row 252: mos-1321, reword the shell.test write-boundary comment so Approve and Deny is the one decision control; BUILD.md records the ruling and its channel-proof review condition

sessions and session_defaults are new and append-only. thread_claims, message_threads and
thread_opens are rebuilt in place with a session column, and thread_claims gains a generation
counted from claim rows. Each existing thread gets a default session with the thread's id; new
threads get a random one. Holder, per-run, release and delivery triggers key on the session,
and two id triggers keep session and thread ids apart (Duckworth checks 1-7, duckworth-0106).

The broker binds a thread run to a session (the default when the record names none), and
thread.open, thread.send and thread.messages take an optional session. New verbs session.list
and session.create (idempotent on op). Tests: sessions.test.mjs for T1 bus half, T2 and T7 with
a pinned 3k fixture; count, version and verb pins; hand-made test threads write the legacy
default session.

Built on row 236 (8f51900b5), which takes 3j-3k, so this step is 3k-3l by landing order
(row264 Q2, sage-2412). The op values are legacy-3l and migration-3l. gitea-migration.test reads
its store after both steps. Not run yet: every run waits for Sage's CLEAR.

BUILD-LOG.md

@@ -5303,3 +5303,11 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 ### 2026-10-22 | Gander | row278 gate run3
 
 Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+
+2026-10-22 11:29:09 UTC | Rocko | V502 carry/rerun on980cec88c: source407c8d7be and packet04a86cf33 match approved8e3c6a79b/9bf4683c6 patch-ids, no conflicts. Dewey0834 carry conditioned on rerun, satisfied under sage2616: stop-run13,processingHTTP6,bustasks9 allgreen (Node28/28),Python4/4,0skips/timeouts. Manifest5758d699,source5/5restored,cwdsweep[]. Doc rerun packet6af85df4b explicitly pushed to rocko/vikunja502-980c-20261022; no live action.
+
+2026-10-22 11:30:17 UTC | Sage | Vikunja 502 (row 191 follow-up, no queue row) LANDED 6af85df4b, a fast-forward from 980cec88c. Before: the processing failure diagnostics and cleanup in stop-run, processing HTTP and bus tasks tests were Dewey-approved on the pre-194 base only (8e3c6a79b/9bf4683c6). After: Rocko's picks 407c8d7be/04a86cf33 carry the same patch-ids (37135ebe/0dbcda54), plus a doc-only rerun record 6af85df4b. The rerun on the new base was green: stop-run 13/13, processing HTTP 6/6, bus tasks 9/9, Python 4/4, 0 skips. Dewey carried the approve (dewey-0836). mosaic-task.mjs is unchanged, so N7 (runs suite) didn't trigger. Overlap with in-review rows 13 and 257 was clean. LIVE is still 86f95bb27.
+
+2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
+
+2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.

agents/gizmoduck/work/queue-264/BUILD.md

@@ -0,0 +1,548 @@
+# Row 264 build notes (Gizmoduck)
+
+T1 item 7: independent sessions, compaction counts and clear context. Gitea #1769, Vikunja 463
+(design) and 466 (Claude compaction format, T3's dependency, linked and not built here). Brief:
+docs/plans/2026-10-21_t1-sessions.md, "T1 item 7: independent sessions, compaction counts and clear
+context" (blob ff0be0c79). Reviewer Duckworth, gate owner Sage. Branch gizmoduck/row264 from refactor
+da9555ca2. MVP due 10-27.
+
+The brief pins its code citations at cca206cdc. `git diff --stat cca206cdc da9555ca2` over every cited
+source file is empty, so F1-F11 still hold line for line. Only docs/prd/mosaic-stack.md moved.
+
+## Phase A: what the code has today
+
+- Bus. `threads` binds one `instance` per thread (schema.sql:240-250). `thread_claims` keys on
+  `thread` alone (:251-261), and `message_threads` maps a message to a thread (:262-265). Schema is
+  3j (store.mjs:17). The thread tables first appear in migrations/3d-3e.sql.
+- Launcher. `check()` refuses a second run for the same instance and thread
+  (launcher.mjs:233-240, `registry.running(b.id, instance, thread)`).
+- Seat. `threadStore()` makes one `session/` and one `claude-projects/` per thread
+  (session.mjs:51-74). The registry's running key is business, instance and thread (:215-218).
+- Runner. `stop()` sends TERM to the child group, then KILL after 5 s (runner.mjs:402-414). It has
+  no drain, no idle acknowledgement and no dequeue fence. D7 step 2 needs all three.
+
+## Consumer audit (D9), first pass
+
+`git grep -F` over packages/*/src/* and adapters/* at da9555ca2:
+
+| Name | Files and hits |
+| --- | --- |
+| `thread_claims` | broker.mjs 12, store.mjs 1 |
+| `message_threads` | broker.mjs 9 |
+| `thread_opens` | broker.mjs 4, store.mjs 1 |
+| `threadStore` | launcher.mjs 4, sandbox.mjs 7, session.mjs 3 |
+| `running(` | launcher.mjs 5, session.mjs 1 |
+
+Still to read: the broker holder, agents, end, usage, reply correlation and pending-approval paths
+named in D9, the two adapters (F5), both harness plugins, the conversation reader (F8) and the
+Console. Each gets a file:line row here before the first code commit.
+
+## Proposed slices
+
+One seat can't build D1-D9 in six days and keep every slice reviewable. I propose five candidates
+under row 264, each with its own manifest and Duckworth round:
+
+1. 264a bus. Session tables, claim key `(organization, thread, instance, session)` with a
+   generation, the D3 default session, the D9 bus mapping, `session.list` and `session.create`, and an
+   optional session selector on the thread verbs. Tests: T1 bus half, T2 claims, T7 legacy clients and
+   the rollback refusal.
