docs: checkpoint row 332 and hand off after T3 crash

BUILD-LOG.md

@@ -5574,3 +5574,11 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 2026-10-24T19:44:50Z | Sage | Row 224 (#1725, C2-05b, Della on Codex, Dewey) LANDED 5e77cdd09, pushed 19:18Z 10-24. Before: refactor at 7fe32d722. After: Della's 13 commits cherry-picked onto 7fe32d722. Sage gate GREEN 19:16:37Z on 27624aa66 (base 06f507dbc): bus 1011/0, business 283/0, harness 176/0, cli 990/0 plus the allowed FED R7 skip, webui 458/0, all scripts rc 0. Drift between the gated base and 7fe32d722 is only docs/plans/2026-10-24_model-proxy-rows.md, which no test reads (mos-1601 condition); manifest-r9 952482b4 matches the landed tree. Dewey APPROVE c31619 rev 3999. #1725 closed c31623; note rev 4015, done rev 4016. Correction: the first done move passed --evidence and was refused (rc 2, the round closes on its recorded verdicts); rerun without it. Follow-up: Dewey's N3, the old ask helper can't serve a library business, goes to a later row. Not re-pinned.
 
 2026-10-24T19:44:50Z | Sage | Row 328 (#1826, Vikunja 622, old T9 timer race, Fethry on Codex, Boyd and Dewey) LANDED 8bb5b3c73, pushed 19:40Z 10-24. Before: refactor at 5e77cdd09. After: Fethry's 8 commits cherry-picked onto 5e77cdd09 (same patches); T9's second start passes intervalMs 2147483647 (mos-1594), test-only. Under 8x50 concurrent loops M1 (50 ms back) gave 26 expected failures and the fix 400/400. Boyd APPROVE c31621 rev 4002, Dewey APPROVE c31622 rev 4003. Sage gate GREEN 19:38:54Z on 8bb5b3c73 itself, no drift: bus 1011/0, business 283/0, harness 176/0, cli 990/0 plus the allowed FED R7 skip, webui 458/0, every scripts/test-*.sh rc 0 (Dewey N1). Manifest 1e010468. #1826 closed c31625, Vikunja 622 done (comment 1071), note rev 4019, done rev 4020. Not re-pinned.
+
+## 2026-10-24 — row332 P3 proxy harness configuration: investigation/test placement
+
+Fethry at c8a9bcf94, per Sage sage-4292 and mos-1616 pi-route amendment. Before: every managed session receives instance-wide provider credentials; harnesses have no transient per-session proxy context; pi preflight checks only its binary. Intended after: proxy-mode isolation, Claude proxy env, pi private run-local route config using environment references only, credential preflight, and business proxy account settings. Design/test plan: agents/fethry/work/queue-332/BUILD.md. Initial tests placed before production changes. No tests run: Sage CLEAR is required and has not arrived. No success/acceptance claim, live change, or dependency landing. Existing proxy issue number requested from Sage; not yet received.
+
+## 2026-10-24 — row332 crash stop, documentation-only checkpoint
+
+Fethry stopped under Mos mos-1630/Jason's T3 crash instruction. No production implementation, tests, probes, mutants or acceptance runs occurred; Sage CLEAR never arrived. Explicit route metadata per sage-4293 is recorded in agents/fethry/work/queue-332/BUILD.md; full state and resumption boundaries are in HANDOFF.md there. Safe crash checkpoint commits documentation/historical plain-text import manifest only; four unrun tests and the import-audit script remain uncommitted. No long jobs restarted, protected branch changes, merges, live changes or further thread messages.

agents/fethry/work/queue-332/BUILD.md

@@ -0,0 +1,88 @@
+# Row 332 — P3 harness config from the model proxy
+
+## Assignment and boundaries
+
+2026-10-24: Fethry, thread 65673bd9-3bfa-412b-85d5-9b364187d8b6, branch fethry/row332, baseline c8a9bcf94. Sage assignment sage-4292; accepted brief plus full pi-routes amendment c8a9bcf94 (mos-1616). Gladstone first review, Dewey landing review; landing waits for P1/329 and P2/331, rebase on both and Sage's gate. No tests before Sage's CLEAR. No live proxy, host credential directories, real proxy data, management key, cutover, policy edits, or Codex harness changes.
+
+Queue next in canonical checkout returned `nothing` during assignment. Starting row with op fethry-332-start met Sage's queue update lock; retry through the queue only. Root npm ci --ignore-scripts --no-audit --no-fund completed in this worktree (128 packages); no canonical node_modules use.
