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
+ok 15 - row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
+  ---
+  duration_ms: 106.365092
+  type: 'test'
+  ...
+# Subtest: row 281 T7: an instance with no grant fires as today, synchronously, with the same events
+ok 16 - row 281 T7: an instance with no grant fires as today, synchronously, with the same events
+  ---
+  duration_ms: 56.418823
+  type: 'test'
+  ...
+# Subtest: row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
+ok 17 - row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
+  ---
+  duration_ms: 216.946442
+  type: 'test'
+  ...
+# Subtest: row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
+ok 18 - row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
+  ---
+  duration_ms: 201.674741
+  type: 'test'
+  ...
+# Subtest: row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
+ok 19 - row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
+  ---
+  duration_ms: 86.697927
+  type: 'test'
+  ...
+# Subtest: row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
+ok 20 - row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
+  ---
+  duration_ms: 79.607017
+  type: 'test'
+  ...
+# Subtest: row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
+ok 21 - row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
+  ---
+  duration_ms: 144.340484
+  type: 'test'
+  ...
+# Subtest: row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
+ok 22 - row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
+  ---
+  duration_ms: 63.576923
+  type: 'test'
+  ...
+# Subtest: row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete
+ok 23 - row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete
+  ---
+  duration_ms: 91.735696
+  type: 'test'
+  ...
+# Subtest: row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens
+ok 24 - row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens
+  ---
+  duration_ms: 76.921326
+  type: 'test'
+  ...
+1..24
+# tests 24
+# suites 0
+# pass 24
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 3342.462062

agents/magica/work/queue-285/gate/bus/gitea-grant-docker.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
+ok 1 - X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
+  ---
+  duration_ms: 11756.822035
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 11850.569796

agents/magica/work/queue-285/gate/bus/gitea-grant.test.mjs.log

@@ -0,0 +1,310 @@
+TAP version 13
+# Subtest: versionAtLeast compares numbers and refuses a prerelease of 1.27.0
+ok 1 - versionAtLeast compares numbers and refuses a prerelease of 1.27.0
+  ---
+  duration_ms: 1.138824
+  type: 'test'
+  ...
+# Subtest: X-G1: a raise that fails a check refuses and stores nothing
+ok 2 - X-G1: a raise that fails a check refuses and stores nothing
+  ---
+  duration_ms: 64.60238
+  type: 'test'
+  ...
+# Subtest: X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
+ok 3 - X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
+  ---
+  duration_ms: 187.669422
+  type: 'test'
+  ...
+# Subtest: X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare
+ok 4 - X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare
+  ---
+  duration_ms: 37.31195
+  type: 'test'
+  ...
+# Subtest: X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
+ok 5 - X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
+  ---
+  duration_ms: 145.197815
+  type: 'test'
+  ...
+# Subtest: X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
+ok 6 - X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
+  ---
+  duration_ms: 107.156803
+  type: 'test'
+  ...
+# Subtest: X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
+ok 7 - X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
+  ---
+  duration_ms: 303.577062
+  type: 'test'
+  ...
+# Subtest: X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
+ok 8 - X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
+  ---
+  duration_ms: 104.549894
+  type: 'test'
+  ...
+# Subtest: X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
+ok 9 - X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
+  ---
+  duration_ms: 107.3476
+  type: 'test'
+  ...
+# Subtest: X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
+ok 10 - X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
+  ---
+  duration_ms: 150.873888
+  type: 'test'
+  ...
+# Subtest: X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
+ok 11 - X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
+  ---
+  duration_ms: 129.838625
+  type: 'test'
+  ...
+# Subtest: X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
+ok 12 - X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
+  ---
+  duration_ms: 150.039926
+  type: 'test'
+  ...
+# Subtest: X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
+ok 13 - X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
+  ---
+  duration_ms: 66.986764
+  type: 'test'
+  ...
+# Subtest: X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
+ok 14 - X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
+  ---
+  duration_ms: 171.079767
+  type: 'test'
+  ...
+# Subtest: X-G10: in a rotation the store file holds the new token before the old one is deleted
+ok 15 - X-G10: in a rotation the store file holds the new token before the old one is deleted
+  ---
+  duration_ms: 151.907468
+  type: 'test'
+  ...
+# Subtest: X-G6: a rotation cut before the rename settles back at once, and the old token stays live
+ok 16 - X-G6: a rotation cut before the rename settles back at once, and the old token stays live
+  ---
+  duration_ms: 170.945576
+  type: 'test'
+  ...
+# Subtest: X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
+ok 17 - X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
+  ---
+  duration_ms: 185.793441
+  type: 'test'
+  ...
+# Subtest: X-G6: a restart settles an open rotation back when the file still holds the old token
+ok 18 - X-G6: a restart settles an open rotation back when the file still holds the old token
+  ---
+  duration_ms: 144.014313
+  type: 'test'
+  ...
+# Subtest: X-G6: a restart settles an open rotation forward when the file holds the new token
+ok 19 - X-G6: a restart settles an open rotation forward when the file holds the new token
+  ---
+  duration_ms: 142.474084
+  type: 'test'
+  ...
+# Subtest: X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
+ok 20 - X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
+  ---
+  duration_ms: 147.865261
+  type: 'test'
+  ...
+# Subtest: X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
+ok 21 - X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
+  ---
+  duration_ms: 1065.533954
+  type: 'test'
+  ...
+# Subtest: X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
+ok 22 - X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
+  ---
+  duration_ms: 162.773787
+  type: 'test'
+  ...
+# Subtest: N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
+ok 23 - N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
+  ---
+  duration_ms: 151.739195
+  type: 'test'
+  ...
+# Subtest: N9: a 404 on a delete by id counts as done
+ok 24 - N9: a 404 on a delete by id counts as done
+  ---
+  duration_ms: 142.331753
+  type: 'test'
+  ...
+# Subtest: X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
+ok 25 - X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
+  ---
+  duration_ms: 463.720696
+  type: 'test'
+  ...
+# Subtest: X-G6: a restart with no admin slot leaves the user an orphan and the token left
+ok 26 - X-G6: a restart with no admin slot leaves the user an orphan and the token left
+  ---
+  duration_ms: 61.403183
+  type: 'test'
+  ...
+# Subtest: X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
+ok 27 - X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
+  ---
+  duration_ms: 126.180326
+  type: 'test'
+  ...
+# Subtest: X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
+ok 28 - X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
+  ---
+  duration_ms: 123.820498
+  type: 'test'
+  ...
+# Subtest: X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
+ok 29 - X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
+  ---
+  duration_ms: 70.36785
+  type: 'test'
+  ...
+# Subtest: X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
+ok 30 - X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
+  ---
+  duration_ms: 56.25775
+  type: 'test'
+  ...
+# Subtest: X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
+ok 31 - X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
+  ---
+  duration_ms: 117.792307
+  type: 'test'
+  ...
+# Subtest: kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
+ok 32 - kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
+  ---
+  duration_ms: 105.999534
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke while the executor runs aborts it and the grant ends revoked
+ok 33 - X-G11: a revoke while the executor runs aborts it and the grant ends revoked
+  ---
+  duration_ms: 107.177993
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke unloads memory and removes the file before its Gitea delete
+ok 34 - X-G11: a revoke unloads memory and removes the file before its Gitea delete
+  ---
+  duration_ms: 131.914846
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
+ok 35 - X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
+  ---
+  duration_ms: 179.665576
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
+ok 36 - X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
+  ---
+  duration_ms: 316.396176
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
+ok 37 - X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
+  ---
+  duration_ms: 180.890524
+  type: 'test'
+  ...
+# Subtest: X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
+ok 38 - X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
+  ---
+  duration_ms: 188.8265
+  type: 'test'
+  ...
+# Subtest: X-G12: a token that reaches wider than its forks fails with the repository named
+ok 39 - X-G12: a token that reaches wider than its forks fails with the repository named
+  ---
+  duration_ms: 430.78295
+  type: 'test'
+  ...
+# Subtest: X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
+ok 40 - X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
+  ---
+  duration_ms: 287.736259
+  type: 'test'
+  ...
+# Subtest: X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
+ok 41 - X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
+  ---
+  duration_ms: 40.701702
+  type: 'test'
+  ...
+# Subtest: X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
+ok 42 - X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
+  ---
+  duration_ms: 255.00293
+  type: 'test'
+  ...
+# Subtest: X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
+ok 43 - X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
+  ---
+  duration_ms: 150.028688
+  type: 'test'
+  ...
+# Subtest: X-G14: a fire whose user is gone or remade skips the fire steps and says why
+ok 44 - X-G14: a fire whose user is gone or remade skips the fire steps and says why
+  ---
+  duration_ms: 307.943002
+  type: 'test'
+  ...
+# Subtest: X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
+ok 45 - X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
+  ---
+  duration_ms: 329.886149
+  type: 'test'
+  ...
+# Subtest: X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
+ok 46 - X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
+  ---
+  duration_ms: 131.77271
+  type: 'test'
+  ...
+# Subtest: row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job
+ok 47 - row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job
+  ---
+  duration_ms: 109.986328
+  type: 'test'
+  ...
+# Subtest: X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
+ok 48 - X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
+  ---
+  duration_ms: 131.334179
+  type: 'test'
+  ...
+# Subtest: X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
+ok 49 - X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
+  ---
+  duration_ms: 46.720817
+  type: 'test'
+  ...
+# Subtest: status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
+ok 50 - status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
+  ---
+  duration_ms: 134.567484
+  type: 'test'
+  ...
+1..50
+# tests 50
+# suites 0
+# pass 50
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 8877.069255

agents/magica/work/queue-285/gate/bus/gitea-migration.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
+ok 1 - 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
+  ---
+  duration_ms: 93.335171
+  type: 'test'
+  ...
+# Subtest: a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
+ok 2 - a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
+  ---
+  duration_ms: 100.672759
+  type: 'test'
+  ...
+# Subtest: the 3j engine refuses a migrated store, migrating or not, and leaves it as it was
+ok 3 - the 3j engine refuses a migrated store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 87.645326
+  type: 'test'
+  ...
+# Subtest: gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
+ok 4 - gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
+  ---
+  duration_ms: 12.32901
+  type: 'test'
+  ...
+# Subtest: gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
+ok 5 - gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
+  ---
+  duration_ms: 12.966492
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 381.559306

agents/magica/work/queue-285/gate/bus/grant-enroll.test.mjs.log

@@ -0,0 +1,154 @@
+TAP version 13
+# Subtest: G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
+ok 1 - G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
+  ---
+  duration_ms: 38.281427
+  type: 'test'
+  ...
+# Subtest: G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
+ok 2 - G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
+  ---
+  duration_ms: 48.163669
+  type: 'test'
+  ...
+# Subtest: G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
+ok 3 - G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
+  ---
+  duration_ms: 32.853876
+  type: 'test'
+  ...
+# Subtest: G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
+ok 4 - G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
+  ---
+  duration_ms: 30.33327
+  type: 'test'
+  ...
+# Subtest: G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
+ok 5 - G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
+  ---
+  duration_ms: 50.930216
+  type: 'test'
+  ...
+# Subtest: A2, A4: a credential.mint without grant, and a no, start nothing
+ok 6 - A2, A4: a credential.mint without grant, and a no, start nothing
+  ---
+  duration_ms: 244.336417
+  type: 'test'
+  ...
+# Subtest: A3, X1: a resolve by the tester or an agent starts nothing
+ok 7 - A3, X1: a resolve by the tester or an agent starts nothing
+  ---
+  duration_ms: 240.65584
+  type: 'test'
+  ...
+# Subtest: G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
+ok 8 - G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
+  ---
+  duration_ms: 240.507806
+  type: 'test'
+  ...
+# Subtest: G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
+ok 9 - G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
+  ---
+  duration_ms: 54.926707
+  type: 'test'
+  ...
+# Subtest: A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
+ok 10 - A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
+  ---
+  duration_ms: 75.219986
+  type: 'test'
+  ...
+# Subtest: A9: the hosts primary key refuses a second record for (business, host)
+ok 11 - A9: the hosts primary key refuses a second record for (business, host)
+  ---
+  duration_ms: 25.782861
+  type: 'test'
+  ...
+# Subtest: X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
+ok 12 - X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
+  ---
+  duration_ms: 48.544299
+  type: 'test'
+  ...
+# Subtest: A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
+ok 13 - A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
+  ---
+  duration_ms: 29.529821
+  type: 'test'
+  ...
+# Subtest: X3: at start an enrollment that stopped after its registry step loses its record and key file
+ok 14 - X3: at start an enrollment that stopped after its registry step loses its record and key file
+  ---
+  duration_ms: 49.214869
+  type: 'test'
+  ...
+# Subtest: G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
+ok 15 - G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
+  ---
+  duration_ms: 0.271703
+  type: 'test'
+  ...
+# Subtest: E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
+ok 16 - E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
+  ---
+  duration_ms: 53.128906
+  type: 'test'
+  ...
+# Subtest: G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
+ok 17 - G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
+  ---
+  duration_ms: 49.568529
+  type: 'test'
+  ...
+# Subtest: G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
+ok 18 - G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
+  ---
+  duration_ms: 49.698822
+  type: 'test'
+  ...
+# Subtest: E4: a check whose installer fingerprint differs from the record refuses host-changed
+ok 19 - E4: a check whose installer fingerprint differs from the record refuses host-changed
+  ---
+  duration_ms: 48.584144
+  type: 'test'
+  ...
+# Subtest: E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
+ok 20 - E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
+  ---
+  duration_ms: 51.761624
+  type: 'test'
+  ...
+# Subtest: G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
+ok 21 - G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
+  ---
+  duration_ms: 50.075941
+  type: 'test'
+  ...
+# Subtest: hosts.remove refuses host-in-use while a grant record names the host
+ok 22 - hosts.remove refuses host-in-use while a grant record names the host
+  ---
+  duration_ms: 50.420746
+  type: 'test'
+  ...
+# Subtest: the grant writer refuses a body outside section 7's shape
+ok 23 - the grant writer refuses a body outside section 7's shape
+  ---
+  duration_ms: 25.550962
+  type: 'test'
+  ...
+# Subtest: recordEvent refuses reserved-event for a grant.* action or operation
+ok 24 - recordEvent refuses reserved-event for a grant.* action or operation
+  ---
+  duration_ms: 22.326313
+  type: 'test'
+  ...
+1..24
+# tests 24
+# suites 0
+# pass 24
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1685.932811