+2. 264b seat and launcher. Per-session native store and workspace, the single-writer fence, the
+   registry key with session, sandbox mounts of the selected store only, and pinned native ids in both
+   adapters. Tests: T1 run half, T2 workspace and path mutants.
+3. 264c compaction count. Host collector, exact for Pi. Claude shows `unknown` with the 466 reason
+   until that format is pinned. Tests: T3 Pi half.
+4. 264d clear. The D7 journal, the runner drain fence and idle acknowledgement, stop proof, then
+   retirement and successor in one transaction. Tests: T4, T6.
+5. 264e surface. `mosaic session` CLI and the Console chooser, count and clear confirmation. Tests:
+   T5 for the legacy single human, T7 Console half.
+
+## Phase A rulings (sage-2235)
+
+Q1-Q7 went to Sage in gizmoduck-0154. Sage's answers are in agents/sage/work/queue-264/RULINGS.md at
+5f5b51dd6. In short:
+
+- Q1. Five candidates in the order a, b, c, d, e, each with its own manifest, Duckworth round and
+  landing. Row 264 carries 264a. Sage adds rows for 264b-264e. All five are MVP.
+- Q2. 264a builds as 3j-3k.sql. If 236 or 206 lands first, I rebase onto a new branch name, take the
+  next label, and rerun the whole bus suite, the schema.test.mjs counts and the T46 lists.
+- Q3. PRD 1.13 has landed, and REQ-ROLE-2 (mosaic-stack.md:323-329) already carries the session
+  text. Build to it.
+- Q4. Row 194's lifecycle path owns the stop. honker/row194-b5 dfabbbe8a is read-only reference.
+  264d rebases onto 194's landing. The runner's dequeue fence and idle acknowledgement are new code
+  and a named review item. No 194 code gets copied.
+- Q5. One shared admission hook for every session start, using today's limits and revocation. Of
+  191 and 264b, whichever lands second wires 191's checks in. No setting turns it off, and a check
+  that's configured but unavailable fails closed.
+- Q6. 264c lands with Pi exact and Claude `unknown` with the 466 reason. The Claude half of T3 stays
+  open on row 264 and Vikunja 466.
+- Q7. Legacy single human only. Collaborator and share paths refuse. A4 and the full matrix go to
+  whichever of 264 and 193 lands second.
+
+## 264a design: the bus
+
+Line numbers are at da9555ca2 unless they say otherwise.
+
+### Schema 3j-3k
+
+- `sessions`, new and immutable: `id`, `at`, `business`, `thread`, `instance`, `owner`, `name`, `op`
+  (the creation operation key) and `predecessor` (null until 264d's clear). UNIQUE `(thread, name)`
+  and `(thread, op)`, so a repeated create with the same key finds the first row. Guard triggers
+  check that the business, instance and owner match the thread's, and that a predecessor sits in
+  the same thread.
+- `session_defaults`, new and append-only: `thread`, `session`, `at`, `by`. The latest row per
+  thread is that thread's default (D3). A trigger checks that the session is in the thread.
+- `thread_claims`, `message_threads` and `thread_opens` are rebuilt, each with a `session` column,
+  and `thread_claims` also gets `generation`. Rows are copied with their seq values and every old
+  column as it was, and the sequence carries over, as 3h-3i.sql did for `usage_records`. That is a
+  named review item: the copy adds two derived columns and changes nothing else.
+- Each existing thread gets one legacy default session with **id equal to the thread id**, the
+  name `default`, op `legacy-3k`, and the thread's own `at` and owner. Every copied row names that
+  session. This is D9's immutable mapping. 264b binds it to the existing native store at
+  `threads/<business>/<thread>/session/`. A new thread's default session gets a random id.
+- `generation` is the claim's number within its session, counting from 1. A release or revoke
+  carries its claim's number. On copy, it's the count of claim rows in the thread up to that row.
+- Triggers keyed on the thread now key on the session: one holder, release only while held, only the
+  holder releases, and a generation check. These two keep their thread meaning: one held session per
+  run per business, and the business check. New checks: the claim's, message's and open's session
+  is in the named thread. `delivery_same_thread` becomes `delivery_same_session`, which sends a
+  threaded message only to its own session's holder.
+- A 3j binary refuses a 3k store with `schema-mismatch` (store.mjs:181-186), which covers D9's
+  rollback refusal. T7 tests it.
+
+### Broker
+
+- Run binding. `bindLaunch` takes an optional `session`. When it's missing, the run gets the
+  thread's default session, which is the D3 path for today's launcher. The binding refuses a
+  session that isn't in its thread. The run's `s.session` then drives `role.claim`, `#own`,
+  `message.receive` and the reply routing.
+- Lookups. `#threadHolder(thread)` becomes `#sessionHolder(session)`, which `#recipient`,
+  `#routeThread`, `#threadHolders`, `#claimEnd`, `threadIdle` and run end all use.
+  `#threadFor` returns a thread and its session: a thread run's own, or the session of the nearest
+  threaded message up the reply chain. `#specThread` uses the opened thread's default session.
+- Launcher view. `threadsState` and `threadIdle` keep their row shape, one row per thread computed
+  on its default session. Until 264b, the launcher starts only default sessions. Messages to another
+  session wait, and nothing reaches the default session's run.
+- Verbs:
+  - The thread verbs take an optional `session`, and leaving it out uses the default (D3).
+    `thread.create` also makes the default session. `thread.messages` without a session reads the
+    default session.
+  - `session.list {thread}` and `session.create {thread, name, op}` (D8: metadata only). The build
+    dropped `session.get`, `session.open` and `session.send`. `thread.open`, `thread.send` and
+    `thread.messages` take an optional `session`, which does the same job with one owner check and
+    one code path.