+
+## Design note (line numbers at c8a9bcf94)
+
+- packages/seat/src/session.mjs:242-247 defines ENV_ALLOW; keep it unchanged. sessionEnv:256-262 gains optional proxy context and drops CLAUDE_CODE_OAUTH_TOKEN, every passed ANTHROPIC_* variable, OPENAI_API_KEY, OPENROUTER_API_KEY and ZAI_API_KEY before adding harness env. Non-proxy results retain current behavior exactly.
+- packages/plugins/harness/claude-code/index.mjs:56-67 preflight accepts the session proxy credential; env:119-126 sets ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN from that context.
+- packages/plugins/harness/pi/index.mjs:33-36 preflight requires its own provider credential or proxy key, never a Claude OAuth token. env:63-70 sets only the session's proxy key as ANTHROPIC_API_KEY and selects the generated provider. Fresh run-local home/.pi/agent/models.json is private (0600; parent directories 0700). Every apiKey is the literal reference $ANTHROPIC_API_KEY; recursively forbid values beginning with !. Nothing stores the key in models.json or a manifest.
+- packages/harness/src/bundle.mjs:313 buildBundle accepts transient proxy context; :379 harness.env call needs it plus run location and launch.models. Context must never be added to session metadata, source digests, or manifest. The run-local file regenerates on each launch.
+- packages/cli/src/launcher.mjs:391,400 preflight, :412 account checks, :529 bundle creation and :592 child env must agree on the same session credential. Coordinate its acquisition with P2; build/test now against the specified { baseUrl, key } stand-in, not a management client or a key-store implementation.
+
+Exact business setting keys remain launch.models.<selection>.provider, launch.models.<selection>.model, launch.account.name and launch.account.credential (launch.mjs:12-24,81-89). Provider already accepts proxy. Proposed account credential sentinel is the literal proxy (add alongside existing uppercase environment-set syntax), with launch.account.name a human-readable id such as proxy. No new fields. Existing provider anthropic selects the Anthropic route, zai selects GLM, and proxy selects the stack-owned GPT route; send this interpretation to Sage before implementation because the brief doesn't specify route encoding for provider proxy.
+
+## Build-time API choice and pinned binary
+
+P1's committed magica/row329 has CLIProxyAPI 8.0.42 in packages/model-proxy/PIN. Use that commit's fetchPinned({dataRoot:<fresh temporary root>}) implementation, copied from Git objects to this seat's temp tooling directory with its relative dependencies and PIN, until P1 lands. Never inspect another seat's worktree/scratch. It fetches only pinned GitHub release assets and checks archive, executable and panel hashes. No production instance config is needed and nothing under a real dataRoot/proxy is read.
+
+After CLEAR, try actual pinned pi requests with both openai-responses and openai-completions through that binary under unshare -rn, against stand-in upstreams with made-up credentials under 24 characters. Record version, API path, safe request fields, response status and turn result. Choose one shape once from those results and hard-code it; no runtime fallback. Real Codex OAuth cannot be simulated as a real authenticated turn: first real Codex turn remains row209 phase A step7. Distinguish the offline compatibility evidence from that deferred real-auth proof.
+
+The separate offline GLM acceptance script (outside scripts/test-*.sh) uses pinned pi and proxy, checks the upstream sees the model id from /v1/models, and records whether thinkingFormat/zaiToolStream-derived fields survive translation. All configs/auth placeholders belong to its fresh temp root.
+
+## Implementation and test sequence
+
+1. Add tests first for env isolation, Claude proxy env and preflight, pi credential refusal and each generated route/file invariant, and business account acceptance. Do not run until CLEAR; first new-test red is reported afterward, old-test red or second red is reported before changing anything.
+2. Implement harness/bundle/env handling against P2's transient interface. Add launcher boundary integration once its exact P2 acquisition seam is agreed. Keep secrets out of session.json and bundle manifests.
+3. With CLEAR, run the offline API-shape probe and GLM turn, then whole touched test files. Before each whole-file run report the list derived by parsing imports and traversing local dependencies; include harness plug-in dynamic loading explicitly. packages/cli/tests/case1-accept.test.mjs remains excluded without Mos approval.