agents/magica/work/queue-285/gate/bus/grant-executor.test.mjs.log

@@ -0,0 +1,262 @@
+TAP version 13
+# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
+ok 1 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
+  ---
+  duration_ms: 85.147898
+  type: 'test'
+  ...
+# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
+ok 2 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
+  ---
+  duration_ms: 0.38305
+  type: 'test'
+  ...
+# Subtest: G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
+ok 3 - G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
+  ---
+  duration_ms: 654.326801
+  type: 'test'
+  ...
+# Subtest: G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
+ok 4 - G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
+  ---
+  duration_ms: 555.189536
+  type: 'test'
+  ...
+# Subtest: G8: a failure at install or verify removes the line and leaves no record, key file or reference
+ok 5 - G8: a failure at install or verify removes the line and leaves no record, key file or reference
+  ---
+  duration_ms: 1529.700962
+  type: 'test'
+  ...
+# Subtest: G8: a failed remove adds hostLineLeft and tells the human to sweep
+ok 6 - G8: a failed remove adds hostLineLeft and tells the human to sweep
+  ---
+  duration_ms: 631.927863
+  type: 'test'
+  ...
+# Subtest: G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
+ok 7 - G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
+  ---
+  duration_ms: 651.862059
+  type: 'test'
+  ...
+# Subtest: G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
+ok 8 - G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
+  ---
+  duration_ms: 673.221734
+  type: 'test'
+  ...
+# Subtest: G8: a failed step 1 check spends the decision and runs nothing remote
+ok 9 - G8: a failed step 1 check spends the decision and runs nothing remote
+  ---
+  duration_ms: 85.965762
+  type: 'test'
+  ...
+# Subtest: G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
+ok 10 - G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
+  ---
+  duration_ms: 516.617317
+  type: 'test'
+  ...
+# Subtest: G9: an agent no longer a role or no longer declaring host ends with its code, spent
+ok 11 - G9: an agent no longer a role or no longer declaring host ends with its code, spent
+  ---
+  duration_ms: 71.610917
+  type: 'test'
+  ...
+# Subtest: G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
+ok 12 - G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
+  ---
+  duration_ms: 514.449713
+  type: 'test'
+  ...
+# Subtest: G15: no event, message or decision holds the private key
+ok 13 - G15: no event, message or decision holds the private key
+  ---
+  duration_ms: 490.45793
+  type: 'test'
+  ...
+# Subtest: G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
+ok 14 - G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
+  ---
+  duration_ms: 525.403254
+  type: 'test'
+  ...
+# Subtest: G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
+ok 15 - G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
+  ---
+  duration_ms: 859.650025
+  type: 'test'
+  ...
+# Subtest: G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
+ok 16 - G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
+  ---
+  duration_ms: 856.142201
+  type: 'test'
+  ...
+# Subtest: G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
+ok 17 - G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
+  ---
+  duration_ms: 512.212562
+  type: 'test'
+  ...
+# Subtest: G24: names at 64 characters with . and _ give distinct tags of the fixed length
+ok 18 - G24: names at 64 characters with . and _ give distinct tags of the fixed length
+  ---
+  duration_ms: 0.395966
+  type: 'test'
+  ...
+# Subtest: G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
+ok 19 - G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
+  ---
+  duration_ms: 223.650509
+  type: 'test'
+  ...
+# Subtest: G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
+ok 20 - G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
+  ---
+  duration_ms: 228.242918
+  type: 'test'
+  ...
+# Subtest: G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
+ok 21 - G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
+  ---
+  duration_ms: 518.665478
+  type: 'test'
+  ...
+# Subtest: G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
+ok 22 - G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
+  ---
+  duration_ms: 67.726567
+  type: 'test'
+  ...
+# Subtest: G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
+ok 23 - G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
+  ---
+  duration_ms: 278.544275
+  type: 'test'
+  ...
+# Subtest: G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
+ok 24 - G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
+  ---
+  duration_ms: 510.221326
+  type: 'test'
+  ...
+# Subtest: N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
+ok 25 - N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
+  ---
+  duration_ms: 6.772461
+  type: 'test'
+  ...
+# Subtest: G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
+ok 26 - G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
+  ---
+  duration_ms: 657.45817
+  type: 'test'
+  ...
+# Subtest: G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
+ok 27 - G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
+  ---
+  duration_ms: 214.935534
+  type: 'test'
+  ...
+# Subtest: G13: a revoke during install aborts the executor, which ends revoked, and the line goes
+ok 28 - G13: a revoke during install aborts the executor, which ends revoked, and the line goes
+  ---
+  duration_ms: 559.367656
+  type: 'test'
+  ...
+# Subtest: G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
+ok 29 - G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
+  ---
+  duration_ms: 505.610854
+  type: 'test'
+  ...
+# Subtest: row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records
+ok 30 - row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records
+  ---
+  duration_ms: 657.398806
+  type: 'test'
+  ...
+# Subtest: G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
+ok 31 - G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
+  ---
+  duration_ms: 660.311286
+  type: 'test'
+  ...
+# Subtest: G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
+ok 32 - G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
+  ---
+  duration_ms: 949.275926
+  type: 'test'
+  ...
+# Subtest: G27: a key file a revoke could not unlink is reported left and goes at the next start
+ok 33 - G27: a key file a revoke could not unlink is reported left and goes at the next start
+  ---
+  duration_ms: 655.004235
+  type: 'test'
+  ...
+# Subtest: G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
+ok 34 - G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
+  ---
+  duration_ms: 683.030342
+  type: 'test'
+  ...
+# Subtest: G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
+ok 35 - G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
+  ---
+  duration_ms: 947.263093
+  type: 'test'
+  ...
+# Subtest: G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
+ok 36 - G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
+  ---
+  duration_ms: 711.921212
+  type: 'test'
+  ...
+# Subtest: G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
+ok 37 - G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
+  ---
+  duration_ms: 208.636299
+  type: 'test'
+  ...
+# Subtest: G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
+ok 38 - G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
+  ---
+  duration_ms: 648.992204
+  type: 'test'
+  ...
+# Subtest: G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
+ok 39 - G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
+  ---
+  duration_ms: 655.778712
+  type: 'test'
+  ...
+# Subtest: G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
+ok 40 - G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
+  ---
+  duration_ms: 1176.881676
+  type: 'test'
+  ...
+# Subtest: mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
+ok 41 - mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
+  ---
+  duration_ms: 64.182383
+  type: 'test'
+  ...
+# Subtest: sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
+ok 42 - sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
+  ---
+  duration_ms: 518.919831
+  type: 'test'
+  ...
+1..42
+# tests 42
+# suites 0
+# pass 42
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 21606.612426

agents/magica/work/queue-285/gate/bus/grant-host.test.mjs.log

@@ -0,0 +1,70 @@
+TAP version 13
+# Subtest: G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
+ok 1 - G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
+  ---
+  duration_ms: 29.512761
+  type: 'test'
+  ...
+# Subtest: G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
+ok 2 - G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
+  ---
+  duration_ms: 40.401059
+  type: 'test'
+  ...
+# Subtest: row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
+ok 3 - row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
+  ---
+  duration_ms: 24.133273
+  type: 'test'
+  ...
+# Subtest: G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
+ok 4 - G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
+  ---
+  duration_ms: 23.680691
+  type: 'test'
+  ...
+# Subtest: mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
+ok 5 - mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
+  ---
+  duration_ms: 20.254516
+  type: 'test'
+  ...
+# Subtest: G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
+ok 6 - G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
+  ---
+  duration_ms: 41.214228
+  type: 'test'
+  ...
+# Subtest: R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
+ok 7 - R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
+  ---
+  duration_ms: 32.587628
+  type: 'test'
+  ...
+# Subtest: G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
+ok 8 - G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
+  ---
+  duration_ms: 26.849369
+  type: 'test'
+  ...
+# Subtest: R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
+ok 9 - R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
+  ---
+  duration_ms: 21.543146
+  type: 'test'
+  ...
+# Subtest: G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
+ok 10 - G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
+  ---
+  duration_ms: 34.607206
+  type: 'test'
+  ...
+1..10
+# tests 10
+# suites 0
+# pass 10
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 377.938537

agents/magica/work/queue-285/gate/bus/grant-migration.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
+ok 1 - 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
+  ---
+  duration_ms: 78.321774
+  type: 'test'
+  ...
+# Subtest: a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
+ok 2 - a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
+  ---
+  duration_ms: 94.303753
+  type: 'test'
+  ...
+# Subtest: the 3i engine refuses a migrated store, migrating or not, and leaves it as it was
+ok 3 - the 3i engine refuses a migrated store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 85.717476
+  type: 'test'
+  ...
+# Subtest: A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
+ok 4 - A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
+  ---
+  duration_ms: 79.018659
+  type: 'test'
+  ...
+# Subtest: the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
+ok 5 - the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
+  ---
+  duration_ms: 15.653321
+  type: 'test'
+  ...
+# Subtest: hosts: one record per business and host, a ready host has its installer and check, grants need the host
+ok 6 - hosts: one record per business and host, a ready host has its installer and check, grants need the host
+  ---
+  duration_ms: 12.80956
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 441.379813

agents/magica/work/queue-285/gate/bus/grant-scope-runtime.test.mjs.log

@@ -0,0 +1,17 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: row 298 runtime: human scope approval writes the file and organization history at the supplied revision
+ok 1 - row 298 runtime: human scope approval writes the file and organization history at the supplied revision
+  ---
+  duration_ms: 75.959603
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 184.502678

agents/magica/work/queue-285/gate/bus/grant-scope.test.mjs.log

@@ -0,0 +1,94 @@
+TAP version 13
+# Subtest: row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse
+ok 1 - row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse
+  ---
+  duration_ms: 76.602768
+  type: 'test'
+  ...
+# Subtest: row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written
+ok 2 - row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written
+  ---
+  duration_ms: 49.29448
+  type: 'test'
+  ...
+# Subtest: row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256
+ok 3 - row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256
+  ---
+  duration_ms: 48.741112
+  type: 'test'
+  ...
+# Subtest: row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable
+ok 4 - row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable
+  ---
+  duration_ms: 131.30707
+  type: 'test'
+  ...
+# Subtest: row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it
+ok 5 - row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it
+  ---
+  duration_ms: 112.266108
+  type: 'test'
+  ...
+# Subtest: row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits
+ok 6 - row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits
+  ---
+  duration_ms: 141.184127
+  type: 'test'
+  ...
+# Subtest: row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope
+ok 7 - row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope
+  ---
+  duration_ms: 47.197556
+  type: 'test'
+  ...
+# Subtest: row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed
+ok 8 - row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed
+  ---
+  duration_ms: 68.220502
+  type: 'test'
+  ...
+# Subtest: row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments
+ok 9 - row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments
+  ---
+  duration_ms: 75.844738
+  type: 'test'
+  ...
+# Subtest: row 298 (Q5): a host scope narrowed before the spend ends scope-changed
+ok 10 - row 298 (Q5): a host scope narrowed before the spend ends scope-changed
+  ---
+  duration_ms: 67.290315
+  type: 'test'
+  ...
+# Subtest: row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution
+ok 11 - row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution
+  ---
+  duration_ms: 89.039863
+  type: 'test'
+  ...
+# Subtest: row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor
+ok 12 - row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor
+  ---
+  duration_ms: 73.928974
+  type: 'test'
+  ...
+# Subtest: row 298 T6: host enrollment stays open for human Approve even with both methods in scope
+ok 13 - row 298 T6: host enrollment stays open for human Approve even with both methods in scope
+  ---
+  duration_ms: 51.023627
+  type: 'test'
+  ...
+# Subtest: row 298: scope without an organization revision never closes automatically
+ok 14 - row 298: scope without an organization revision never closes automatically
+  ---
+  duration_ms: 48.248905
+  type: 'test'
+  ...
+1..14
+# tests 14
+# suites 0
+# pass 14
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1162.045876

agents/magica/work/queue-285/gate/bus/hard-waits.test.mjs.log

@@ -0,0 +1,88 @@
+TAP version 13
+# Subtest: REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
+ok 1 - REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
+  ---
+  duration_ms: 1.193206
+  type: 'test'
+  ...
+# Subtest: REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
+ok 2 - REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
+  ---
+  duration_ms: 26.375408
+  type: 'test'
+  ...
+# Subtest: REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
+ok 3 - REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
+  ---
+  duration_ms: 466.348889
+  type: 'test'
+  ...
+# Subtest: REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
+ok 4 - REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
+  ---
+  duration_ms: 190.216517
+  type: 'test'
+  ...
+# Subtest: REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
+ok 5 - REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
+  ---
+  duration_ms: 49.516039
+  type: 'test'
+  ...
+# Subtest: REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
+ok 6 - REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
+  ---
+  duration_ms: 72.728787
+  type: 'test'
+  ...
+# Subtest: REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
+ok 7 - REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
+  ---
+  duration_ms: 103.290969
+  type: 'test'
+  ...
+# Subtest: Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
+ok 8 - Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
+  ---
+  duration_ms: 48.768178
+  type: 'test'
+  ...
+# Subtest: Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
+ok 9 - Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
+  ---
+  duration_ms: 114.814502
+  type: 'test'
+  ...
+# Subtest: Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
+ok 10 - Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
+  ---
+  duration_ms: 63.423274
+  type: 'test'
+  ...
+# Subtest: Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
+ok 11 - Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
+  ---
+  duration_ms: 50.811833
+  type: 'test'
+  ...
+# Subtest: Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
+ok 12 - Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
+  ---
+  duration_ms: 49.699334
+  type: 'test'
+  ...
+# Subtest: Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
+ok 13 - Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
+  ---
+  duration_ms: 70.00674
+  type: 'test'
+  ...
+1..13
+# tests 13
+# suites 0
+# pass 13
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1393.657013