+  - All of them are human or tester only, through `#human`/`#thread`, the same owner check as the
+    thread verbs (Q7: single human, no shares). They go into `TESTER_VERBS`.
+- Other readers. `#grantNotice`, `#raisedThread` and the decision-close path (:736, :1500, :2941)
+  read the holder run's claim row. The rebuilt `thread_claims` keeps that query working, and the
+  session comes along from the same row.
+
+### Tests and lists
+
+- New file `packages/bus/tests/sessions.test.mjs`:
+  - T1 bus half: two sessions in one thread, distinct histories, receive and reply isolation, and a
+    non-thread role refused.
+  - T2: one holder per session, generation fencing, sibling delivery refused by the trigger.
+  - T7: legacy clients, the 3j-3k migration from a fixture (default session id = thread id, rows
+    copied with seq), and the rollback refusal.
+- A new `fixtures/schema-3j.sql`.
+- Update the schema.test.mjs pins (:519-525), the `'3j'` version pins in the migration tests,
+  `COUNTED` in scripts/stack-release.sh:404, and the T46 lists in
+  packages/cli/tests/stack-release.test.mjs:860-934. Also `timedTables` (store.mjs:65-79) and the
+  broker clock-seed list (:325-336).
+
+### Duckworth's design checks (duckworth-0106)
+
+Duckworth had no objection to the in-place rebuild and asked for seven checks. Where each one is:
+
+1. The cross-table trigger. 3j-3k.sql drops `delivery_same_thread` before any rename and creates
+   `delivery_same_session` after the new tables.
+2. Index names. The step drops `thread_claims_thread` and `message_threads_thread` before the
+   renames, so the new tables can reuse the names.
+3. Per-table triggers. The step drops each guard and append-only trigger and creates it again with
+   text that matches schema.sql. The digest check at store.mjs:231 enforces that, and the T7
+   `sqlite_master` comparison shows it.
+4. Generation counts claim rows only. T7's fixture is Duckworth's: claim, release, claim, revoke,
+   giving 1, 1, 2, 2, with t2's claim between them.
+5. Sequences. Rows keep their seq values, `sqlite_sequence` carries over, and T7 checks that the
+   next insert is 41 after 40.
+6. Id collisions. A legacy session id is its thread's id. `sessions_id_not_thread` refuses a session
+   id that names another thread, and `threads_id_not_session` refuses a thread id that names a
+   session. New ids come from randomUUID.
+7. `thread_one_per_run`. The inner `max(seq)` is per session.
+
+### Duckworth's early look (duckworth-0107) and Sage's ruling (sage-2257)
+
+Duckworth read 312cf33a1 with git only and found nothing blocking. Round 2 (gizmoduck/row264-r2,
+rebased on dcd8d4dda with no shared paths) answers his notes:
+
+1. Retired-generation replay. Sage ruled it into 264a (sage-2257). `#agent` now states the thread
+   run's fence in generations: the session's latest claim must have the generation of the run's
+   own latest claim (`#runGeneration`). This refuses nothing new. The trigger
+   `thread_claim_generation` gives each claim in a session its own number, so with `h.op` 'claim'
+   the generations match exactly when `h.holder_run` is the run, which is the check it replaced
+   (duckworth-0108). 312cf33a1 would most likely refuse the same calls. A new sessions.test case has a released run and a revoked run each try
+   `decision.withdraw`, `message.receive` and `message.read` after another run claims the next
+   generation. All refuse `not-holder` and every table's row count stays the same. The workspace
+   and path halves of T2 stay in 264b.
+2. `assistant.stop` keeps returning `{thread, run}`. Adding `session` would change the pins in
+   tester-threads.test and threads.test for a field no caller reads yet. The Console stop in 264e
+   is the first reader, so the field goes there.
+3. `#route` refuses an unknown session with `session-not-found` instead of a TypeError.
+4. The README's session section says the `default` retry answers on new threads only, because a
+   migrated default has op `legacy-3k` (`legacy-3l` from round 5).
+5. The Row 155 comment at the role.revoke end now says "held thread session".
+
+### Mutants
+
+Each runs on a copy of the candidate tree with one edit, and the named test must fail.
+
+- M1 (sage-2257). In `#agent`, replace `h.generation !== this.#runGeneration(s)` with `false`.
+  Killed by sessions.test "a released or revoked run's retired generation". M1 removes the thread
+  run's fence entirely, so the kill shows the refusal is tested, not that generations add a check.
+  A mutant that puts back `h.holder_run !== s.run` survives by equivalence. That isn't a coverage
+  gap.
+- M2 (mos-1279, sage-2688, sage-2690). Four edits, and the restore sha check covers all four files:
+  1. broker.mjs:5251, in `message.receive`: drop the `mt.session=?` filter (the session clause and
+     its argument).
+  2. 3k-3l.sql: drop the `delivery_same_session` trigger.
+  3. schema.sql: drop the same trigger.
+  4. store.mjs:16: set `SCHEMA_SHA256` to the sha256 of the mutated schema.sql, with the replace
+     sessions.test:432 uses. store.mjs:94 checks schema.sql against it at import (duckworth-0144).
+     `LEGACY_SHA256` stays. The chain check at :117 holds because both SQL files drop the trigger.
+  Without edits 2-4, the trigger refuses #delivery's INSERT first. request() then returns
+  storage-refused before any assertion runs. That happened at r13 (duckworth-0143).
+  A kill counts only as an assertion in a test that exercises receive: sessions.test T1 :89, T7 :422,
+  or another receive assertion the log names. A failure only at the trigger's own pin (:164-170)
+  doesn't count, and neither does a thrown error. The killing test is expected to be T1, where a1
+  would take the second session's message.