+4. Kill named mutants; restore production source and verify. Record exact output and nice. Use a fresh shell mktemp -d /mnt/storage/scratch/tmp/XXXXXX TMPDIR for each run, absolute nice 19, and timeout -k 10 for each scripts/test-*.sh. No hidden skips; Sage owns the package/script landing gate.
+5. After dependency landings, rebase, complete review and gate stages, update queue only through its CLI, and append session/build receipts. Push only fethry/* when ready for authorized review; no force-push or attribution trailers.
+
+Planned tests:
+- Each forbidden environment variable is absent in proxy mode; all existing allowed env is identical without a proxy; two launches receive distinct own keys and no other agent's key.
+- Claude env has exactly the supplied proxy base URL/auth token; proxy credential satisfies preflight without host upstream credentials.
+- pi refuses no-session-credential for no key or Claude OAuth alone, accepts an own provider key and a proxy key.
+- models.json covers Anthropic anthropic-messages at root URL, GLM openai-completions at /v1, and a stack-owned GPT provider at /v1 with the chosen API; routes use configured model ids.
+- Every apiKey is $ANTHROPIC_API_KEY; no key value occurs in file; recursively no value starts with !; mode 0600 and private parents; next launch uses changed port/models/key reference with no stale content.
+- Business accepts provider proxy and account credential proxy while preserving existing valid and invalid account behavior.
+- Launcher/bundle integration keeps context transient and passes only the launch's own key.
+- Every new refusal code gets a separate test.
+- Offline GLM pinned-pi turn and z.ai compat observation; both GPT API-shape requests recorded with limitations.
+
+Named gate mutants:
+1. Proxy mode still passes CLAUDE_CODE_OAUTH_TOKEN (original brief).
+2. models.json receives the key value instead of $ANTHROPIC_API_KEY (amendment).
+
+No tests have run. API-shape choice is pending evidence, not claimed.
+
+## Progress 22:27Z
+
+Placed initial RED tests (not executed): packages/seat/tests/proxy-session-env.test.mjs and packages/plugins/tests/proxy-harness.test.mjs. These exercise real sessionEnv and loader-loaded harness exports. Production source remains untouched pending the first authorized RED run. Removed no assertions and ran no tests. Correct baseline bundle harness.env line is 376 (not 379 in the initial design note).
+
+Sage reporting attempts fethry-0001 (including same-key retry) and fethry-0002 all returned `T3 GET /api/orchestration/threads/<sage> timed out after 30s`. Delivery is unconfirmed. Queue move retry also met a Sage queue update lock (sage-333-reviewers-1024a); no bypass.
+
+Additional test-first placement: packages/business/tests/proxy-launch.test.mjs covers existing proxy model acceptance, proposed proxy account credential literal, preserved environment account forms, and rejection of mixed/literal credential strings. Pending Sage's route/account interpretation and CLEAR; no production edits or tests run.
+
+## Import audit and queue status
+
+The non-evaluating import audit uses Node vm.SourceTextModule.dependencySpecifiers, not a text-path grep, plus explicit computed-import edges from the plug-in loader to both harness modules. Source: import-run-list.mjs; output: IMPORT-RUN-LIST.txt (211 entries, including the explicitly EXCLUDED case1-accept file). This is a candidate impact list for the planned source changes, not an executed test list. Before a whole-file run, report the actual authorized subset to Sage. Parsing executes no repository modules and runs no tests. The first audit invocation had a path-depth setup error (ENOENT); corrected the audit's own repository root and regenerated successfully.
+
+At 22:28:19Z the canonical start operation returned `queue: only the owner (sage) may start row 332`. Per assignment, wait at least two minutes before repeating this same op. No queue state was edited manually.
+
+## Design correction after D9 re-read
+
+The initial route-encoding proposal (provider proxy for GPT only) is not sufficient: design D9 explicitly defines provider proxy as any model through the instance proxy. Do not implement the earlier proposal. Two viable encodings need resolving before route-dependent tests/production: exact model-id lookup in pinned pi's provider catalogs (no new business fields, but refuses proxy-only aliases/unknown models), or explicit route metadata in launch.models (additive schema, needs Sage to confirm it is within the approved brief). Recommend exact catalog membership if all intended configured model ids are in pinned pi; otherwise ask Sage to define/approve an explicit route field. Never guess by model prefix or silently choose a wire API. Independent env/preflight tests already placed remain valid.
+
+Reporting recovered: fethry-0004 was accepted by t3_send_message at approximately 22:29:51Z. It delivered the D9 route correction, route-encoding/P2-seam question, import-manifest location and no-tests status to Sage. Earlier failed-message deliveries remain unconfirmed.