agents/magica/work/queue-285/gate/bus/host-run.test.mjs.log

@@ -0,0 +1,166 @@
+TAP version 13
+# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
+ok 1 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
+  ---
+  duration_ms: 88.88808
+  type: 'test'
+  ...
+# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
+ok 2 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
+  ---
+  duration_ms: 0.389323
+  type: 'test'
+  ...
+# Subtest: the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
+ok 3 - the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
+  ---
+  duration_ms: 0.115572
+  type: 'test'
+  ...
+# Subtest: T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
+ok 4 - T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
+  ---
+  duration_ms: 31.85853
+  type: 'test'
+  ...
+# Subtest: T4: the value check takes one unencrypted ed25519 key and nothing else
+ok 5 - T4: the value check takes one unencrypted ed25519 key and nothing else
+  ---
+  duration_ms: 162.875863
+  type: 'test'
+  ...
+# Subtest: T5 to T8: registry, grant, argv shape and allowlist refusals
+ok 6 - T5 to T8: registry, grant, argv shape and allowlist refusals
+  ---
+  duration_ms: 527.25457
+  type: 'test'
+  ...
+# Subtest: T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
+ok 7 - T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
+  ---
+  duration_ms: 300.897416
+  type: 'test'
+  ...
+# Subtest: T10, T11: argv reaches sudo unchanged after sudo -n --
+ok 8 - T10, T11: argv reaches sudo unchanged after sudo -n --
+  ---
+  duration_ms: 279.757279
+  type: 'test'
+  ...
+# Subtest: T12, T13: exit code passes through, the timeout kills the group, output is capped
+ok 9 - T12, T13: exit code passes through, the timeout kills the group, output is capped
+  ---
+  duration_ms: 1509.864596
+  type: 'test'
+  ...
+# Subtest: T14: a host key not in the registry refuses and nothing runs
+ok 10 - T14: a host key not in the registry refuses and nothing runs
+  ---
+  duration_ms: 173.80908
+  type: 'test'
+  ...
+# Subtest: G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
+ok 11 - G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
+  ---
+  duration_ms: 312.878674
+  type: 'test'
+  ...
+# Subtest: N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
+ok 12 - N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
+  ---
+  duration_ms: 305.582747
+  type: 'test'
+  ...
+# Subtest: T15: ssh reads no config file and no user known_hosts
+ok 13 - T15: ssh reads no config file and no user known_hosts
+  ---
+  duration_ms: 278.446582
+  type: 'test'
+  ...
+# Subtest: T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
+ok 14 - T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
+  ---
+  duration_ms: 617.456634
+  type: 'test'
+  ...
+# Subtest: T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
+ok 15 - T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
+  ---
+  duration_ms: 4654.933725
+  type: 'test'
+  ...
+# Subtest: T21: revoke kills the call in flight, and the next call refuses
+ok 16 - T21: revoke kills the call in flight, and the next call refuses
+  ---
+  duration_ms: 291.755403
+  type: 'test'
+  ...
+# Subtest: T22: events carry host, address, user and argv in clear, and sizes and hashes only
+ok 17 - T22: events carry host, address, user and argv in clear, and sizes and hashes only
+  ---
+  duration_ms: 278.189827
+  type: 'test'
+  ...
+# Subtest: T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
+ok 18 - T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
+  ---
+  duration_ms: 23.423912
+  type: 'test'
+  ...
+# Subtest: T25: no role definition lists host.sudo while it is a hard wait
+ok 19 - T25: no role definition lists host.sudo while it is a hard wait
+  ---
+  duration_ms: 0.564622
+  type: 'test'
+  ...
+# Subtest: T27: the bus child dying takes ssh and ssh-agent with it
+ok 20 - T27: the bus child dying takes ssh and ssh-agent with it
+  ---
+  duration_ms: 342.968434
+  type: 'test'
+  ...
+# Subtest: T27: ssh-add -t drops the key from an agent the test keeps alive
+ok 21 - T27: ssh-add -t drops the key from an agent the test keeps alive
+  ---
+  duration_ms: 3542.905082
+  type: 'test'
+  ...
+# Subtest: N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
+ok 22 - N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
+  ---
+  duration_ms: 428.870752
+  type: 'test'
+  ...
+# Subtest: T27: the start sweep keeps a live bus dir and kills only a matching live process
+ok 23 - T27: the start sweep keeps a live bus dir and kills only a matching live process
+  ---
+  duration_ms: 27.220032
+  type: 'test'
+  ...
+# Subtest: T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
+ok 24 - T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
+  ---
+  duration_ms: 52.209172
+  type: 'test'
+  ...
+# Subtest: M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
+ok 25 - M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
+  ---
+  duration_ms: 145.231007
+  type: 'test'
+  ...
+# Subtest: M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
+ok 26 - M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
+  ---
+  duration_ms: 104.662799
+  type: 'test'
+  ...
+1..26
+# tests 26
+# suites 0
+# pass 26
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 14603.445804

agents/magica/work/queue-285/gate/bus/host-tools.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: G16: the writer refuses each user, tag and key the design names, before any key file
+ok 1 - G16: the writer refuses each user, tag and key the design names, before any key file
+  ---
+  duration_ms: 2115.883429
+  type: 'test'
+  ...
+# Subtest: G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
+ok 2 - G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
+  ---
+  duration_ms: 517.226102
+  type: 'test'
+  ...
+# Subtest: G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
+ok 3 - G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
+  ---
+  duration_ms: 256.283481
+  type: 'test'
+  ...
+# Subtest: G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
+ok 4 - G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
+  ---
+  duration_ms: 383.692365
+  type: 'test'
+  ...
+# Subtest: G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
+ok 5 - G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
+  ---
+  duration_ms: 77.405161
+  type: 'test'
+  ...
+# Subtest: E3: the sudoers line and the sshd drop-in are the design lines and parse
+ok 6 - E3: the sudoers line and the sshd drop-in are the design lines and parse
+  ---
+  duration_ms: 14.546124
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 3412.250249

agents/magica/work/queue-285/gate/bus/human.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
+ok 1 - human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
+  ---
+  duration_ms: 1.375668
+  type: 'test'
+  ...
+# Subtest: process reader gets own kernel identity without exposing environment values
+ok 2 - process reader gets own kernel identity without exposing environment values
+  ---
+  duration_ms: 0.393442
+  type: 'test'
+  ...
+# Subtest: EACCES ancestor environments skip only markers; commands and registered launches still refuse
+ok 3 - EACCES ancestor environments skip only markers; commands and registered launches still refuse
+  ---
+  duration_ms: 0.583749
+  type: 'test'
+  ...
+# Subtest: real pid 1 remains inspectable when its environment is protected
+ok 4 - real pid 1 remains inspectable when its environment is protected
+  ---
+  duration_ms: 0.232996
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 54.830277

agents/magica/work/queue-285/gate/bus/instances-verb.test.mjs.log

@@ -0,0 +1,30 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
+ok 1 - row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
+  ---
+  duration_ms: 36.484777
+  type: 'test'
+  ...
+# Subtest: row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
+ok 2 - row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
+  ---
+  duration_ms: 128.208541
+  type: 'test'
+  ...
+# Subtest: row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
+ok 3 - row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
+  ---
+  duration_ms: 25.863108
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 274.257156

agents/magica/work/queue-285/gate/bus/interpreter.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: system Python is a resolved root-owned ELF, never a shim or home interpreter
+ok 1 - system Python is a resolved root-owned ELF, never a shim or home interpreter
+  ---
+  duration_ms: 2.030887
+  type: 'test'
+  ...
+# Subtest: real system interpreter is available and safely inspected
+ok 2 - real system interpreter is available and safely inspected
+  ---
+  duration_ms: 19.118933
+  type: 'test'
+  ...
+# Subtest: restart receipt appends actual replacement identity and refuses unsafe files
+ok 3 - restart receipt appends actual replacement identity and refuses unsafe files
+  ---
+  duration_ms: 4.251693
+  type: 'test'
+  ...
+# Subtest: activation gate compares fresh startup receipt to the current interpreter identity
+ok 4 - activation gate compares fresh startup receipt to the current interpreter identity
+  ---
+  duration_ms: 1.28812
+  type: 'test'
+  ...
+# Subtest: non-regular startup receipt refuses promptly without waiting on a FIFO peer
+ok 5 - non-regular startup receipt refuses promptly without waiting on a FIFO peer
+  ---
+  duration_ms: 29.268501
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 103.564663

agents/magica/work/queue-285/gate/bus/land.test.mjs.log

@@ -0,0 +1,118 @@
+TAP version 13
+# Subtest: REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
+ok 1 - REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
+  ---
+  duration_ms: 37.846485
+  type: 'test'
+  ...
+# Subtest: checkLand refuses on the decision and the review
+ok 2 - checkLand refuses on the decision and the review
+  ---
+  duration_ms: 34.951131
+  type: 'test'
+  ...
+# Subtest: REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
+ok 3 - REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
+  ---
+  duration_ms: 83.160306
+  type: 'test'
+  ...
+# Subtest: REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
+ok 4 - REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
+  ---
+  duration_ms: 22.634701
+  type: 'test'
+  ...
+# Subtest: a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
+ok 5 - a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
+  ---
+  duration_ms: 25.932752
+  type: 'test'
+  ...
+# Subtest: a merge option with no first line refuses no-subject, as land-work does
+ok 6 - a merge option with no first line refuses no-subject, as land-work does
+  ---
+  duration_ms: 23.866952
+  type: 'test'
+  ...
+# Subtest: checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
+ok 7 - checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
+  ---
+  duration_ms: 69.631014
+  type: 'test'
+  ...
+# Subtest: a ticket outlives the run that asked, and recordLand checks the task again
+ok 8 - a ticket outlives the run that asked, and recordLand checks the task again
+  ---
+  duration_ms: 27.570116
+  type: 'test'
+  ...
+# Subtest: two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
+ok 9 - two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
+  ---
+  duration_ms: 30.428122
+  type: 'test'
+  ...
+# Subtest: landRefused files the code on the task, tells the role only with notify, and ends the ticket
+ok 10 - landRefused files the code on the task, tells the role only with notify, and ends the ticket
+  ---
+  duration_ms: 30.007493
+  type: 'test'
+  ...
+# Subtest: landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
+ok 11 - landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
+  ---
+  duration_ms: 28.645388
+  type: 'test'
+  ...
+# Subtest: landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
+ok 12 - landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
+  ---
+  duration_ms: 37.70204
+  type: 'test'
+  ...
+# Subtest: landHolders leaves out a thread instance's decision, even one raised before its role became one
+ok 13 - landHolders leaves out a thread instance's decision, even one raised before its role became one
+  ---
+  duration_ms: 22.808296
+  type: 'test'
+  ...
+# Subtest: landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
+ok 14 - landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
+  ---
+  duration_ms: 35.287353
+  type: 'test'
+  ...
+# Subtest: a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
+ok 15 - a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
+  ---
+  duration_ms: 28.249072
+  type: 'test'
+  ...
+# Subtest: the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
+ok 16 - the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
+  ---
+  duration_ms: 137.675026
+  type: 'test'
+  ...
+# Subtest: usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
+ok 17 - usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
+  ---
+  duration_ms: 36.29073
+  type: 'test'
+  ...
+# Subtest: no run may write the action.allowed for git.merge.protected itself
+ok 18 - no run may write the action.allowed for git.merge.protected itself
+  ---
+  duration_ms: 18.368651
+  type: 'test'
+  ...
+1..18
+# tests 18
+# suites 0
+# pass 18
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 813.691433

agents/magica/work/queue-285/gate/bus/launch-notice.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: a message to a stopped role sends launch.by one notice, and the result says so
+ok 1 - a message to a stopped role sends launch.by one notice, and the result says so
+  ---
+  duration_ms: 27.80908
+  type: 'test'
+  ...
+# Subtest: a message to a role outside launch.instances says so in its result and in the notice
+ok 2 - a message to a role outside launch.instances says so in its result and in the notice
+  ---
+  duration_ms: 15.490264
+  type: 'test'
+  ...
+# Subtest: a message to a running role sends no notice and its result is unchanged
+ok 3 - a message to a running role sends no notice and its result is unchanged
+  ---
+  duration_ms: 13.314736
+  type: 'test'
+  ...
+# Subtest: a re-route at a claim, a release and claim, and a broker restart send no second notice
+ok 4 - a re-route at a claim, a release and claim, and a broker restart send no second notice
+  ---
+  duration_ms: 20.788754
+  type: 'test'
+  ...
+# Subtest: a run launched but not yet claimed counts as no holder
+ok 5 - a run launched but not yet claimed counts as no holder
+  ---
+  duration_ms: 11.922992
+  type: 'test'
+  ...
+# Subtest: no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
+ok 6 - no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
+  ---
+  duration_ms: 23.587631
+  type: 'test'
+  ...
+# Subtest: a business with no launch block tells nobody and says there is no launcher
+ok 7 - a business with no launch block tells nobody and says there is no launcher
+  ---
+  duration_ms: 10.429305
+  type: 'test'
+  ...
+# Subtest: the notice sender stays internal: no role is named _bus and no caller can send as it or to it
+ok 8 - the notice sender stays internal: no role is named _bus and no caller can send as it or to it
+  ---
+  duration_ms: 30.09346
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 233.106825

agents/magica/work/queue-285/gate/bus/launcher-released.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again
+ok 1 - row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again
+  ---
+  duration_ms: 42.582326
+  type: 'test'
+  ...
+# Subtest: row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder
+ok 2 - row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder
+  ---
+  duration_ms: 31.668665
+  type: 'test'
+  ...
+# Subtest: row 302 a run landRelease released answers launcher-released, and claims nothing again
+ok 3 - row 302 a run landRelease released answers launcher-released, and claims nothing again
+  ---
+  duration_ms: 32.290996
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 186.014217