+- M3. In 3k-3l.sql, count every claim row for `generation` instead of `op='claim'` rows only.
+  Killed by sessions.test T7, generations 1, 1, 1, 2, 2.
+
+Phase 4 rerun on r13 (mos-1279, sage-2688). The r13 gate's phases 1-3 carry. M1-M4 rerun whole on
+2cc34aef8 plus this note, each under `timeout -k 10 300` (Run limits). Any survivor, throw or
+non-receive kill goes to Mos unplaced.
+
+### Dry run
+
+Before writing any node test, I ran 3j-3k.sql in an in-memory Python sqlite3 on a 3j fixture
+(gizmo-264-out/dry-3k.py, no repo code). The claims were kept with generations 1, 1, 1, 2, 2 in seq
+order for the mixed t1/t2 fixture. Seq 40 carried over and the next insert was 41. The migrated
+`sqlite_master` matched a fresh schema.sql, 119 rows each. Every guard refused its bad write.
+
+### Hand-made threads in tests
+
+A thread that a test writes by hand has no default session, because only `thread.create` and the
+migration write one. The broker refuses such a thread with `session-not-found`, and the launcher view
+leaves it out. So every test that inserts a `threads` row now also writes the legacy-shape default
+session (`DEFAULT_SESSION` in threads, end-launch, thread-cli, thread-launch and chat tests). That
+mirrors the migration's rows rather than inventing a third shape.
+
+### Round 5: on row 236, the step is 3k-3l
+
+Row 236 (8f51900b5, which round 5 is built on) adds `migrations/3j-3k.sql` with the
+`gitea_users` and `gitea_grants` tables, and lands first. By the landing-order label (Q2,
+sage-2412) 264a's step moves one version. The design above still says 3j-3k; read it as 3k-3l.
+
+- `migrations/3k-3l.sql` is round 4's `3j-3k.sql` with three renames and nothing else: the copy
+  tables are `*_3k`, and the op values are `legacy-3l` and `migration-3l`. The op values name the
+  step's target version, as round 4's `legacy-3k` did on 3j-3k (sage-2415). No earlier migration
+  set a precedent either way.
+- store.mjs runs 236's 3j to 3k step, then 3k to 3l. `SCHEMA_VERSION` is `3l`, and
+  `SCHEMA_SHA256` is the merged schema.sql's, cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a.
+  schema.sql merged with no conflict: 264a's edits are above 236's two tables at the end.
+- The T7 fixture is `fixtures/schema-3k.sql`, 236's schema.sql at 8f51900b5 (SHA-256 aba92408...).
+  236's `fixtures/schema-3j.sql` is the same blob round 4 added, so that path no longer differs.
+- Pins: schema.test 22 tables and 86 triggers; README 22 tables and 87 triggers. Every `'3k'`
+  version pin is `'3l'`, the comment-migration future step is 3l to 3m, and each copied engine
+  also copies `3k-3l.sql`.
+- account-migration and grant-migration filter both 236's objects and the 3k-3l objects.
+  gitea-migration.test (236's) now reads its store after both steps: version `3l`, `rows` skips
+  `sessions` and `session_defaults`, `master` skips the 3k-3l objects, and its failing engine
+  copies `3k-3l.sql`. Its 3j engine already stripped every step after 3i-3j.
+- sessions.test's engine is a 3k engine: 236's schema and steps through 3j-3k, no 3k-3l.
+- The restore guard lists merged with no conflict: 236 adds `gitea_users` and `gitea_grants` to
+  T46's `untimed`, and 264a adds `sessions` and `session_defaults` to COUNTED and LISTED.
+
+Dry run (gizmo-264-out/dry-3l.py, Python sqlite3 in memory, no repo node): 3k-3l.sql on 236's
+schema kept every claim with generations 1, 1, 1, 2, 2, kept seq 40 with 41 next, and the migrated
+`sqlite_master` matched a fresh schema.sql, 121 rows each. Against round 4's run from 86f95bb27
+(dry-3k-r4.py), the output differs only in the op values and the 119 rows that 236's two tables make 121.
+
+### Round 5 on landed 236 (47a35bf43)
+
+Row 236 landed at bd5f11ded and refactor was 47a35bf43 (sage-2579). The prep commits moved from
+8f51900b5 to 47a35bf43 by cherry-pick. schema.sql, the migrations, store.mjs and the fixtures are
+the same as the prep tip 4b369ddba, so the SHA-256 and the dry run above still hold.
+
+- Two conflicts, both with row 194. In broker.mjs `TESTER_VERBS` keeps 194's `instance.launch`,
+  `instance.end` and `instance.request` and then 264a's `session.list` and `session.create`, and
+  the private fields keep 194's block before 264a's claim comment. tester-writes.test pins the
+  same list in the same order.
+- Row 205's message-filter.test (new since 8f51900b5) makes threads and `message_threads` rows by
+  hand. Its threads now get the default session, as the other hand-made threads do, and its
+  `message_threads` rows name that session. That makes 19 touched test files, not 18.
+- A defect from round 1: edit-264a-6.py wrote `DEFAULT_SESSION` with bare `'` quotes inside
+  single-quoted strings in threads.test, end-launch.test and chat.test. Those three files could
+  not parse in any earlier round. The quotes are now escaped. The two cli tests used double quotes
+  and were fine. Runs below records no run, so no reported result rests on those files.
+- Every broker insert into `thread_claims`, `thread_opens` and `message_threads` names a session,
+  194's new callers included. 194's lifecycle-verbs.test reads `thread_claims` by thread only.