+
+22:32:18Z: The start retry issued at 22:30:40Z (over two minutes after first owner refusal) also exited 2: `queue: only the owner (sage) may start row 332`. This is an ownership boundary; row was not started and no code/test execution proceeds through it. Sage's assignment must take effect before the same op can succeed. The full design report fethry-0005 again timed out; fethry-0004 is the confirmed delivered report. git diff --check passed; no test, probe, commit or push has run.
+
+## Route ruling accepted — sage-4293, 22:37Z
+
+Sage settled explicit metadata, superseding both initial encoding proposals and the catalog proposal. Exact new setting: launch.models.<selection>.route; permitted values anthropic, glm, codex, required only when provider is proxy. Nonproxy entries still allow provider/model only. Missing route refuses proxy-route-missing; present unknown/nonstring route refuses proxy-route-unknown. Both get independent code assertions; each valid value gets a test using a proxy-only model id absent from any catalog. The GPT route's generated pi provider will be mosaic-proxy-codex, never openai-codex. Its wire API remains a build-time choice after the pinned-binary probe. P2 passes only {baseUrl,key}; no route belongs to that seam.
+
+A key persistence hazard found during source inspection: launcher.mjs:571 writes bundle.env as session.harnessEnv. Adding the key to harness.env must not retain this behavior for credentials. P3 will keep generated key env transient for spawnSession and omit those credential values from serialized harnessEnv. runner.mjs:390 already inherits the spawn environment before applying nonsecret harnessEnv. Test the on-disk session/bundle boundary, not only models.json.
+
+The old launch-settings.test.mjs already uses provider proxy fixtures without route. Update those fixtures to explicit anthropic routes before any full-file run; preserve their existing authorization assertions. This is the new approved validation shape, not permission to loosen tests. No tests have run and no production edits exist.
+
+Additional test-first placement after route ruling: packages/harness/tests/proxy-bundle.test.mjs exercises real buildBundle with explicit provider proxy entries and proxy-only model ids, three generated providers, run-local file mode, environment references, recursive no-! values, no key in bundle files/manifest, fresh model/port/key on next launch. The exact GPT API assertion must be added from the authorized pinned-binary probe before this test file's first run; it deliberately makes no unverified wire-shape claim now. No skip is introduced.
+
+Canonical queue show returned owner sage and after=331 at 22:40Z; it also warned `view unknown` for the rendered table. No repair or queue bypass attempted; wait for Sage's announced batch. Queue metadata identifies shared proxy Gitea issue #1830.
+
+## STOPPED — mos-1630, 2026-10-24T22:48Z
+
+Jason's relayed crash instruction supersedes active work: no long-job restart, commit/push safe documentation only, handoff in this worktree, no other thread messages, then stop. See HANDOFF.md for complete state, next steps, uncommitted tests/audit script, and reruns needed. No tests or probes ever ran; no production implementation exists. Latest design is explicit launch.models route metadata per sage-4293; earlier catalog/GPT-only proposals are superseded. The original 211-entry import manifest predates the fourth new test file and is historical, not run authorization. Full inline resends still hit T3 timeouts. Crash commit will exclude every unrun test and the audit script.

agents/fethry/work/queue-332/HANDOFF.md

@@ -0,0 +1,51 @@
+# STOPPED — row 332 (P3), T3 crash handoff
+
+Stopped on 2026-10-24 under Mos mos-1630, relaying Jason's instruction: do not restart long jobs; commit/push safe work, leave a handoff, then stop. No further thread messages, tests, probes, queue operations, or implementation will run in this session.
+
+## Branch and completed work
+
+- Worktree: /home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332
+- Branch: fethry/row332, based on refactor c8a9bcf94. No implementation commits, rebases, merges or production source edits.
+- Read P3 brief, rules, full pi amendment, gate template, design and named source files. Detailed notes in BUILD.md beside this handoff.
+- Root npm ci --ignore-scripts --no-audit --no-fund completed in this worktree only (128 packages). No canonical node_modules used.
+- Initial test files written before implementation; none executed. Sage has not sent CLEAR. No proxy fetch, binary probe, offline turn, mutant, or suite has run.
+- No real proxy, management key, host auth directory or live instance was accessed. No production service was started/stopped.