agents/magica/work/queue-285/gate/bus/library-sync.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
+ok 1 - C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
+  ---
+  duration_ms: 19.169688
+  type: 'test'
+  ...
+# Subtest: C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
+ok 2 - C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
+  ---
+  duration_ms: 15.915067
+  type: 'test'
+  ...
+# Subtest: C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
+ok 3 - C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
+  ---
+  duration_ms: 24.257198
+  type: 'test'
+  ...
+# Subtest: C2-03a runtime: a librarySync from a boot config, with no function, is refused
+ok 4 - C2-03a runtime: a librarySync from a boot config, with no function, is refused
+  ---
+  duration_ms: 1.310757
+  type: 'test'
+  ...
+# Subtest: C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
+ok 5 - C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
+  ---
+  duration_ms: 558.931568
+  type: 'test'
+  ...
+# Subtest: row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
+ok 6 - row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
+  ---
+  duration_ms: 6080.946109
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 6813.5026

agents/magica/work/queue-285/gate/bus/library.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: C2-04 M4: both verbs reject every agent before arguments or adapter access
+ok 1 - C2-04 M4: both verbs reject every agent before arguments or adapter access
+  ---
+  duration_ms: 37.344826
+  type: 'test'
+  ...
+# Subtest: C2-04 bus: human reads validate keys and return adapter results without path leakage
+ok 2 - C2-04 bus: human reads validate keys and return adapter results without path leakage
+  ---
+  duration_ms: 16.332414
+  type: 'test'
+  ...
+# Subtest: C2-04 socket: each async library verb resolves its result rather than serializing {}
+ok 3 - C2-04 socket: each async library verb resolves its result rather than serializing {}
+  ---
+  duration_ms: 79.144627
+  type: 'test'
+  ...
+# Subtest: C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
+ok 4 - C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
+  ---
+  duration_ms: 109.185924
+  type: 'test'
+  ...
+# Subtest: C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
+ok 5 - C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
+  ---
+  duration_ms: 25.867172
+  type: 'test'
+  ...
+# Subtest: C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
+ok 6 - C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
+  ---
+  duration_ms: 222.293394
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 614.170243

agents/magica/work/queue-285/gate/bus/lifecycle-revoke.test.mjs.log

@@ -0,0 +1,59 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
+ok 1 - T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
+  ---
+  duration_ms: 91.697035
+  type: 'test'
+  ...
+# Subtest: T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
+ok 2 - T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
+  ---
+  duration_ms: 53.072006
+  type: 'test'
+  ...
+# Subtest: T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
+ok 3 - T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
+  ---
+  duration_ms: 58.331052
+  type: 'test'
+  ...
+# Subtest: T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
+ok 4 - T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
+  ---
+  duration_ms: 78.290907
+  type: 'test'
+  ...
+# Subtest: T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
+ok 5 - T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
+  ---
+  duration_ms: 62.034163
+  type: 'test'
+  ...
+# Subtest: T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
+ok 6 - T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
+  ---
+  duration_ms: 64.515985
+  type: 'test'
+  ...
+# Subtest: row 281 T1 fire: a host.<id> or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged
+ok 7 - row 281 T1 fire: a host.<id> or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged
+  ---
+  duration_ms: 62.311222
+  type: 'test'
+  ...
+# Subtest: row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued
+ok 8 - row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued
+  ---
+  duration_ms: 58.140551
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 653.759661

agents/magica/work/queue-285/gate/bus/lifecycle-verbs.test.mjs.log

@@ -0,0 +1,88 @@
+TAP version 13
+# Subtest: row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
+ok 1 - row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
+  ---
+  duration_ms: 36.174694
+  type: 'test'
+  ...
+# Subtest: row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
+ok 2 - row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
+  ---
+  duration_ms: 20.369541
+  type: 'test'
+  ...
+# Subtest: row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
+ok 3 - row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
+  ---
+  duration_ms: 15.444837
+  type: 'test'
+  ...
+# Subtest: row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
+ok 4 - row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
+  ---
+  duration_ms: 17.744659
+  type: 'test'
+  ...
+# Subtest: row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
+ok 5 - row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
+  ---
+  duration_ms: 30.245113
+  type: 'test'
+  ...
+# Subtest: row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
+ok 6 - row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
+  ---
+  duration_ms: 26.862404
+  type: 'test'
+  ...
+# Subtest: row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
+ok 7 - row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
+  ---
+  duration_ms: 26.507599
+  type: 'test'
+  ...
+# Subtest: row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
+ok 8 - row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
+  ---
+  duration_ms: 19.17881
+  type: 'test'
+  ...
+# Subtest: row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
+ok 9 - row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
+  ---
+  duration_ms: 28.018373
+  type: 'test'
+  ...
+# Subtest: row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
+ok 10 - row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
+  ---
+  duration_ms: 11.649386
+  type: 'test'
+  ...
+# Subtest: row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
+ok 11 - row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
+  ---
+  duration_ms: 21.341319
+  type: 'test'
+  ...
+# Subtest: row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
+ok 12 - row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
+  ---
+  duration_ms: 21.257984
+  type: 'test'
+  ...
+# Subtest: row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
+ok 13 - row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
+  ---
+  duration_ms: 137.897954
+  type: 'test'
+  ...
+1..13
+# tests 13
+# suites 0
+# pass 13
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 496.81624

agents/magica/work/queue-285/gate/bus/limit-checks.test.mjs.log

@@ -0,0 +1,106 @@
+TAP version 13
+# Subtest: REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
+ok 1 - REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
+  ---
+  duration_ms: 1.308677
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
+ok 2 - REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
+  ---
+  duration_ms: 0.201839
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
+ok 3 - REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
+  ---
+  duration_ms: 14.354093
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
+ok 4 - REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
+  ---
+  duration_ms: 13.101545
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
+ok 5 - REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
+  ---
+  duration_ms: 12.544299
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
+ok 6 - REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
+  ---
+  duration_ms: 13.960739
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
+ok 7 - REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
+  ---
+  duration_ms: 11.913582
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
+ok 8 - REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
+  ---
+  duration_ms: 14.658805
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
+ok 9 - REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
+  ---
+  duration_ms: 10.679739
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
+ok 10 - REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
+  ---
+  duration_ms: 9.307716
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
+ok 11 - REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
+  ---
+  duration_ms: 10.868384
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
+ok 12 - REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
+  ---
+  duration_ms: 10.698385
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
+ok 13 - REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
+  ---
+  duration_ms: 0.47025
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
+ok 14 - REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
+  ---
+  duration_ms: 16.68495
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
+ok 15 - REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
+  ---
+  duration_ms: 10.651737
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
+ok 16 - REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
+  ---
+  duration_ms: 1.470129
+  type: 'test'
+  ...
+1..16
+# tests 16
+# suites 0
+# pass 16
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 233.090607

agents/magica/work/queue-285/gate/bus/limit-stop.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
+ok 1 - REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
+  ---
+  duration_ms: 32.733374
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
+ok 2 - REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
+  ---
+  duration_ms: 34.422552
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
+ok 3 - REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
+  ---
+  duration_ms: 80.313268
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
+ok 4 - REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
+  ---
+  duration_ms: 22.652278
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 a broker with no limit checks configured never stops a run
+ok 5 - REQ-LIMIT-4 a broker with no limit checks configured never stops a run
+  ---
+  duration_ms: 14.508164
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 259.40863

agents/magica/work/queue-285/gate/bus/limits-runtime.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"03ce1bde-0b22-4634-b1a0-a7baad750a2b","source":"@none","code":"baseline-unknown"}
+# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
+# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"2646c66e-f96f-4723-a01b-66e8ec601e17","source":"@none","code":"baseline-unknown"}
+# Subtest: REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
+# organization: {"event":"reload-needs-restart","business":"demo"}
+ok 1 - REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
+  ---
+  duration_ms: 145.307315
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
+ok 2 - REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
+  ---
+  duration_ms: 36.374289
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
+ok 3 - REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
+  ---
+  duration_ms: 48.688122
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
+ok 4 - REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
+  ---
+  duration_ms: 45.207804
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
+ok 5 - REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
+  ---
+  duration_ms: 63.205522
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 381.203354

agents/magica/work/queue-285/gate/bus/limits.test.mjs.log

@@ -0,0 +1,30 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: limits binds actor from human proof and rejects role, reader, a tester set and forged actor
+ok 1 - limits binds actor from human proof and rejects role, reader, a tester set and forged actor
+  ---
+  duration_ms: 54.532604
+  type: 'test'
+  ...
+# Subtest: runtime wires verified human settings to the actual shared file writer and actor receipt
+ok 2 - runtime wires verified human settings to the actual shared file writer and actor receipt
+  ---
+  duration_ms: 97.971332
+  type: 'test'
+  ...
+# Subtest: uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
+ok 3 - uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
+  ---
+  duration_ms: 53.74373
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 281.657269

agents/magica/work/queue-285/gate/bus/message-citation.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: within-role sends cite an open gated launch decision without spending it or naming it in grants
+ok 1 - within-role sends cite an open gated launch decision without spending it or naming it in grants
+  ---
+  duration_ms: 38.403577
+  type: 'test'
+  ...
+# Subtest: missing and foreign-business citations refuse and roll back message and grant
+ok 2 - missing and foreign-business citations refuse and roll back message and grant
+  ---
+  duration_ms: 16.771426
+  type: 'test'
+  ...
+# Subtest: cross-role sends still need a matching resolved decision and consume it once
+ok 3 - cross-role sends still need a matching resolved decision and consume it once
+  ---
+  duration_ms: 21.602787
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 154.775138

agents/magica/work/queue-285/gate/bus/message-filter.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
+ok 1 - trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
+  ---
+  duration_ms: 84.975298
+  type: 'test'
+  ...
+# Subtest: replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
+ok 2 - replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
+  ---
+  duration_ms: 100.934275
+  type: 'test'
+  ...
+# Subtest: trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
+ok 3 - trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
+  ---
+  duration_ms: 98.503124
+  type: 'test'
+  ...
+# Subtest: replies leaves out other users thread messages and still fills a page
+ok 4 - replies leaves out other users thread messages and still fills a page
+  ---
+  duration_ms: 789.171476
+  type: 'test'
+  ...
+# Subtest: messages in the business human and tester threads are not hidden (row 177 unchanged)
+ok 5 - messages in the business human and tester threads are not hidden (row 177 unchanged)
+  ---
+  duration_ms: 127.278913
+  type: 'test'
+  ...
+# Subtest: governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
+ok 6 - governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
+  ---
+  duration_ms: 190.962668
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1464.341692

agents/magica/work/queue-285/gate/bus/messages.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: messages pages all human messages newest first without writes; read state is history
+ok 1 - messages pages all human messages newest first without writes; read state is history
+  ---
+  duration_ms: 308.580063
+  type: 'test'
+  ...
+# Subtest: messages refuses role callers, invalid paging and cursors outside this human feed
+ok 2 - messages refuses role callers, invalid paging and cursors outside this human feed
+  ---
+  duration_ms: 24.510231
+  type: 'test'
+  ...
+# Subtest: views messages passes only its paging arguments through
+ok 3 - views messages passes only its paging arguments through
+  ---
+  duration_ms: 0.285542
+  type: 'test'
+  ...
+# Subtest: messages isolates businesses even with a valid foreign cursor
+ok 4 - messages isolates businesses even with a valid foreign cursor
+  ---
+  duration_ms: 17.148738
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 446.277243

agents/magica/work/queue-285/gate/bus/messaging.test.mjs.log

@@ -0,0 +1,88 @@
+TAP version 13
+# Subtest: the assistant sends to the user and to the chief of staff only
+ok 1 - the assistant sends to the user and to the chief of staff only
+  ---
+  duration_ms: 42.757376
+  type: 'test'
+  ...
+# Subtest: an assistant send to any other role, or to the tester, is refused and logged
+ok 2 - an assistant send to any other role, or to the tester, is refused and logged
+  ---
+  duration_ms: 32.965072
+  type: 'test'
+  ...
+# Subtest: only the user and the chief of staff may send to the assistant; the tester is refused by default
+ok 3 - only the user and the chief of staff may send to the assistant; the tester is refused by default
+  ---
+  duration_ms: 32.637806
+  type: 'test'
+  ...
+# Subtest: REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
+ok 4 - REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
+  ---
+  duration_ms: 25.489268
+  type: 'test'
+  ...
+# Subtest: a sender-side list alone refuses a send to a role that has no list
+ok 5 - a sender-side list alone refuses a send to a role that has no list
+  ---
+  duration_ms: 28.58315
+  type: 'test'
+  ...
+# Subtest: a target-side list alone refuses a send from a role that has no list
+ok 6 - a target-side list alone refuses a send from a role that has no list
+  ---
+  duration_ms: 28.874455
+  type: 'test'
+  ...
+# Subtest: the sender list is checked before the target list
+ok 7 - the sender list is checked before the target list
+  ---
+  duration_ms: 25.36166
+  type: 'test'
+  ...
+# Subtest: roles without the field behave exactly as before
+ok 8 - roles without the field behave exactly as before
+  ---
+  duration_ms: 35.710632
+  type: 'test'
+  ...
+# Subtest: a business with no role definitions at all is unlimited
+ok 9 - a business with no role definitions at all is unlimited
+  ---
+  duration_ms: 32.156819
+  type: 'test'
+  ...
+# Subtest: a malformed messaging field refuses at boot
+ok 10 - a malformed messaging field refuses at boot
+  ---
+  duration_ms: 12.561738
+  type: 'test'
+  ...
+# Subtest: the assistant's review.request to a reviewer is refused and logged, even with an approved decision
+ok 11 - the assistant's review.request to a reviewer is refused and logged, even with an approved decision
+  ---
+  duration_ms: 30.029693
+  type: 'test'
+  ...
+# Subtest: a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
+ok 12 - a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
+  ---
+  duration_ms: 33.367279
+  type: 'test'
+  ...
+# Subtest: review requests and verdicts between roles without the field are unchanged
+ok 13 - review requests and verdicts between roles without the field are unchanged
+  ---
+  duration_ms: 26.302136
+  type: 'test'
+  ...
+1..13
+# tests 13
+# suites 0
+# pass 13
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 462.653952