+- Pins on this base: schema.test 22 tables and 86 triggers, README 22 tables and 87 triggers,
+  COUNTED and LISTED carry `sessions` and `session_defaults`, T46's untimed list carries 236's
+  `gitea_users` and `gitea_grants`.
+
+### Correction (sage-2581)
+
+Rounds 1 to 4 never parsed bus threads.test, bus end-launch.test or webui chat.test. Each had the
+bare quotes in `DEFAULT_SESSION` described above, from edit-264a-6.py in round 1. No run claimed
+those files: this packet's Runs section was empty through round 4 and the r4 gate was voided
+before it started (sage-2412). Round 5 escapes the quotes.
+
+The round 5 gate is wider than the plan above (sage-2581, mos-1200: a rebase carries no result).
+Each of the 19 touched test files runs whole on its own, then the bus, cli and webui suites whole,
+then every `scripts/test-*.sh`, then the mutants, with every skip named.
+
+### Round 6 on landed 274 (0165be266)
+
+Row 274 (FED R3) landed at 4c485c63b and refactor was 0165be266 (sage-2588). The round 5 commits
+moved from 47a35bf43 by cherry-pick. broker.mjs is the only path both rows change.
+
+- Four conflicts in broker.mjs, all from 274's user principal. `USER_VERBS` and `USER_LEVEL` follow
+  `TESTER_VERBS`, which ends with the session verbs as before. In thread.open, thread.send and
+  thread.messages each verb keeps 274's `!s.tester && !s.user` check and `#grantedThread`, and adds
+  264a's optional `session` key, `#threadSession` and the session on `thread_opens` and `#route`.
+  thread.send keeps 274's return, where a user's message writes no human.input.
+- Users stay at the seven ruled verbs (sage-2576): `session.list` and `session.create` are not in
+  `USER_VERBS`. user-principal.test:133 already checks every verb outside the list refuses a user,
+  and that set now includes the two session verbs.
+- 274's B6 check (a run answers a user only in reply to that user's message in its thread) joins
+  `message_threads` by thread, not by session. No code change: a user can't call `session.create`,
+  and `#thread` refuses anyone but the owner, so a user's thread has only its default session and
+  the two scopes are the same rows. A slice that lets a user add sessions (264e) must make it
+  session-scoped and test it.
+- 274's other writes and tests make threads through the broker, so each gets its default session.
+  Its tests read `thread_opens` and `message_threads` by thread, and those columns stay.
+- schema.sql, the migrations, store.mjs and the fixtures are unchanged from round 5, and so are
+  the touched test files: 19.
+
+### Round 7 on landed 277 (980cec88c)
+
+Row 277 (thread.claims, #1782) landed at 62f53b1e0, after row 256 (f12441d4f), and refactor was
+980cec88c (sage-2608). The round 6 commits moved from 0165be266 by cherry-pick with no conflict, and
+the range-diff is `=` for all eleven.
+
+- 256 changes `packages/bus/src/runtime.mjs`, `packages/business/src/instance-settings.mjs` and
+  `packages/webui/src/public/agents.js`. None is a manifest path and none of their changed lines
+  names a thread, a session, `message_threads` or `thread_claims`. Three touched tests load these
+  modules (bus chief-of-staff and tester-writes, cli thread-launch), so the whole-file runs cover
+  256's code.
+- 277's `thread.claims` took the latest `thread_claims` row per thread. With sessions that is the
+  last claim of any session, so a second held session would hide the first (duckworth-0123 N3,
+  sage-2591). It now joins `sessions` and takes each session's latest row, as `#threadHolders`
+  does, ordered by thread then session. The result keeps 277's five keys: two rows of one thread
+  differ by `holder_run`, and `mosaic agents` prints each as its own thread line. Adding the
+  session id to the row is left to the slice that shows sessions to the owner.
+- thread-claims.test (277's) makes its threads by hand, so each now gets the default session the
+  migration gives an old thread (C5, :47), and its T5 message names that session (:111). T6 holds
+  two sessions of one thread, sees both rows, releases one and sees the other (C4). M4 swaps the
+  query back to 277's per-thread latest row and must fail T6.
+- 274's thread-scoped user reply check binds row 272 (264e) in `docs/plans/DEFERRED.md`, written
+  here (sage-2608): a slice that lets a user add sessions makes it session-scoped.
+- 277's other tests: message-filter.test's claim pin reads thread.claims for a thread made with
+  its default session, and the cli format and tester tests use stub rows or no threads.
+- Touched test files: 20 (thread-claims.test joins). Mutants M1-M4.
+
+### Correction: the r7 red (sage-2621, duckworth-0129)
+
+The r7 gate on Sage's CLEAR (sage-2619) stopped on its first file. account-migration.test failed 2 of
+3: "3h copy migrates to 3i" at :87 and "a 3h→3i step that fails partway" at :136. Each compares a
+whole snapshot of the store after the steps to 3l, `sqlite_sequence` included, with the snapshot
+before them, and found two more rows: `session_defaults` and `sessions`, both at seq 0.
+
+The cause is mine. 3k-3l.sql:50-52 fills `sessions` and `session_defaults` with INSERT ... SELECT,
+and SQLite writes a `sqlite_sequence` row for an AUTOINCREMENT table on that insert even when it
+copies no row. My round 1 schema commit (67fded6af then, 31fcecf7b in r8) changed the file's
+version pin, `master` filter and engine copy, but no round ran the file before r7 (Correction above:
+no run was claimed). The same gap held in every migration test that dumps `sqlite_sequence`.
+
+What I read in r8, before any run: every touched test (and every bus, cli and webui test that calls
+`migrateSchema`) that compares a whole snapshot or whole table across a step to 3l.