+- Canonical queue next returned nothing during the assignment. Queue start op fethry-332-start refused on locks, then owner sage, including a retry after two minutes. Latest completed queue show still had owner sage, state briefed, after 331; it also warned that the rendered table was unknown. Did not repair or bypass it. Sage sage-4293 says an assign/after=none batch is running. Queue metadata identifies shared Gitea issue #1830.
+
+## Latest accepted design
+
+Sage sage-4293 supersedes all earlier route proposals: explicit route metadata, never catalog membership or model-prefix inference. Selected spelling: launch.models.<selection>.route = anthropic | glm | codex, required only with provider proxy. Missing route: proxy-route-missing; unknown/nonstring route: proxy-route-unknown. Other providers keep provider/model-only entries. Proposed launch.account.credential literal proxy; existing name/credential field names retained. GPT generated provider: mosaic-proxy-codex, never openai-codex. GPT wire API is still undecided pending the authorized pinned-binary requests. P2's seam stays exactly { baseUrl, key }.
+
+Important implementation finding: launcher.mjs:571 serializes bundle.env into session.harnessEnv. Harness env will contain the session key in proxy mode, so credentials must instead reach spawnSession through transient environment variables and be omitted from serialized harnessEnv. runner.mjs:390 already inherits the spawn environment. Preserve ENV_ALLOW; filter instance provider variables in proxy mode only.
+
+## Uncommitted work, intentionally left for the next session
+
+These are unrun, incomplete tests/audit code, excluded from the documentation-only crash commit:
+
+- packages/business/tests/proxy-launch.test.mjs — explicit routes and refusal codes, proxy account credential, existing nonproxy/account behavior.
+- packages/plugins/tests/proxy-harness.test.mjs — Claude env/preflight, own-key isolation, pi preflight and OAuth-only refusal.
+- packages/seat/tests/proxy-session-env.test.mjs — instance credential filtering and unchanged nonproxy env.
+- packages/harness/tests/proxy-bundle.test.mjs — real bundle generation, all three providers, key reference/no-key/no-! invariants, file modes and launch freshness. Exact GPT API assertion deliberately pending probe evidence; add before its first run.
+- agents/fethry/work/queue-332/import-run-list.mjs — non-evaluating static import audit using vm.SourceTextModule plus explicit computed loader edges. It ran successfully after correcting its own root-depth setup error. It is not a test runner.
+
+IMPORT-RUN-LIST.txt is a historical 211-entry candidate impact list, generated before proxy-bundle.test.mjs was added. It includes case1-accept as explicitly EXCLUDED (mos-1612). Regenerate the list after resuming and report the actual authorized run list inline before any whole-file run. Do not treat the historical manifest as a current run authorization.
+
+## Reporting status
+
+T3 reporting repeatedly failed during GET with a 30-second timeout. fethry-0004 was confirmed delivered. Some later short numeric keys returned reused:true unexpectedly; do not rely on them as delivery evidence. A row-scoped detailed design resend and the inline 211-line import manifest also timed out, including the manifest's same-key retry. Sage may not have those messages. This handoff and BUILD.md are being pushed so they can be read with git show; no new thread message is sent under mos-1630.
+
+## Next session, after restart authorization
+
+1. Read this handoff/BUILD.md and recover queue state from canonical checkout. Wait for owner fethry and no after, then retry the same start op. Never bypass a refusal.
+2. Recover Sage's slot status. Still NO tests or probes until Sage sends CLEAR. No job needs restarting merely to preserve current state.
+3. Review the four uncommitted test files. Add the pinned-proxy API probe and exact GPT assertion before the first relevant run. Initial RED has not happened; production implementation must follow the authorized first RED.
+4. Rebuild the import-derived run list and send it inline or in a reviewed pushed commit before runs. case1-accept remains off without Mos approval. Existing launch-settings.test.mjs proxy fixtures need explicit route metadata with their authorization assertions preserved; no old-test red has occurred.
+5. Use P1's committed fetchPinned code under an owned fresh temporary root (8.0.42 at the inspected magica/row329 revision), never live proxy assets or another seat's scratch. After CLEAR, try pi's responses and completions requests under unshare -rn against stand-in upstream, record evidence, choose one GPT API at build time. Separately prove offline GLM and record z.ai compat survival. Real Codex auth proof remains row209 phase A step7.
+6. Implement transient P2 context, model validation/route propagation, harness config, preflight, spawn env/serialization separation and tests. Named mutants: OAuth token leak; literal key in models.json. No policy or real credentials involved.