agents/magica/work/queue-285/gate/bus/name-migration.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
+ok 1 - 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
+  ---
+  duration_ms: 82.991277
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 146.792555

agents/magica/work/queue-285/gate/bus/names.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
+ok 1 - REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
+  ---
+  duration_ms: 34.398425
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: the human names an instance through the CLI
+ok 2 - REQ-MSG-2: the human names an instance through the CLI
+  ---
+  duration_ms: 17.15729
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
+ok 3 - REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
+  ---
+  duration_ms: 19.338874
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
+ok 4 - REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
+  ---
+  duration_ms: 32.200163
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
+ok 5 - REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
+  ---
+  duration_ms: 27.214989
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
+ok 6 - REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
+  ---
+  duration_ms: 19.250075
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
+ok 7 - REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
+  ---
+  duration_ms: 19.533385
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 245.496335

agents/magica/work/queue-285/gate/bus/peer-transport.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
+ok 1 - proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
+  ---
+  duration_ms: 5.749109
+  type: 'test'
+  ...
+# Subtest: proof helper error and disconnect during verification never dispatch or bind
+ok 2 - proof helper error and disconnect during verification never dispatch or bind
+  ---
+  duration_ms: 1.335897
+  type: 'test'
+  ...
+# Subtest: Client receives explicit proof refusal codes without dispatch, not outcome-unknown
+ok 3 - Client receives explicit proof refusal codes without dispatch, not outcome-unknown
+  ---
+  duration_ms: 38.364481
+  type: 'test'
+  ...
+# Subtest: asynchronous proof calls release their transient session on success, failure and timeout
+ok 4 - asynchronous proof calls release their transient session on success, failure and timeout
+  ---
+  duration_ms: 28.555373
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 125.777462

agents/magica/work/queue-285/gate/bus/peercred.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
+ok 1 - T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
+  ---
+  duration_ms: 234.751974
+  type: 'test'
+  ...
+# Subtest: helper output and failures fail closed including unsafe gid
+ok 2 - helper output and failures fail closed including unsafe gid
+  ---
+  duration_ms: 1.799281
+  type: 'test'
+  ...
+# Subtest: helper timeout, capacity and shutdown refuse without leaving children
+ok 3 - helper timeout, capacity and shutdown refuse without leaving children
+  ---
+  duration_ms: 25.766608
+  type: 'test'
+  ...
+# Subtest: missing or non-regular peer helper refuses at construction before opening the bus
+ok 4 - missing or non-regular peer helper refuses at construction before opening the bus
+  ---
+  duration_ms: 0.289419
+  type: 'test'
+  ...
+# Subtest: shutdown waits for killed helper close before returning
+ok 5 - shutdown waits for killed helper close before returning
+  ---
+  duration_ms: 5.712687
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 339.640356

agents/magica/work/queue-285/gate/bus/plugins-verb.test.mjs.log

@@ -0,0 +1,32 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
+ok 1 - plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
+  ---
+  duration_ms: 22.156207
+  type: 'test'
+  ...
+# Subtest: runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
+ok 2 - runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
+  ---
+  duration_ms: 112.230912
+  type: 'test'
+  ...
+# Subtest: vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
+ok 3 - vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
+  ---
+  duration_ms: 59.303096
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 269.880034

agents/magica/work/queue-285/gate/bus/principal.test.mjs.log

@@ -0,0 +1,40 @@
+TAP version 13
+# Subtest: principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
+ok 1 - principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
+  ---
+  duration_ms: 1.598442
+  type: 'test'
+  ...
+# Subtest: user requires its own nonce and full walk plus immediate same-tree Console parent
+ok 2 - user requires its own nonce and full walk plus immediate same-tree Console parent
+  ---
+  duration_ms: 0.50262
+  type: 'test'
+  ...
+# Subtest: tester deliberately admits agent parents but rejects managed runs and another nonce
+ok 3 - tester deliberately admits agent parents but rejects managed runs and another nonce
+  ---
+  duration_ms: 0.285343
+  type: 'test'
+  ...
+# Subtest: human leaf identity is reread after walking the parents
+ok 4 - human leaf identity is reread after walking the parents
+  ---
+  duration_ms: 0.153324
+  type: 'test'
+  ...
+# Subtest: console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env
+ok 5 - console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env
+  ---
+  duration_ms: 1.274611
+  type: 'test'
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 58.415338

agents/magica/work/queue-285/gate/bus/process.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
+ok 1 - broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
+  ---
+  duration_ms: 162.402875
+  type: 'test'
+  ...
+# Subtest: startup token refusal returns safe code without value or partial listening broker
+ok 2 - startup token refusal returns safe code without value or partial listening broker
+  ---
+  duration_ms: 104.511422
+  type: 'test'
+  ...
+# Subtest: loaded fixture token is absent from socket replies and SQLite, including refusal evidence
+ok 3 - loaded fixture token is absent from socket replies and SQLite, including refusal evidence
+  ---
+  duration_ms: 146.007246
+  type: 'test'
+  ...
+# Subtest: killed broker leaves an explicit stale lock; another process cannot silently reclaim it
+ok 4 - killed broker leaves an explicit stale lock; another process cannot silently reclaim it
+  ---
+  duration_ms: 223.278634
+  type: 'test'
+  ...
+# Subtest: trusted host registers later launches; socket clients never have a registration verb
+ok 5 - trusted host registers later launches; socket clients never have a registration verb
+  ---
+  duration_ms: 171.458678
+  type: 'test'
+  ...
+# Subtest: REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
+ok 6 - REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
+  ---
+  duration_ms: 134.693475
+  type: 'test'
+  ...
+# Subtest: runtime excludes declared project roots even when host supplies no repoRoots
+ok 7 - runtime excludes declared project roots even when host supplies no repoRoots
+  ---
+  duration_ms: 108.789551
+  type: 'test'
+  ...
+# Subtest: a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
+ok 8 - a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
+  ---
+  duration_ms: 150.416773
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1254.687541

agents/magica/work/queue-285/gate/bus/processing-runtime.test.mjs.log

@@ -0,0 +1,22 @@
+TAP version 13
+# Subtest: real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
+ok 1 - real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
+  ---
+  duration_ms: 160.686197
+  type: 'test'
+  ...
+# Subtest: invalid state still starts the control bus and human halt then resume repairs it
+ok 2 - invalid state still starts the control bus and human halt then resume repairs it
+  ---
+  duration_ms: 67.198627
+  type: 'test'
+  ...
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 335.440989

agents/magica/work/queue-285/gate/bus/processing-timeout.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
+ok 1 - processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
+  ---
+  duration_ms: 183.216891
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 235.289094

agents/magica/work/queue-285/gate/bus/processing-web.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: a root halt aborts the active search-source signal before the normal web deadline
+ok 1 - a root halt aborts the active search-source signal before the normal web deadline
+  ---
+  duration_ms: 33.671547
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 98.241716

agents/magica/work/queue-285/gate/bus/processing.test.mjs.log

@@ -0,0 +1,94 @@
+TAP version 13
+# Subtest: processing.halt refuses agent reader and tester before any transition
+ok 1 - processing.halt refuses agent reader and tester before any transition
+  ---
+  duration_ms: 22.887001
+  type: 'test'
+  ...
+# Subtest: processing.resume refuses agent reader and tester before any transition
+ok 2 - processing.resume refuses agent reader and tester before any transition
+  ---
+  duration_ms: 14.966832
+  type: 'test'
+  ...
+# Subtest: human halt and clear each have one event with verified actor; launch.restore cannot clear
+ok 3 - human halt and clear each have one event with verified actor; launch.restore cannot clear
+  ---
+  duration_ms: 17.922193
+  type: 'test'
+  ...
+# Subtest: all ordinary work verbs refuse before dispatch while pure reads remain available
+ok 4 - all ordinary work verbs refuse before dispatch while pure reads remain available
+  ---
+  duration_ms: 31.531025
+  type: 'test'
+  ...
+# Subtest: task web authorization and bind paths refuse before external work
+ok 5 - task web authorization and bind paths refuse before external work
+  ---
+  duration_ms: 15.922592
+  type: 'test'
+  ...
+# Subtest: recordEvent cannot forge processing.halt
+ok 6 - recordEvent cannot forge processing.halt
+  ---
+  duration_ms: 11.810395
+  type: 'test'
+  ...
+# Subtest: recordEvent cannot forge processing.resume
+ok 7 - recordEvent cannot forge processing.resume
+  ---
+  duration_ms: 14.718066
+  type: 'test'
+  ...
+# Subtest: recordEvent cannot forge processing.stop
+ok 8 - recordEvent cannot forge processing.stop
+  ---
+  duration_ms: 11.317725
+  type: 'test'
+  ...
+# Subtest: recordTask poll cannot forge a processing action through its kinds filter
+ok 9 - recordTask poll cannot forge a processing action through its kinds filter
+  ---
+  duration_ms: 11.280761
+  type: 'test'
+  ...
+# Subtest: recordTask self cannot forge a processing action through its kinds filter
+ok 10 - recordTask self cannot forge a processing action through its kinds filter
+  ---
+  duration_ms: 10.998626
+  type: 'test'
+  ...
+# Subtest: spec read remains a read but cannot release new write work after an await
+ok 11 - spec read remains a read but cannot release new write work after an await
+  ---
+  duration_ms: 14.884287
+  type: 'test'
+  ...
+# Subtest: the real socket awaits halt and resume beyond the ordinary idle deadline
+ok 12 - the real socket awaits halt and resume beyond the ordinary idle deadline
+  ---
+  duration_ms: 53.60331
+  type: 'test'
+  ...
+# Subtest: a malformed processing reader never silently admits agent work
+ok 13 - a malformed processing reader never silently admits agent work
+  ---
+  duration_ms: 15.970847
+  type: 'test'
+  ...
+# Subtest: halt refuses the newly landed host executor path before credentials or effects
+ok 14 - halt refuses the newly landed host executor path before credentials or effects
+  ---
+  duration_ms: 14.541247
+  type: 'test'
+  ...
+1..14
+# tests 14
+# suites 0
+# pass 14
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 333.348316

agents/magica/work/queue-285/gate/bus/project-await.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
+ok 1 - D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
+  ---
+  duration_ms: 21.633659
+  type: 'test'
+  ...
+# Subtest: D2: spec.read refuses without content if its role is released during the read
+ok 2 - D2: spec.read refuses without content if its role is released during the read
+  ---
+  duration_ms: 14.345614
+  type: 'test'
+  ...
+# Subtest: D3: spec.read secret check refuses flagged content without content
+ok 3 - D3: spec.read secret check refuses flagged content without content
+  ---
+  duration_ms: 13.371872
+  type: 'test'
+  ...
+# Subtest: D3: spec.read secret check refuses flagged subject without content
+ok 4 - D3: spec.read secret check refuses flagged subject without content
+  ---
+  duration_ms: 12.77567
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 136.771938

agents/magica/work/queue-285/gate/bus/project-files.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: a human lists, opens and saves; the save is one commit by the business human
+ok 1 - a human lists, opens and saves; the save is one commit by the business human
+  ---
+  duration_ms: 102.225288
+  type: 'test'
+  ...
+# Subtest: an agent and a reader refuse every file verb and nothing is written
+ok 2 - an agent and a reader refuse every file verb and nothing is written
+  ---
+  duration_ms: 40.256895
+  type: 'test'
+  ...
+# Subtest: a stale base refuses stale-base and writes nothing
+ok 3 - a stale base refuses stale-base and writes nothing
+  ---
+  duration_ms: 67.757673
+  type: 'test'
+  ...
+# Subtest: paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
+ok 4 - paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
+  ---
+  duration_ms: 56.787219
+  type: 'test'
+  ...
+# Subtest: without a project adapter the file verbs refuse project-not-configured
+ok 5 - without a project adapter the file verbs refuse project-not-configured
+  ---
+  duration_ms: 27.905029
+  type: 'test'
+  ...
+# Subtest: on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
+ok 6 - on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
+  ---
+  duration_ms: 229.733966
+  type: 'test'
+  ...
+# Subtest: a request that names the save verb first and another verb last is refused at 64 KiB
+ok 7 - a request that names the save verb first and another verb last is refused at 64 KiB
+  ---
+  duration_ms: 59.730483
+  type: 'test'
+  ...
+# Subtest: two saves racing for one repository make one commit
+ok 8 - two saves racing for one repository make one commit
+  ---
+  duration_ms: 132.501597
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 797.30583

agents/magica/work/queue-285/gate/bus/project-runtime.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
+ok 1 - Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
+  ---
+  duration_ms: 1.923845
+  type: 'test'
+  ...
+# Subtest: without a trusted project adapter all three async paths refuse project-not-configured
+ok 2 - without a trusted project adapter all three async paths refuse project-not-configured
+  ---
+  duration_ms: 42.451202
+  type: 'test'
+  ...
+# Subtest: real startBroker injects the project adapter for socket reads and bound-author record writes
+ok 3 - real startBroker injects the project adapter for socket reads and bound-author record writes
+  ---
+  duration_ms: 199.703737
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 357.861956