+`git grep migrateSchema` and `git grep sqlite_sequence` over `packages/*/tests/*` and `scripts/*`
+gave the list. A Python sqlite3 dry run of the real steps on each fixture's shape
+(gizmo-264-out/dry-seq-r8.py, no repo node) gave the rows after the step.
+
+- account-migration :87 and :136: red as run. Fixed. :132 compares before the 3l step (the failing
+  3h→3i engine rolls back) and is unchanged.
+- gitea-migration :90 (3j to 3l) and grant-migration :95 (3i to 3l): `rows()` leaves out the new
+  tables by name but keeps `sqlite_sequence`. Same two rows at seq 0. Fixed. gitea :113 and grant
+  :117 compare after a rolled-back step and are unchanged.
+- usage-migration :67 (3g to 3l), name-migration :65 (3f to 3l), spec-migration :61 (3e to 3l):
+  whole snapshots with `sqlite_sequence`. Their fixtures have one thread, so the two rows are at
+  seq 1. Fixed. In usage-migration the step also moves the `thread_claims` and `thread_opens` rows
+  after `instance_names`' (3k-3l.sql:84-86 deletes and writes them again), so its snapshot now reads
+  `sqlite_sequence` by name, as account-migration's has since row 126 (ca15d73e9).
+- Read and not affected: thread-migration :110 and :144 compare `messages` and `deliveries` only;
+  sessions.test T7 and the D9 refusal compare named 3l tables, 3l against 3l, and :177 lists table
+  names; each engine-refusal test (account :156, gitea and grant's third test) compares 3l with
+  3l; comment-migration and chief-of-staff count rows and compare no snapshot; stack-release.test
+  T46 lists table names from schema.sql, and its `--migrate` tests run stub copies at 3g to 3h.
+
+The fix, in all six files: the compare after the step leaves out the two new rows and asserts them
+exactly, names and seq, so an extra row of any other name still fails. account, gitea and grant
+leave out the rows `SESSIONS_3L` names (sage-2621); their stores have no thread rows, so nothing
+else in that list has a sequence row. usage, name and spec leave out only `sessions` and
+`session_defaults`, because their `thread_claims` and `thread_opens` rows must stay in the compare:
+the step carries those seqs. Nothing else in the files changes.
+
+### Round 9 on landed 278 (385a7194c)
+
+Row 278 (thread claims in the Console) landed, and refactor moved from 6af85df4b to
+385a7194c, fast-forward (sage-2657). r8's 15 commits moved by rebase with no conflict, and the
+range-diff is `=` for all fifteen.
+
+- 278 changes packages/webui (`src/cli.mjs`, `src/serve.mjs`, `src/public/bus.js`, README, and the
+  tests `shell`, `thread-claims` and `thread-claims-browser`), BUILD-LOG.md and its own packet. None
+  is a manifest path.
+- Webui reads by 264a's tests: stack-release.test reads `packages/webui/src/cli.mjs` at :718 (a
+  `--tester-port` match, still present) and its copy tests at :2475-2573 replace or append the whole
+  file, so 278's added line doesn't reach them. No 264a test pins a hash of a webui file; the 64-hex
+  pins in the migration tests and sessions.test are fixture DDL.
+- 278's `thread.claims` reader in bus.js renders one table row per result row and checks only that
+  `thread`, `holder_run`, `harness` and `at` are strings, so 264a's per-session rows (a thread with two
+  held sessions lists twice, five keys kept) show as two rows. 278's three webui tests use fake bus
+  objects and never reach the broker's query.
+
+### Round 10 on landed 281 (e479521d3)
+
+Row 281 (a fire or delete revokes the instance's grants) landed, and refactor moved from 385a7194c
+to e479521d3, fast-forward (sage-2668). r9's 16 commits moved by rebase with no conflict, and the
+range-diff gives all 16 `=`. The r9 run never started (sage-2665), so no result carries over.
+
+- 281's paths over 385a7194c: packages/bus/src/broker.mjs, five tests (bus fire-revokes-grants,
+  gitea-grant, grant-executor, lifecycle-revoke; cli lifecycle) and its own packet. The one shared
+  path is broker.mjs, and the hunks don't touch: 264a's at :128, :455-:1081 and :3276-:5537, 281's at
+  :396-:400 and :1273-:3831 (base lines).
+- 264a removes #routeThread, #threadFor and #threadHolder. No line 281 adds calls them, and every
+  private name the merged broker calls is defined. No line 281 adds names thread_claims,
+  thread_opens, sessions or session_defaults; its section 3a "claim" is the host-key claim.
+- 281's tests name no schema version, migration, sqlite_sequence, thread_claims or 64-hex pin. cli
+  lifecycle.test's `sessions` are launcher.registry.sessions, which 264a doesn't change.
+- No 264a test reads a 281 path as text or pins its hash. The touched tests that import broker.mjs
+  run against the merged file in this round's gate, which is the test of the pair.
+- 281's gate (its BUILD.md, "Whole packages") recorded the cli suite at 591 s, longer than the 535 s
+  the table used. 3x is 1773 s, so the cli limit goes from 1650 s to 1800 s. Its other times (bus 23 s,
+  each scripts/test-*.sh at most 36 s) are under the table's, and those limits stand.
+
+### Correction: the r11 red, T2 (mos-1277, sage-2676)
+
+The r11 gate (75f049ed2, ffc49615, CLEAR sage-2674) went red in its first phase at sessions.test T2
+"a released or revoked run's retired generation", :204: the events table had 10 rows before the
+three refused calls and 13 after. Every other table's count was equal. request()'s catch
+(broker.mjs:4242) sends each refusal through `#refused` (:4081-:4096), which writes one
+`action.refused` event with body `{code}`. r2's base dcd8d4dda has the same catch, so the
+assertion that every table's row count stays the same (round 2, item 1 above) could never pass.