+7. Land only after 329 and 331 land, rebasing on both, Gladstone first review, Dewey landing review and Sage's required gate. No force-push or merge authority is added by the crash instruction.
+
+All future tests use a fresh shell-created short TMPDIR, absolute nice 19, and timeout -k 10 for scripts/test-*.sh. First new-test red is reportable afterward; old-test red or a second red goes to Sage before changes/reruns. No test outcomes are claimed here.
+
+## Crash commit
+
+Only documentation and the historical plain-text import manifest are committed. The final STOPPED reply records the exact pushed commit. The uncommitted files above remain deliberately available in this worktree because they have never run and test-slot authorization has not arrived.

agents/fethry/work/queue-332/IMPORT-RUN-LIST.txt

@@ -0,0 +1,211 @@
+packages/bus/tests/access-revoke.test.mjs
+packages/bus/tests/broker.test.mjs
+packages/bus/tests/channel-proof.test.mjs
+packages/bus/tests/chief-of-staff.test.mjs
+packages/bus/tests/citation-guard.test.mjs
+packages/bus/tests/citation-runtime.test.mjs
+packages/bus/tests/creative.test.mjs
+packages/bus/tests/credential-verbs.test.mjs
+packages/bus/tests/grant-scope-runtime.test.mjs
+packages/bus/tests/host-run.test.mjs
+packages/bus/tests/land.test.mjs
+packages/bus/tests/library-credential.test.mjs
+packages/bus/tests/library-lookups.test.mjs
+packages/bus/tests/library-sync.test.mjs
+packages/bus/tests/library.test.mjs
+packages/bus/tests/lifecycle-revoke.test.mjs
+packages/bus/tests/limit-checks.test.mjs
+packages/bus/tests/messages.test.mjs
+packages/bus/tests/processing-runtime.test.mjs
+packages/bus/tests/project-runtime.test.mjs
+packages/bus/tests/reload.test.mjs
+packages/bus/tests/tasks.test.mjs
+packages/bus/tests/tester-writes.test.mjs
+packages/bus/tests/tester.test.mjs
+packages/bus/tests/usage-runtime.test.mjs
+packages/bus/tests/usage.test.mjs
+packages/bus/tests/workflow-roles.test.mjs
+packages/business/tests/access-levels.test.mjs
+packages/business/tests/access.test.mjs
+packages/business/tests/agent-identity.test.mjs
+packages/business/tests/assistant.test.mjs
+packages/business/tests/business.test.mjs
+packages/business/tests/case1-business-file.test.mjs
+packages/business/tests/chief-library-credentials.test.mjs
+packages/business/tests/chief-of-staff.test.mjs
+packages/business/tests/cli.test.mjs
+packages/business/tests/credentials.test.mjs
+packages/business/tests/csuite.test.mjs
+packages/business/tests/grant-scope.test.mjs
+packages/business/tests/hard-waits.test.mjs
+packages/business/tests/hosts.test.mjs
+packages/business/tests/instance-credential-transitions.test.mjs
+packages/business/tests/instance-settings.test.mjs
+packages/business/tests/launch-settings.test.mjs
+packages/business/tests/library-projects-protected.test.mjs
+packages/business/tests/library-seats.test.mjs
+packages/business/tests/lifecycle-settings.test.mjs
+packages/business/tests/optional-tracker.test.mjs
+packages/business/tests/plugin-settings.test.mjs
+packages/business/tests/project-repo.test.mjs
+packages/business/tests/project.test.mjs
+packages/business/tests/proxy-launch.test.mjs
+packages/business/tests/record-grants.test.mjs
+packages/business/tests/reply-limits.test.mjs
+packages/business/tests/resolve.test.mjs
+packages/business/tests/role.test.mjs
+packages/business/tests/token-limit-settings.test.mjs
+packages/business/tests/vars.test.mjs
+packages/business/tests/workflow-roles.test.mjs
+packages/cli/tests/access-boot.test.mjs
+packages/cli/tests/access.test.mjs
+packages/cli/tests/app.test.mjs
+packages/cli/tests/boot-status.test.mjs
+EXCLUDED (mos-1612) packages/cli/tests/case1-accept.test.mjs
+packages/cli/tests/case1-hostcheck.test.mjs