agents/magica/work/queue-285/gate/bus/publish.test.mjs.log

@@ -0,0 +1,88 @@
+TAP version 13
+# Subtest: a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
+ok 1 - a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
+  ---
+  duration_ms: 29.037054
+  type: 'test'
+  ...
+# Subtest: happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
+ok 2 - happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
+  ---
+  duration_ms: 22.690586
+  type: 'test'
+  ...
+# Subtest: a hard wait: no decision refuses, and a decision for another task refuses
+ok 3 - a hard wait: no decision refuses, and a decision for another task refuses
+  ---
+  duration_ms: 22.617765
+  type: 'test'
+  ...
+# Subtest: r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
+ok 4 - r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
+  ---
+  duration_ms: 44.702604
+  type: 'test'
+  ...
+# Subtest: grant and fork refusals
+ok 5 - grant and fork refusals
+  ---
+  duration_ms: 40.787987
+  type: 'test'
+  ...
+# Subtest: remote-not-fork, compared without case, and remote-host-mismatch, at push
+ok 6 - remote-not-fork, compared without case, and remote-host-mismatch, at push
+  ---
+  duration_ms: 83.061963
+  type: 'test'
+  ...
+# Subtest: two agents granted one project each get their own fork
+ok 7 - two agents granted one project each get their own fork
+  ---
+  duration_ms: 43.594065
+  type: 'test'
+  ...
+# Subtest: the request cannot name the fork, the user or the destination
+ok 8 - the request cannot name the fork, the user or the destination
+  ---
+  duration_ms: 20.183608
+  type: 'test'
+  ...
+# Subtest: one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
+ok 9 - one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
+  ---
+  duration_ms: 49.139367
+  type: 'test'
+  ...
+# Subtest: publishRefused files the code on the task's trail and drops the ticket
+ok 10 - publishRefused files the code on the task's trail and drops the ticket
+  ---
+  duration_ms: 21.139396
+  type: 'test'
+  ...
+# Subtest: git.push.remote is in neither ROUTED list and no shipped role grants it
+ok 11 - git.push.remote is in neither ROUTED list and no shipped role grants it
+  ---
+  duration_ms: 0.697216
+  type: 'test'
+  ...
+# Subtest: runtime: withGitea keys from the open ticket only, and the store root is the organization dir
+ok 12 - runtime: withGitea keys from the open ticket only, and the store root is the organization dir
+  ---
+  duration_ms: 95.77284
+  type: 'test'
+  ...
+# Subtest: the bus process answers the publish ops from their own lines, not launch-op-refused
+ok 13 - the bus process answers the publish ops from their own lines, not launch-op-refused
+  ---
+  duration_ms: 137.273424
+  type: 'test'
+  ...
+1..13
+# tests 13
+# suites 0
+# pass 13
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 687.373143

agents/magica/work/queue-285/gate/bus/reload.test.mjs.log

@@ -0,0 +1,79 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
+ok 1 - T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
+  ---
+  duration_ms: 69.242354
+  type: 'test'
+  ...
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
+ok 2 - T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
+  ---
+  duration_ms: 82.454928
+  type: 'test'
+  ...
+# Subtest: T14 a definition change on a running instance refuses instance-running; a vars change still goes live
+ok 3 - T14 a definition change on a running instance refuses instance-running; a vars change still goes live
+  ---
+  duration_ms: 61.758295
+  type: 'test'
+  ...
+# Subtest: T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
+ok 4 - T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
+  ---
+  duration_ms: 43.483042
+  type: 'test'
+  ...
+# Subtest: T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
+ok 5 - T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
+  ---
+  duration_ms: 44.645779
+  type: 'test'
+  ...
+# Subtest: T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
+ok 6 - T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
+  ---
+  duration_ms: 95.238605
+  type: 'test'
+  ...
+# Subtest: T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
+ok 7 - T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
+  ---
+  duration_ms: 105.907228
+  type: 'test'
+  ...
+# Subtest: T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
+ok 8 - T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
+  ---
+  duration_ms: 58.349325
+  type: 'test'
+  ...
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
+ok 9 - T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
+  ---
+  duration_ms: 191.268691
+  type: 'test'
+  ...
+# Subtest: T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
+ok 10 - T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
+  ---
+  duration_ms: 10.440953
+  type: 'test'
+  ...
+1..10
+# tests 10
+# suites 0
+# pass 10
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 876.201837

agents/magica/work/queue-285/gate/bus/replies.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: a reply is listed for human and reader sessions, and its delivery rows are unchanged
+ok 1 - a reply is listed for human and reader sessions, and its delivery rows are unchanged
+  ---
+  duration_ms: 38.602536
+  type: 'test'
+  ...
+# Subtest: the reply still reaches the human message.receive (mosaic talk) after the Console showed it
+ok 2 - the reply still reaches the human message.receive (mosaic talk) after the Console showed it
+  ---
+  duration_ms: 19.85836
+  type: 'test'
+  ...
+# Subtest: a message with no reply gives an empty list
+ok 3 - a message with no reply gives an empty list
+  ---
+  duration_ms: 15.374113
+  type: 'test'
+  ...
+# Subtest: replies come oldest first and stop at REPLIES
+ok 4 - replies come oldest first and stop at REPLIES
+  ---
+  duration_ms: 72.181413
+  type: 'test'
+  ...
+# Subtest: an id that names no message in the business refuses message-not-found, and the refusal is recorded
+ok 5 - an id that names no message in the business refuses message-not-found, and the refusal is recorded
+  ---
+  duration_ms: 26.696416
+  type: 'test'
+  ...
+# Subtest: strict arguments; a role session gets human-required
+ok 6 - strict arguments; a role session gets human-required
+  ---
+  duration_ms: 30.7198
+  type: 'test'
+  ...
+# Subtest: views passes replies through as one call with the id
+ok 7 - views passes replies through as one call with the id
+  ---
+  duration_ms: 0.224431
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 282.184229

agents/magica/work/queue-285/gate/bus/requirements.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: requirements returns the committed list to a holding role session, and no one else
+ok 1 - requirements returns the committed list to a holding role session, and no one else
+  ---
+  duration_ms: 28.36651
+  type: 'test'
+  ...
+# Subtest: the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
+ok 2 - the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
+  ---
+  duration_ms: 16.745268
+  type: 'test'
+  ...
+# Subtest: the PM's non-blocking role.revoke with no task reaches the human's Inbox
+ok 3 - the PM's non-blocking role.revoke with no task reaches the human's Inbox
+  ---
+  duration_ms: 17.373687
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 140.39683

agents/magica/work/queue-285/gate/bus/review.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
+ok 1 - a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
+  ---
+  duration_ms: 30.296994
+  type: 'test'
+  ...
+# Subtest: review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
+ok 2 - review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
+  ---
+  duration_ms: 23.529897
+  type: 'test'
+  ...
+# Subtest: review.request says which run holds the reviewer role, or null, and a null request waits for a claim
+ok 3 - review.request says which run holds the reviewer role, or null, and a null request waits for a claim
+  ---
+  duration_ms: 26.171158
+  type: 'test'
+  ...
+# Subtest: review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
+ok 4 - review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
+  ---
+  duration_ms: 33.057767
+  type: 'test'
+  ...
+# Subtest: reviewFetch answers only the addressed reviewer, for the request it cites
+ok 5 - reviewFetch answers only the addressed reviewer, for the request it cites
+  ---
+  duration_ms: 23.095518
+  type: 'test'
+  ...
+# Subtest: review.verdict answers one request once, to the role that asked
+ok 6 - review.verdict answers one request once, to the role that asked
+  ---
+  duration_ms: 25.638946
+  type: 'test'
+  ...
+# Subtest: task.close on a pushed task needs an approve verdict for the latest push
+ok 7 - task.close on a pushed task needs an approve verdict for the latest push
+  ---
+  duration_ms: 34.923901
+  type: 'test'
+  ...
+# Subtest: a refusal the host decided is filed on the task it names, and only a task ref counts
+ok 8 - a refusal the host decided is filed on the task it names, and only a task ref counts
+  ---
+  duration_ms: 19.44463
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 291.610836

agents/magica/work/queue-285/gate/bus/revoke-window.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked
+ok 1 - row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked
+  ---
+  duration_ms: 34.474606
+  type: 'test'
+  ...
+# Subtest: row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked
+ok 2 - row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked
+  ---
+  duration_ms: 42.933114
+  type: 'test'
+  ...
+# Subtest: row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder
+ok 3 - row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder
+  ---
+  duration_ms: 32.312363
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 183.431888

agents/magica/work/queue-285/gate/bus/rooms.test.mjs.log

@@ -0,0 +1,118 @@
+TAP version 13
+# Subtest: room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads
+ok 1 - room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads
+  ---
+  duration_ms: 23.504339
+  type: 'test'
+  ...
+# Subtest: room.open preflights instance collisions atomically
+ok 2 - room.open preflights instance collisions atomically
+  ---
+  duration_ms: 15.453505
+  type: 'test'
+  ...
+# Subtest: room.open preflights owner collisions atomically
+ok 3 - room.open preflights owner collisions atomically
+  ---
+  duration_ms: 13.365239
+  type: 'test'
+  ...
+# Subtest: room verbs require the human, and none is a tester verb
+ok 4 - room verbs require the human, and none is a tester verb
+  ---
+  duration_ms: 20.113002
+  type: 'test'
+  ...
+# Subtest: room verbs refuse missing projects and zero member businesses
+ok 5 - room verbs refuse missing projects and zero member businesses
+  ---
+  duration_ms: 29.19635
+  type: 'test'
+  ...
+# Subtest: send/read refuse a missing canonical member without effects
+ok 6 - send/read refuse a missing canonical member without effects
+  ---
+  duration_ms: 15.691762
+  type: 'test'
+  ...
+# Subtest: send/read refuse a foreign-owner canonical member without effects
+ok 7 - send/read refuse a foreign-owner canonical member without effects
+  ---
+  duration_ms: 16.147529
+  type: 'test'
+  ...
+# Subtest: send/read refuse a wrong-instance canonical member without effects
+ok 8 - send/read refuse a wrong-instance canonical member without effects
+  ---
+  duration_ms: 17.257285
+  type: 'test'
+  ...
+# Subtest: room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows
+ok 9 - room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows
+  ---
+  duration_ms: 17.918111
+  type: 'test'
+  ...
+# Subtest: current display names and repeated tags resolve once; a replaced display name is unknown
+ok 10 - current display names and repeated tags resolve once; a replaced display name is unknown
+  ---
+  duration_ms: 17.569751
+  type: 'test'
+  ...
+# Subtest: a legacy name colliding with another member key is ambiguous; its own key resolves once
+ok 11 - a legacy name colliding with another member key is ambiguous; its own key resolves once
+  ---
+  duration_ms: 16.835485
+  type: 'test'
+  ...
+# Subtest: unknown or non-member addressees and tags-only bodies leave no message effects
+ok 12 - unknown or non-member addressees and tags-only bodies leave no message effects
+  ---
+  duration_ms: 19.933568
+  type: 'test'
+  ...
+# Subtest: messaging denial on the last target rolls back the entire broadcast; allowed subset still works
+ok 13 - messaging denial on the last target rolls back the entire broadcast; allowed subset still works
+  ---
+  duration_ms: 15.040151
+  type: 'test'
+  ...
+# Subtest: a clearing last member fences the whole send; another active target still accepts
+ok 14 - a clearing last member fences the whole send; another active target still accepts
+  ---
+  duration_ms: 19.148051
+  type: 'test'
+  ...
+# Subtest: room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors
+ok 15 - room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors
+  ---
+  duration_ms: 31.10873
+  type: 'test'
+  ...
+# Subtest: room.read keeps identical sends at the same timestamp separate and includes every session
+ok 16 - room.read keeps identical sends at the same timestamp separate and includes every session
+  ---
+  duration_ms: 28.620091
+  type: 'test'
+  ...
+# Subtest: room.read defaults and caps the number of merged entries, not recipient rows
+ok 17 - room.read defaults and caps the number of merged entries, not recipient rows
+  ---
+  duration_ms: 449.726146
+  type: 'test'
+  ...
+# Subtest: room.read includes an agent reply with its thread and instance without merging it with human rows
+ok 18 - room.read includes an agent reply with its thread and instance without merging it with human rows
+  ---
+  duration_ms: 20.318066
+  type: 'test'
+  ...
+1..18
+# tests 18
+# suites 0
+# pass 18
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 863.875474

agents/magica/work/queue-285/gate/bus/routes-verb.test.mjs.log

@@ -0,0 +1,35 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
+ok 1 - row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
+  ---
+  duration_ms: 37.13708
+  type: 'test'
+  ...
+# Subtest: row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
+ok 2 - row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
+  ---
+  duration_ms: 21.862763
+  type: 'test'
+  ...
+# Subtest: row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
+ok 3 - row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
+  ---
+  duration_ms: 38.116593
+  type: 'test'
+  ...
+# Subtest: row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
+ok 4 - row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
+  ---
+  duration_ms: 80.455295
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 251.758969

agents/magica/work/queue-285/gate/bus/schema.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: v3b prototype refusals, views and append-only mutations
+ok 1 - v3b prototype refusals, views and append-only mutations
+  ---
+  duration_ms: 87.075404
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 131.691588

agents/magica/work/queue-285/gate/bus/session-clear.test.mjs.log

@@ -0,0 +1,124 @@
+TAP version 13
+# Subtest: T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default
+ok 1 - T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default
+  ---
+  duration_ms: 139.573367
+  type: 'test'
+  ...
+# Subtest: T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default
+ok 2 - T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default
+  ---
+  duration_ms: 76.436253
+  type: 'test'
+  ...
+# Subtest: T4 D7: a run that ends before its next receive drains at its end, with its generation
+ok 3 - T4 D7: a run that ends before its next receive drains at its end, with its generation
+  ---
+  duration_ms: 73.695914
+  type: 'test'
+  ...
+# Subtest: T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more
+ok 4 - T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more
+  ---
+  duration_ms: 107.140203
+  type: 'test'
+  ...
+# Subtest: T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival
+ok 5 - T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival
+  ---
+  duration_ms: 122.531343
+  type: 'test'
+  ...
+# Subtest: T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt
+ok 6 - T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt
+  ---
+  duration_ms: 104.601526
+  type: 'test'
+  ...
+# Subtest: T4 Q4: the successor takes <old>-N, the next N free, and a bound name stays taken
+ok 7 - T4 Q4: the successor takes <old>-N, the next N free, and a bound name stays taken
+  ---
+  duration_ms: 90.612442
+  type: 'test'
+  ...
+# Subtest: T4 D8: the successor start is held, refused or started, each report on its own counter
+ok 8 - T4 D8: the successor start is held, refused or started, each report on its own counter
+  ---
+  duration_ms: 88.162498
+  type: 'test'
+  ...
+# Subtest: T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes
+ok 9 - T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes
+  ---
+  duration_ms: 70.048248
+  type: 'test'
+  ...
+# Subtest: T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor
+ok 10 - T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor
+  ---
+  duration_ms: 100.823621
+  type: 'test'
+  ...
+# Subtest: T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input
+ok 11 - T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input
+  ---
+  duration_ms: 83.167647
+  type: 'test'
+  ...
+# Subtest: T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was
+ok 12 - T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was
+  ---
+  duration_ms: 84.885077
+  type: 'test'
+  ...
+# Subtest: T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor
+ok 13 - T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor
+  ---
+  duration_ms: 83.448743
+  type: 'test'
+  ...
+# Subtest: T4 sage-2828: a cancel after the successor started refuses session-clear-complete
+ok 14 - T4 sage-2828: a cancel after the successor started refuses session-clear-complete
+  ---
+  duration_ms: 76.911584
+  type: 'test'
+  ...
+# Subtest: T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled
+ok 15 - T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled
+  ---
+  duration_ms: 83.895535
+  type: 'test'
+  ...
+# Subtest: T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing
+ok 16 - T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing
+  ---
+  duration_ms: 94.245934
+  type: 'test'
+  ...
+# Subtest: T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker
+ok 17 - T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker
+  ---
+  duration_ms: 64.740868
+  type: 'test'
+  ...
+# Subtest: T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was
+ok 18 - T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was
+  ---
+  duration_ms: 500.309365
+  type: 'test'
+  ...
+# Subtest: T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was
+ok 19 - T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 954.398623
+  type: 'test'
+  ...
+1..19
+# tests 19
+# suites 0
+# pass 19
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 3077.300038