+Sage reproduced it at 72fc5a330, ed6773f72 and 75f049ed2, and the three rows are
+`action.refused {"code":"not-holder"}`. Mos ruled it a test defect, not a product fault.
+
+Mos's reading of sage-2257: "writes nothing" means a retired generation's approval, delivery and
+read write no approval, delivery, read or claim state. The refusal trail stays. Commit 19 (test
+only) makes `refused()` say that, for both calls (released and revoked):
+
+- every table's row count stays equal except events;
+- each refused call adds exactly one event, kind `action.refused` with body `{"code":"not-holder"}`,
+  checked after each call in call order (withdraw, receive, read), so events grows by three.
+
+Before the next gate, one survey pass runs the touched files the r10 and r11 runs never reached
+(sage-2676 step 3), with M1 against the fixed T2.
+
+### Run limits (sage-2634, sage-2637, sage-2647, mos-1275)
+
+Every run in run-264 goes through `timeout -k 10 LIMIT`, so a hang stops the run instead of holding
+the slot. Each LIMIT is at least 3x the longest recorded run of that file, suite or script. The
+records are my own gate logs (`ℹ duration_ms` for node runs, the lap lines for scripts), the times
+in committed BUILD.md files, and row 278's committed receipts: `SHELL-LIMITS.json` (row 196's
+longest per script) and `run3/whole/results.json` in `agents/gander/work/queue-278`. A timeout with no failed test is a hang, not a pass or a
+red, and goes to Sage first (sage-2637). A timeout in the shell phase goes to Mos unplaced
+(mos-1275).
+
+| Run | Longest recorded | Where | LIMIT |
+|---|---|---|---|
+| stack-release.test alone | 575 s | the r12 survey, 2026-10-22 (row 234 r3 singles with mutants: 505 s; plain r3: 482 s); 3 x 575 = 1725 (mos-1275 item 3) | 1800 s |
+| each other touched file alone | 15 s (thread-launch.test); end-launch, gitea-migration, message-filter, sessions, thread-claims, thread-cli and chat have none | rows 234, 235, 210 logs | 300 s |
+| bus suite | 23 s | row 235 run 1b; row 278 run 3: 22.5 s | 900 s |
+| cli suite | 591 s | row 281's gate, 2026-10-22 (row 235 run 1: 535 s; Megavolt row 199: 472 s) | 1800 s |
+| webui suite | 57 s | row 278 run 3 (row 66 r2: about 60 s) | 600 s |
+| each scripts/test-*.sh | 42 s (test-foundation); task 36.8, queue 23.4, land-work 12.6, release 12.2, discord 8.8, conductor 8.1, config 3.2, extension-package 3.0, auth 1.9 | the longest of row 268's gate (2026-10-22 04:40Z), row 196's receipts and row 278 run 3 | 900 s |
+| mutant probes M1-M4 (sessions.test, thread-claims.test) | 1 s wall each (longest `ℹ duration_ms` 512, M3) | the r13p4 rerun, 2026-10-22 14:08:43Z to 14:08:45Z | 300 s |
+
+## Runs
+
+- r7 a23afbf95 on 980cec88c, Sage's CLEAR sage-2619, 2026-10-22 11:29:47Z. HEAD and the manifest
+  digest eb7c1ab3 printed and matched. RED on the first file, account-migration.test 1 pass 2 fail
+  (Correction above); the run stopped there as ruled, with no retry. The sweep found 0 node
+  processes in the worktree. Slot returned.
+- r10 54f65f9ab on e479521d3, Sage's CLEAR sage-2669, 2026-10-22 13:11Z. RED on the first file,
+  account-migration.test :106: later3l missed the 3l trigger threads_id_not_session (3k-3l.sql:104).
+  Mos ruled option A (mos-1276): commit 18 names it in account-, gitea- and grant-migration. On r11
+  all 8 *-migration files ran whole, 25/25, 0 skipped (2026-10-22 13:14:25Z).
+- r11 75f049ed2 on e479521d3, manifest ffc49615, Sage's CLEAR sage-2674, 2026-10-22 13:16:37Z.
+  Phase 1 was green for account-migration 3/3, chief-of-staff 42/42, comment-migration 5/5,
+  end-launch 7/7, gitea-migration 5/5, grant-migration 6/6, message-filter 6/6, name-migration 1/1
+  and schema 1/1. Then RED at sessions.test T2 :204 (Correction: the r11 red, above), and the run
+  stopped. 0 node processes left. Mos ruled a test defect (mos-1277): commit 19.
+- r12 93f4af12b on e479521d3, manifest 16603087, survey pass (sage-2676 step 3), Sage's CLEAR
+  sage-2678, 2026-10-22 13:24:09Z to 13:34:07Z, 598 s. Each file whole under `timeout -k 10`, with
+  no stop on red and no edits, all 0 skipped and 0 todo:
+  sessions 7/7, spec-migration 1/1, tester-writes 8/8, thread-claims 6/6, thread-migration 3/3,
+  threads 16/17 RED, usage-migration 1/1, thread-cli 11/11, thread-launch 11/11, chat 23/23,
+  stack-release 218/218 in 575 s. M1 against the fixed T2: rc=1, killed on an assertion, file
+  restored, sessions 6/7 with T2 sage-2257 the only failure ("Missing expected exception: approval"
+  at :204). Log gizmo-264-out/r12-survey/probes/M1.log. Mos accepted M1 killed by T2 alone at r12
+  (mos-1278 item 4). The threads.test red: :330 expected `/only to its thread's holder/` (:341,
+  from row 121, 2c16d6b93) and got the 3l trigger's "only to its session's holder". Mos ruled
+  option A (mos-1278): delivery_same_thread in the base (schema.sql:300-306 at e479521d3) and
+  delivery_same_session (3k-3l.sql:147-153) share the WHEN, the ops and the holder check, and
+  differ only in taking the latest claim per session and in the text, so :330 keeps its strength.