+packages/cli/tests/case2-install.test.mjs
+packages/cli/tests/case2-persona-import.test.mjs
+packages/cli/tests/case2-unit.test.mjs
+packages/cli/tests/channel-cli.test.mjs
+packages/cli/tests/channel-recovery.test.mjs
+packages/cli/tests/cli.test.mjs
+packages/cli/tests/compactions-launch.test.mjs
+packages/cli/tests/config.test.mjs
+packages/cli/tests/credentials.test.mjs
+packages/cli/tests/federation-acceptance.test.mjs
+packages/cli/tests/follow.test.mjs
+packages/cli/tests/git-socket.test.mjs
+packages/cli/tests/grants-scope.test.mjs
+packages/cli/tests/grants.test.mjs
+packages/cli/tests/host.test.mjs
+packages/cli/tests/hosts.test.mjs
+packages/cli/tests/idle-stop-race.test.mjs
+packages/cli/tests/instances.test.mjs
+packages/cli/tests/launch-account.test.mjs
+packages/cli/tests/launch-limit-checks.test.mjs
+packages/cli/tests/launch-limits.test.mjs
+packages/cli/tests/launch-routes.test.mjs
+packages/cli/tests/launcher.test.mjs
+packages/cli/tests/lifecycle.test.mjs
+packages/cli/tests/limits-tokens.test.mjs
+packages/cli/tests/limits.test.mjs
+packages/cli/tests/mark-read.test.mjs
+packages/cli/tests/names.test.mjs
+packages/cli/tests/notifier.test.mjs
+packages/cli/tests/optional-tracker.test.mjs
+packages/cli/tests/other-tree.test.mjs
+packages/cli/tests/processing-cli.test.mjs
+packages/cli/tests/project-name-repo.test.mjs
+packages/cli/tests/project.test.mjs
+packages/cli/tests/publish-socket.test.mjs
+packages/cli/tests/reply-limits.test.mjs
+packages/cli/tests/revoke-window.test.mjs
+packages/cli/tests/session-clear.test.mjs
+packages/cli/tests/session-cli.test.mjs
+packages/cli/tests/session-launch.test.mjs
+packages/cli/tests/stack-copy.test.mjs
+packages/cli/tests/stack-instances.test.mjs
+packages/cli/tests/tester-reads.test.mjs
+packages/cli/tests/tester-threads.test.mjs
+packages/cli/tests/tester.test.mjs
+packages/cli/tests/thread-cli.test.mjs
+packages/cli/tests/thread-launch.test.mjs
+packages/cli/tests/thread-revoke.test.mjs
+packages/cli/tests/trackers-boot.test.mjs
+packages/cli/tests/transport.test.mjs
+packages/cli/tests/usage.test.mjs
+packages/cli/tests/verbs.test.mjs
+packages/control-board/tests/creative-hidden.test.mjs
+packages/control-board/tests/discord.test.mjs
+packages/control-board/tests/serve.test.mjs
+packages/conversation/tests/flows.test.mjs
+packages/harness/tests/bundle.test.mjs
+packages/harness/tests/claude-gate.test.mjs
+packages/harness/tests/claude-session.test.mjs
+packages/harness/tests/creative.test.mjs
+packages/harness/tests/gate.test.mjs
+packages/harness/tests/git-tools.test.mjs
+packages/harness/tests/library-tools.test.mjs
+packages/harness/tests/mcp-server.test.mjs
+packages/harness/tests/pi-session.test.mjs
+packages/harness/tests/raise-domain.test.mjs
+packages/harness/tests/runner.test.mjs
+packages/harness/tests/skills.test.mjs
+packages/harness/tests/spec-tools.test.mjs
+packages/harness/tests/tools.test.mjs
+packages/plugins/tests/channel.test.mjs
+packages/plugins/tests/harness-compactions.test.mjs
+packages/plugins/tests/harness.test.mjs
+packages/plugins/tests/loader.test.mjs
+packages/plugins/tests/proxy-harness.test.mjs
+packages/plugins/tests/searxng.test.mjs
+packages/processing-control/tests/task.test.mjs
+packages/seat/tests/compactions-budget.test.mjs
+packages/seat/tests/compactions-ledger.test.mjs
+packages/seat/tests/compactions.test.mjs
+packages/seat/tests/proxy-session-env.test.mjs
+packages/seat/tests/sandbox.test.mjs
+packages/seat/tests/session-workspace.test.mjs
+packages/seat/tests/session.test.mjs
+packages/tasks/tests/fields.test.mjs
+packages/webui/tests/agents-browser.test.mjs
+packages/webui/tests/agents.test.mjs
+packages/webui/tests/assistant.test.mjs
+packages/webui/tests/board-held.test.mjs