agents/magica/work/queue-285/gate/bus/session-compactions.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: session.list rows carry the reader count for each session, with its store identity
+ok 1 - session.list rows carry the reader count for each session, with its store identity
+  ---
+  duration_ms: 27.217947
+  type: 'test'
+  ...
+# Subtest: a legacy session is asked for with legacy true
+ok 2 - a legacy session is asked for with legacy true
+  ---
+  duration_ms: 14.876979
+  type: 'test'
+  ...
+# Subtest: without a reader the count is unknown, never 0; a reader that throws is store-unreadable
+ok 3 - without a reader the count is unknown, never 0; a reader that throws is store-unreadable
+  ---
+  duration_ms: 25.704946
+  type: 'test'
+  ...
+# Subtest: compactions must be a function
+ok 4 - compactions must be a function
+  ---
+  duration_ms: 9.038293
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 149.758854

agents/magica/work/queue-285/gate/bus/sessions.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies
+ok 1 - T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies
+  ---
+  duration_ms: 52.447052
+  type: 'test'
+  ...
+# Subtest: T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder
+ok 2 - T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder
+  ---
+  duration_ms: 37.413272
+  type: 'test'
+  ...
+# Subtest: T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing
+ok 3 - T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing
+  ---
+  duration_ms: 48.636403
+  type: 'test'
+  ...
+# Subtest: session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads
+ok 4 - session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads
+  ---
+  duration_ms: 28.072857
+  type: 'test'
+  ...
+# Subtest: the 3l triggers keep sessions in their thread and session ids apart from thread ids
+ok 5 - the 3l triggers keep sessions in their thread and session ids apart from thread ids
+  ---
+  duration_ms: 66.1131
+  type: 'test'
+  ...
+# Subtest: T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs
+ok 6 - T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs
+  ---
+  duration_ms: 100.049413
+  type: 'test'
+  ...
+# Subtest: T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was
+ok 7 - T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was
+  ---
+  duration_ms: 154.293355
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 567.356958

agents/magica/work/queue-285/gate/bus/single-use.test.mjs.log

@@ -0,0 +1,82 @@
+TAP version 13
+# Subtest: gated approval authorizes once, survives store reopen, and fresh approval works
+ok 1 - gated approval authorizes once, survives store reopen, and fresh approval works
+  ---
+  duration_ms: 38.765836
+  type: 'test'
+  ...
+# Subtest: another run of the same instance consumes an approval once; a failed check leaves it usable
+ok 2 - another run of the same instance consumes an approval once; a failed check leaves it usable
+  ---
+  duration_ms: 18.91237
+  type: 'test'
+  ...
+# Subtest: two scheduled callers have exactly one grant and one consumed refusal
+ok 3 - two scheduled callers have exactly one grant and one consumed refusal
+  ---
+  duration_ms: 15.121428
+  type: 'test'
+  ...
+# Subtest: failed commit rolls consumption back; cross-role consumes and within-role stays reusable
+ok 4 - failed commit rolls consumption back; cross-role consumes and within-role stays reusable
+  ---
+  duration_ms: 27.764609
+  type: 'test'
+  ...
+# Subtest: class drift gated to cross-role refuses before consumption
+ok 5 - class drift gated to cross-role refuses before consumption
+  ---
+  duration_ms: 19.173603
+  type: 'test'
+  ...
+# Subtest: class drift cross-role to gated refuses before consumption
+ok 6 - class drift cross-role to gated refuses before consumption
+  ---
+  duration_ms: 21.022631
+  type: 'test'
+  ...
+# Subtest: class drift gated to within-role refuses before consumption
+ok 7 - class drift gated to within-role refuses before consumption
+  ---
+  duration_ms: 18.541143
+  type: 'test'
+  ...
+# Subtest: class drift cross-role to within-role refuses before consumption
+ok 8 - class drift cross-role to within-role refuses before consumption
+  ---
+  duration_ms: 19.631314
+  type: 'test'
+  ...
+# Subtest: class drift within-role to gated refuses before consumption
+ok 9 - class drift within-role to gated refuses before consumption
+  ---
+  duration_ms: 18.222474
+  type: 'test'
+  ...
+# Subtest: class drift within-role to cross-role refuses before consumption
+ok 10 - class drift within-role to cross-role refuses before consumption
+  ---
+  duration_ms: 17.905388
+  type: 'test'
+  ...
+# Subtest: message.send consumes approval and prevents a later send or authorize
+ok 11 - message.send consumes approval and prevents a later send or authorize
+  ---
+  duration_ms: 20.400932
+  type: 'test'
+  ...
+# Subtest: role.revoke consumes approval and prevents a later revoke or authorize
+ok 12 - role.revoke consumes approval and prevents a later revoke or authorize
+  ---
+  duration_ms: 22.298188
+  type: 'test'
+  ...
+1..12
+# tests 12
+# suites 0
+# pass 12
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 330.529971

agents/magica/work/queue-285/gate/bus/spec-migration.test.mjs.log

@@ -0,0 +1,16 @@
+TAP version 13
+# Subtest: 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
+ok 1 - 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
+  ---
+  duration_ms: 90.395948
+  type: 'test'
+  ...
+1..1
+# tests 1
+# suites 0
+# pass 1
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 155.354393

agents/magica/work/queue-285/gate/bus/spec-review.test.mjs.log

@@ -0,0 +1,82 @@
+TAP version 13
+# Subtest: a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
+ok 1 - a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
+  ---
+  duration_ms: 127.988885
+  type: 'test'
+  ...
+# Subtest: no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
+ok 2 - no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
+  ---
+  duration_ms: 133.106454
+  type: 'test'
+  ...
+# Subtest: a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
+ok 3 - a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
+  ---
+  duration_ms: 66.261911
+  type: 'test'
+  ...
+# Subtest: a business without a pm or a cto saves the spec and sends nothing
+ok 4 - a business without a pm or a cto saves the spec and sends nothing
+  ---
+  duration_ms: 58.186501
+  type: 'test'
+  ...
+# Subtest: a notice that cannot be stored answers outcome-unknown, and the commit stands
+ok 5 - a notice that cannot be stored answers outcome-unknown, and the commit stands
+  ---
+  duration_ms: 68.126595
+  type: 'test'
+  ...
+# Subtest: a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
+ok 6 - a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
+  ---
+  duration_ms: 75.523138
+  type: 'test'
+  ...
+# Subtest: with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
+ok 7 - with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
+  ---
+  duration_ms: 69.894864
+  type: 'test'
+  ...
+# Subtest: within the notice's project the relay lands in the user's most recently opened thread
+ok 8 - within the notice's project the relay lands in the user's most recently opened thread
+  ---
+  duration_ms: 74.638592
+  type: 'test'
+  ...
+# Subtest: a more recently opened thread in another project does not take the relay
+ok 9 - a more recently opened thread in another project does not take the relay
+  ---
+  duration_ms: 71.452685
+  type: 'test'
+  ...
+# Subtest: a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
+ok 10 - a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
+  ---
+  duration_ms: 78.28336
+  type: 'test'
+  ...
+# Subtest: a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
+ok 11 - a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
+  ---
+  duration_ms: 75.398448
+  type: 'test'
+  ...
+# Subtest: the bus receives nothing: a reply to a notice addressed to _bus is refused
+ok 12 - the bus receives nothing: a reply to a notice addressed to _bus is refused
+  ---
+  duration_ms: 68.108541
+  type: 'test'
+  ...
+1..12
+# tests 12
+# suites 0
+# pass 12
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1044.288469

agents/magica/work/queue-285/gate/bus/spec-socket.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: real socket awaits spec reads, record writes and cited raises; other requests still return normally
+ok 1 - real socket awaits spec reads, record writes and cited raises; other requests still return normally
+  ---
+  duration_ms: 109.228566
+  type: 'test'
+  ...
+# Subtest: real socket preserves asynchronous refusal codes and disconnects its transient proof
+ok 2 - real socket preserves asynchronous refusal codes and disconnects its transient proof
+  ---
+  duration_ms: 62.722234
+  type: 'test'
+  ...
+# Subtest: two real socket writes to one repository yield one commit and one project-busy refusal
+ok 3 - two real socket writes to one repository yield one commit and one project-busy refusal
+  ---
+  duration_ms: 63.935486
+  type: 'test'
+  ...
+# Subtest: client disconnect during await tolerates late reply
+ok 4 - client disconnect during await tolerates late reply
+  ---
+  duration_ms: 61.857055
+  type: 'test'
+  ...
+# Subtest: client disconnect during await tolerates late refusal
+ok 5 - client disconnect during await tolerates late refusal
+  ---
+  duration_ms: 44.342334
+  type: 'test'
+  ...
+# Subtest: N-a: slow admitted record.write returns its committed result after the idle deadline
+ok 6 - N-a: slow admitted record.write returns its committed result after the idle deadline
+  ---
+  duration_ms: 213.952861
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 629.247053

agents/magica/work/queue-285/gate/bus/spec.test.mjs.log

@@ -0,0 +1,34 @@
+TAP version 13
+# Subtest: current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
+ok 1 - current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
+  ---
+  duration_ms: 96.830639
+  type: 'test'
+  ...
+# Subtest: stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
+ok 2 - stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
+  ---
+  duration_ms: 101.715858
+  type: 'test'
+  ...
+# Subtest: uncited raises retain their synchronous path and spec read is available to any held role in its business
+ok 3 - uncited raises retain their synchronous path and spec read is available to any held role in its business
+  ---
+  duration_ms: 46.911584
+  type: 'test'
+  ...
+# Subtest: record writes bind the session author, require authority and refuse spec and impersonation paths
+ok 4 - record writes bind the session author, require authority and refuse spec and impersonation paths
+  ---
+  duration_ms: 54.362423
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 371.868184

agents/magica/work/queue-285/gate/bus/staff-request.test.mjs.log

@@ -0,0 +1,70 @@
+TAP version 13
+# Subtest: REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
+ok 1 - REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
+  ---
+  duration_ms: 92.507328
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
+ok 2 - REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
+  ---
+  duration_ms: 100.814643
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: a pm without message.send is refused like any other gated action
+ok 3 - REQ-COS-1: a pm without message.send is refused like any other gated action
+  ---
+  duration_ms: 56.220592
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
+ok 4 - REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
+  ---
+  duration_ms: 143.171044
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
+ok 5 - REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
+  ---
+  duration_ms: 134.927188
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
+ok 6 - REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
+  ---
+  duration_ms: 134.41351
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
+ok 7 - REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
+  ---
+  duration_ms: 79.132154
+  type: 'test'
+  ...
+# Subtest: REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
+ok 8 - REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
+  ---
+  duration_ms: 219.325023
+  type: 'test'
+  ...
+# Subtest: a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
+ok 9 - a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
+  ---
+  duration_ms: 152.699478
+  type: 'test'
+  ...
+# Subtest: REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
+ok 10 - REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
+  ---
+  duration_ms: 89.09922
+  type: 'test'
+  ...
+1..10
+# tests 10
+# suites 0
+# pass 10
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1278.843559

agents/magica/work/queue-285/gate/bus/state.test.mjs.log

@@ -0,0 +1,58 @@
+TAP version 13
+# Subtest: a business that never switched launches reads allowed with no time and no event
+ok 1 - a business that never switched launches reads allowed with no time and no event
+  ---
+  duration_ms: 24.853961
+  type: 'test'
+  ...
+# Subtest: launches revoked and then restored read allowed, with the restore time and event id
+ok 2 - launches revoked and then restored read allowed, with the restore time and event id
+  ---
+  duration_ms: 14.215993
+  type: 'test'
+  ...
+# Subtest: a task closed on the tracker leaves the open list, and total counts the open ones
+ok 3 - a task closed on the tracker leaves the open list, and total counts the open ones
+  ---
+  duration_ms: 15.087952
+  type: 'test'
+  ...
+# Subtest: a tombstone is not open
+ok 4 - a tombstone is not open
+  ---
+  duration_ms: 12.475878
+  type: 'test'
+  ...
+# Subtest: the open list stops at the cap and says so; total still counts every open task
+ok 5 - the open list stops at the cap and says so; total still counts every open task
+  ---
+  duration_ms: 14.614274
+  type: 'test'
+  ...
+# Subtest: a role and a reader session read state; arguments, and an unbound cap, refuse
+ok 6 - a role and a reader session read state; arguments, and an unbound cap, refuse
+  ---
+  duration_ms: 13.054829
+  type: 'test'
+  ...
+# Subtest: a human session reads the same state, with the same cap
+ok 7 - a human session reads the same state, with the same cap
+  ---
+  duration_ms: 16.018199
+  type: 'test'
+  ...
+# Subtest: reading state writes nothing: every table keeps its row count
+ok 8 - reading state writes nothing: every table keeps its row count
+  ---
+  duration_ms: 15.293874
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 201.769812