+packages/webui/tests/browser-edge.test.mjs
+packages/webui/tests/browser.test.mjs
+packages/webui/tests/bus-browser.test.mjs
+packages/webui/tests/bus.test.mjs
+packages/webui/tests/channel-chat.test.mjs
+packages/webui/tests/chat-browser.test.mjs
+packages/webui/tests/chat-instances.test.mjs
+packages/webui/tests/chat-replies-browser.test.mjs
+packages/webui/tests/chat.test.mjs
+packages/webui/tests/conversation.test.mjs
+packages/webui/tests/decide-browser.test.mjs
+packages/webui/tests/decide-sso.test.mjs
+packages/webui/tests/discord.test.mjs
+packages/webui/tests/docs-browser.test.mjs
+packages/webui/tests/editor-browser.test.mjs
+packages/webui/tests/editor.test.mjs
+packages/webui/tests/granted-user.test.mjs
+packages/webui/tests/history-return-flow.test.mjs
+packages/webui/tests/instances-browser.test.mjs
+packages/webui/tests/instances.test.mjs
+packages/webui/tests/library-cli.test.mjs
+packages/webui/tests/library-routes.test.mjs
+packages/webui/tests/limits-browser.test.mjs
+packages/webui/tests/limits-route.test.mjs
+packages/webui/tests/messages.test.mjs
+packages/webui/tests/pinned-copy.test.mjs
+packages/webui/tests/preview.test.mjs
+packages/webui/tests/processing-browser.test.mjs
+packages/webui/tests/processing.test.mjs
+packages/webui/tests/project-file.test.mjs
+packages/webui/tests/proof-cli.test.mjs
+packages/webui/tests/proof.test.mjs
+packages/webui/tests/reads.test.mjs
+packages/webui/tests/relaunch.test.mjs
+packages/webui/tests/return-flow.test.mjs
+packages/webui/tests/room-browser.test.mjs
+packages/webui/tests/room-http.test.mjs
+packages/webui/tests/routes-browser.test.mjs
+packages/webui/tests/routes.test.mjs
+packages/webui/tests/send-browser.test.mjs
+packages/webui/tests/send.test.mjs
+packages/webui/tests/serve.test.mjs
+packages/webui/tests/settings-form.test.mjs
+packages/webui/tests/settings-write.test.mjs
+packages/webui/tests/shell.test.mjs
+packages/webui/tests/sso-browser.test.mjs
+packages/webui/tests/sso.test.mjs
+packages/webui/tests/tester-browser.test.mjs
+packages/webui/tests/tester-cli.test.mjs
+packages/webui/tests/tester-listener.test.mjs
+packages/webui/tests/thread-claims-browser.test.mjs
+packages/webui/tests/thread-claims.test.mjs
+packages/webui/tests/thread-sharing.test.mjs
+packages/webui/tests/usage-browser.test.mjs
+packages/webui/tests/usage.test.mjs
+packages/webui/tests/user-option-swap.test.mjs
+packages/webui/tests/views.test.mjs

docs/SESSIONS.md

@@ -1687,3 +1687,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24 | Fethry14f80e3c | Row328 T9 race acceptance evidence | sage4214 on06c57a7db:400 concurrent M1 attempts yield26 expected failures, fixed400/400, whole file6/6; exact restoration/clean checks and process sweep empty. All801 receipts/nice/load preserved. Manifest1e010468 one approved+4/-3 old test, no assertion/product change. Earlier aborted and serial non-repro receipts separate. Review handoff Boyd/Dewey, Sage landing gate pending.
 
 2026-10-24 | Sage 1ef1e4f8 | Landings 257, 266, 224, 328; model-proxy rows 329-333 filed | 257 73692e1bb, 266 3e5041b43, 224 5e77cdd09, 328 8bb5b3c73 landed on GREEN gates. Rows 329-333 briefed from 7fe32d722 (mos-1600/1601); 330 blocked on Jason's subdomain answer (mos-1602). Magica holds the slot for 329's builder gate.
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 P3 proxy harness configuration at c8a9bcf94 | Started recovery and design; npm ci in isolated worktree; tests held for Sage CLEAR; no live proxy or credentials accessed.
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 crash stop (mos-1630) | Documentation-only handoff on fethry/row332; four unrun test files and import audit script left uncommitted; no tests/probes/production edits; no jobs restarted or other threads messaged.