agents/magica/work/queue-285/gate/bus/store.test.mjs.log

@@ -0,0 +1,52 @@
+TAP version 13
+# Subtest: creates private WAL store and excludes a second writer until explicit close
+ok 1 - creates private WAL store and excludes a second writer until explicit close
+  ---
+  duration_ms: 11.884907
+  type: 'test'
+  ...
+# Subtest: rollback is atomic and schema metadata is checked against trusted DDL, not just itself
+ok 2 - rollback is atomic and schema metadata is checked against trusted DDL, not just itself
+  ---
+  duration_ms: 11.629264
+  type: 'test'
+  ...
+# Subtest: existing empty database and symlink runtime directory refuse, never initialize over damage
+ok 3 - existing empty database and symlink runtime directory refuse, never initialize over damage
+  ---
+  duration_ms: 11.876703
+  type: 'test'
+  ...
+# Subtest: crash during a transaction recovers no partial event after explicit fixture-only lock removal
+ok 4 - crash during a transaction recovers no partial event after explicit fixture-only lock removal
+  ---
+  duration_ms: 62.883714
+  type: 'test'
+  ...
+# Subtest: writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
+ok 5 - writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
+  ---
+  duration_ms: 9.224663
+  type: 'test'
+  ...
+# Subtest: async transactions refuse before invoking their function
+ok 6 - async transactions refuse before invoking their function
+  ---
+  duration_ms: 7.164541
+  type: 'test'
+  ...
+# Subtest: usage_records refuses non-canonical timestamps atomically
+ok 7 - usage_records refuses non-canonical timestamps atomically
+  ---
+  duration_ms: 8.082585
+  type: 'test'
+  ...
+1..7
+# tests 7
+# suites 0
+# pass 7
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 188.497074

agents/magica/work/queue-285/gate/bus/task-page.test.mjs.log

@@ -0,0 +1,46 @@
+TAP version 13
+# Subtest: the session default fits under the reply cap and pages to the end with next
+ok 1 - the session default fits under the reply cap and pages to the end with next
+  ---
+  duration_ms: 114.014536
+  type: 'test'
+  ...
+# Subtest: the short form: no description, assignees by role, every listed key
+ok 2 - the short form: no description, assignees by role, every listed key
+  ---
+  duration_ms: 72.032682
+  type: 'test'
+  ...
+# Subtest: each filter, alone and together, and total counts every match
+ok 3 - each filter, alone and together, and total counts every match
+  ---
+  duration_ms: 142.808336
+  type: 'test'
+  ...
+# Subtest: task_ref reads one task in full, as the whole board has it
+ok 4 - task_ref reads one task in full, as the whole board has it
+  ---
+  duration_ms: 89.346269
+  type: 'test'
+  ...
+# Subtest: no arguments is the read the Console and mosaic make, unchanged
+ok 5 - no arguments is the read the Console and mosaic make, unchanged
+  ---
+  duration_ms: 77.157628
+  type: 'test'
+  ...
+# Subtest: an unknown argument or a bad value refuses invalid-request
+ok 6 - an unknown argument or a bad value refuses invalid-request
+  ---
+  duration_ms: 296.078284
+  type: 'test'
+  ...
+1..6
+# tests 6
+# suites 0
+# pass 6
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 875.378823

agents/magica/work/queue-285/gate/bus/task-read.test.mjs.log

@@ -0,0 +1,28 @@
+TAP version 13
+# Subtest: tasks rows carry priority and requirement for every session that reads tasks
+ok 1 - tasks rows carry priority and requirement for every session that reads tasks
+  ---
+  duration_ms: 46.060009
+  type: 'test'
+  ...
+# Subtest: the read model rebuilds from the ledger: a reopened bus and each trail give the same values
+ok 2 - the read model rebuilds from the ledger: a reopened bus and each trail give the same values
+  ---
+  duration_ms: 38.625836
+  type: 'test'
+  ...
+# Subtest: an empty business and one with snapshots but no task.created read cleanly
+ok 3 - an empty business and one with snapshots but no task.created read cleanly
+  ---
+  duration_ms: 10.365394
+  type: 'test'
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 3
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 167.22348

agents/magica/work/queue-285/gate/bus/tasks.test.mjs.log

@@ -0,0 +1,64 @@
+TAP version 13
+# Subtest: recordTask keeps sync reads and a role write apart
+ok 1 - recordTask keeps sync reads and a role write apart
+  ---
+  duration_ms: 32.291615
+  type: 'test'
+  ...
+# Subtest: read_at must be one canonical UTC format, so the projection compares strings safely
+ok 2 - read_at must be one canonical UTC format, so the projection compares strings safely
+  ---
+  duration_ms: 9.749087
+  type: 'test'
+  ...
+# Subtest: a bad entry refuses the whole record
+ok 3 - a bad entry refuses the whole record
+  ---
+  duration_ms: 9.920013
+  type: 'test'
+  ...
+# Subtest: taskView reads the projection for one business
+ok 4 - taskView reads the projection for one business
+  ---
+  duration_ms: 12.236337
+  type: 'test'
+  ...
+# Subtest: requestTask hands only a holder and a task verb to the handler, and records refusals
+ok 5 - requestTask hands only a holder and a task verb to the handler, and records refusals
+  ---
+  duration_ms: 23.173468
+  type: 'test'
+  ...
+# Subtest: the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
+ok 6 - the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
+  ---
+  duration_ms: 300.213754
+  type: 'test'
+  ...
+# Subtest: without an adapter the server refuses every task verb
+ok 7 - without an adapter the server refuses every task verb
+  ---
+  duration_ms: 41.015793
+  type: 'test'
+  ...
+# Subtest: the runtime refuses an invalid adapter and closes a valid one
+ok 8 - the runtime refuses an invalid adapter and closes a valid one
+  ---
+  duration_ms: 50.467871
+  type: 'test'
+  ...
+# Subtest: the process loads the S3 adapter from plain-data trackers
+ok 9 - the process loads the S3 adapter from plain-data trackers
+  ---
+  duration_ms: 243.013357
+  type: 'test'
+  ...
+1..9
+# tests 9
+# suites 0
+# pass 9
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 830.235689

agents/magica/work/queue-285/gate/bus/tester-threads.test.mjs.log

@@ -0,0 +1,100 @@
+TAP version 13
+# Subtest: row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
+ok 1 - row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
+  ---
+  duration_ms: 35.979213
+  type: 'test'
+  ...
+# Subtest: row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
+ok 2 - row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
+  ---
+  duration_ms: 17.968372
+  type: 'test'
+  ...
+# Subtest: row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
+ok 3 - row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
+  ---
+  duration_ms: 14.662839
+  type: 'test'
+  ...
+# Subtest: row 177 T3: an assistant that would not hear the human refuses the tester too
+ok 4 - row 177 T3: an assistant that would not hear the human refuses the tester too
+  ---
+  duration_ms: 13.349224
+  type: 'test'
+  ...
+# Subtest: row 177 T4: the tester thread run answers the tester, never the human
+ok 5 - row 177 T4: the tester thread run answers the tester, never the human
+  ---
+  duration_ms: 27.308895
+  type: 'test'
+  ...
+# Subtest: row 177 T5: each stop revokes only its own threads, recorded by its own actor
+ok 6 - row 177 T5: each stop revokes only its own threads, recorded by its own actor
+  ---
+  duration_ms: 20.244143
+  type: 'test'
+  ...
+# Subtest: row 177 T5: the human stop never ends a tester run
+ok 7 - row 177 T5: the human stop never ends a tester run
+  ---
+  duration_ms: 15.017796
+  type: 'test'
+  ...
+# Subtest: row 177 T6: a business whose human is tester refuses invalid-business
+ok 8 - row 177 T6: a business whose human is tester refuses invalid-business
+  ---
+  duration_ms: 9.500037
+  type: 'test'
+  ...
+# Subtest: row 177 T7: the human trail shows a tester thread message as the tester
+ok 9 - row 177 T7: the human trail shows a tester thread message as the tester
+  ---
+  duration_ms: 18.681979
+  type: 'test'
+  ...
+# Subtest: row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
+ok 10 - row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
+  ---
+  duration_ms: 19.116027
+  type: 'test'
+  ...
+# Subtest: row 177 T8: a tester-thread raise routed to the arbiter stays allowed
+ok 11 - row 177 T8: a tester-thread raise routed to the arbiter stays allowed
+  ---
+  duration_ms: 15.581525
+  type: 'test'
+  ...
+# Subtest: row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
+ok 12 - row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
+  ---
+  duration_ms: 17.569161
+  type: 'test'
+  ...
+# Subtest: row 182 T9: a tester reply into its own thread lands there
+ok 13 - row 182 T9: a tester reply into its own thread lands there
+  ---
+  duration_ms: 17.583589
+  type: 'test'
+  ...
+# Subtest: row 182 T9: the chief's reply up a chain into a tester's thread lands there
+ok 14 - row 182 T9: the chief's reply up a chain into a tester's thread lands there
+  ---
+  duration_ms: 20.75166
+  type: 'test'
+  ...
+# Subtest: row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
+ok 15 - row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
+  ---
+  duration_ms: 19.657996
+  type: 'test'
+  ...
+1..15
+# tests 15
+# suites 0
+# pass 15
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 356.736022

agents/magica/work/queue-285/gate/bus/tester-writes.test.mjs.log

@@ -0,0 +1,63 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: row 175: TESTER_VERBS and the organization branch tester set are pinned
+ok 1 - row 175: TESTER_VERBS and the organization branch tester set are pinned
+  ---
+  duration_ms: 1.064462
+  type: 'test'
+  ...
+# Subtest: row 175: each of the six reads as the tester deep-equals the human read
+ok 2 - row 175: each of the six reads as the tester deep-equals the human read
+  ---
+  duration_ms: 78.503549
+  type: 'test'
+  ...
+# Subtest: row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
+ok 3 - row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
+  ---
+  duration_ms: 71.663579
+  type: 'test'
+  ...
+# Subtest: row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
+ok 4 - row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
+  ---
+  duration_ms: 60.738463
+  type: 'test'
+  ...
+# Subtest: row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
+ok 5 - row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
+  ---
+  duration_ms: 60.904038
+  type: 'test'
+  ...
+# Subtest: row 175: W4 as the tester writes by tester and keeps every name check
+ok 6 - row 175: W4 as the tester writes by tester and keeps every name check
+  ---
+  duration_ms: 19.013292
+  type: 'test'
+  ...
+# Subtest: row 175: W6 as the tester records created_by tester; the human records the human
+ok 7 - row 175: W6 as the tester records created_by tester; the human records the human
+  ---
+  duration_ms: 12.638177
+  type: 'test'
+  ...
+# Subtest: row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
+ok 8 - row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
+  ---
+  duration_ms: 47.549587
+  type: 'test'
+  ...
+1..8
+# tests 8
+# suites 0
+# pass 8
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 465.587546

agents/magica/work/queue-285/gate/bus/tester.test.mjs.log

@@ -0,0 +1,94 @@
+TAP version 13
+# Subtest: the tester binds only when the business sets bus.tester to exactly true
+ok 1 - the tester binds only when the business sets bus.tester to exactly true
+  ---
+  duration_ms: 91.899234
+  type: 'test'
+  ...
+# Subtest: a business may not name a role tester, so the tester address is never a role
+ok 2 - a business may not name a role tester, so the tester address is never a role
+  ---
+  duration_ms: 22.459037
+  type: 'test'
+  ...
+# Subtest: every verb outside the tester list refuses tester-refused and is recorded against the tester
+ok 3 - every verb outside the tester list refuses tester-refused and is recorded against the tester
+  ---
+  duration_ms: 39.375495
+  type: 'test'
+  ...
+# Subtest: a tester message is from tester, needs no prefix, and writes no human.input or authority
+ok 4 - a tester message is from tester, needs no prefix, and writes no human.input or authority
+  ---
+  duration_ms: 16.78048
+  type: 'test'
+  ...
+# Subtest: a tester message to a role no run holds refuses tester-target-not-running and stores nothing
+ok 5 - a tester message to a role no run holds refuses tester-target-not-running and stores nothing
+  ---
+  duration_ms: 13.335004
+  type: 'test'
+  ...
+# Subtest: a tester message is refused while the run is only launched, and routes once it claims
+ok 6 - a tester message is refused while the run is only launched, and routes once it claims
+  ---
+  duration_ms: 14.772012
+  type: 'test'
+  ...
+# Subtest: a human message to a role no run holds still waits and tells launch.by
+ok 7 - a human message to a role no run holds still waits and tells launch.by
+  ---
+  duration_ms: 12.842306
+  type: 'test'
+  ...
+# Subtest: a role answers a tester only in reply to a tester message, and the answer never reaches the human
+ok 8 - a role answers a tester only in reply to a tester message, and the answer never reaches the human
+  ---
+  duration_ms: 24.056725
+  type: 'test'
+  ...
+# Subtest: the tester reads the human views a reader reads
+ok 9 - the tester reads the human views a reader reads
+  ---
+  duration_ms: 26.435408
+  type: 'test'
+  ...
+# Subtest: tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
+ok 10 - tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
+  ---
+  duration_ms: 1.110431
+  type: 'test'
+  ...
+# Subtest: neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
+ok 11 - neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
+  ---
+  duration_ms: 0.32652
+  type: 'test'
+  ...
+# Subtest: testerNonce reads only the tester's variable and gives null on any read error
+ok 12 - testerNonce reads only the tester's variable and gives null on any read error
+  ---
+  duration_ms: 0.171059
+  type: 'test'
+  ...
+# Subtest: an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
+ok 13 - an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
+  ---
+  duration_ms: 90.568113
+  type: 'test'
+  ...
+# Subtest: tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
+ok 14 - tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
+  ---
+  duration_ms: 1014.44347
+  type: 'test'
+  ...
+1..14
+# tests 14
+# suites 0
+# pass 14
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1479.197933