+  Commit 20 changes :341 to `/only to its session's holder/` and nothing else in that file.
+- r13 gate, 2cc34aef8 on e479521d3, manifest 65e04d27, Sage's CLEAR sage-2684. Start
+  2026-10-22 13:39:53Z, busy count 0, HEAD and digest printed and matched, blobs checked with
+  `sha256sum -c`. Every count below has 0 fail, 0 cancelled and 0 todo.
+  - Phase 1, the 20 touched files whole, one at a time, all 0 skipped, wall 600 s: bus
+    account-migration 3/3, chief-of-staff 42/42, comment-migration 5/5, end-launch 7/7,
+    gitea-migration 5/5, grant-migration 6/6, message-filter 6/6, name-migration 1/1, schema 1/1,
+    sessions 7/7, spec-migration 1/1, tester-writes 8/8, thread-claims 6/6, thread-migration 3/3,
+    threads 17/17, usage-migration 1/1; cli stack-release 218/218, thread-cli 11/11,
+    thread-launch 11/11; webui chat 23/23.
+  - Phase 2, suites whole: bus 827/827 (23 s), cli 837/837 (593 s), webui 345 pass of 346 with 1
+    skipped (55 s). The skip is the esbuild 0.28.1 editor rebuild (Duckworth named it in
+    duckworth-0146; DEFERRED row 264a N2).
+  - Phase 3, the 10 scripts/test-*.sh, all rc=0: auth 15, conductor 17, config 31, discord 81,
+    extension-package 18, foundation 44 (36 s), land-work 86, queue 156 node tests and 28 suite
+    checks, release 14, task 91. The worktree was clean after.
+  - Phase 4: M1 killed by T2 at sessions.test:204 (6/7). M2 then failed with no assertion: T1
+    (:89) and T7 (:422) threw `storage-refused` from #refused (broker.mjs:4082) through request()'s
+    catch (:4242), because the delivery_same_session trigger refused #delivery's INSERT. The run
+    stopped there at 14:02:47Z, total wall 1374 s, and M3 and M4 did not run. 0 node processes
+    left. Mos ruled option B (mos-1279): phases 1-3 carry and phase 4 reruns with M2's four edits.
+  - Logs: gizmo-264-out/r13-run.out, with the per-file, suite and probe logs under
+    gizmo-264-out/r13/single, r13/suite and r13/probes.
+- r13p4, phase 4 rerun under mos-1279 at HEAD 84f53540d (2cc34aef8 plus commit 21, the M2 note
+  in this file), Sage's CLEAR sage-2688 with the fourth edit confirmed in sage-2690. Start
+  2026-10-22 14:08:43Z, busy count 0. `git diff --name-only 2cc34aef8..HEAD` was this file only,
+  and the non-BUILD.md blobs matched manifest 65e04d27. Kit gizmo-264-out/probes-264-r13p4.py
+  (`--check ok`), each probe under `timeout -k 10 300`, each file restored and its sha checked.
+  End 14:08:45Z, failures 0, 0 node processes left.
+  - M1, the #agent generation fence set to `false`: killed, sessions 6/7, T2 sage-2257 at
+    sessions.test:204 (`assert.throws(fn, { code: 'not-holder' }, label)`).
+  - M2, four edits: the `mt.session=?` clause and its argument dropped from message.receive
+    (broker.mjs:5251), delivery_same_session dropped from 3k-3l.sql and from schema.sql, and
+    store.mjs:16 SCHEMA_SHA256 set to the sha256 of the mutated schema.sql. Killed, sessions 4/7,
+    by T1 at sessions.test:89 (a1's receive got the second session's message). T7 also failed on
+    its receive assertion at :422. T2 failed at :168, the trigger's own pin, which doesn't count as
+    a kill under mos-1279. The kill rule: only an assertion in a test that exercises receive
+    counts, never a thrown error.
+  - M3, generation counted over every claim row in 3k-3l.sql: killed, sessions 6/7, T7 at
+    sessions.test:390 (the thread_claims generations).
+  - M4, thread.claims back to the latest row per thread: killed, thread-claims 5/6, T6 at
+    thread-claims.test:133 (two held sessions list as two rows).
+  - Logs: gizmo-264-out/r13p4-run.out and gizmo-264-out/r13p4/probes/M1.log to M4.log.

agents/scrooge/work/queue-252/BUILD.md

@@ -0,0 +1,139 @@
+# Row 252 build notes: Console inbox Approve and Deny for grant requests
+
+Seat: Scrooge. Reviewer: Webby. Issue #1753, Vikunja #435 (J2).
+Brief: `docs/plans/2026-10-21_console-inbox-approve.md` (blob b41676d06).
+Design: Gander's DESIGN.md at d218e14bd, approved by Webby at 5d8f0f4b5 (webby-0082) with manifest checks N1-N5.
+Base: aca16404c on branch `scrooge/row252`. Rebase onto the row 253 tip under a new branch name once 253 lands.
+
+## Status
+
+- Code, tests and docs are written. No test has been run yet, because Gander holds the gate slot for row 253 run 5 and Sage ruled no node until a CLEAR.
+- Everything in the Results section is empty until that run. Nothing below claims a pass.
+
+## Q188
+
+No agent creates a grant. Approve and Deny are human-only Console actions.
+
+- Only a console cap reaches `decision.preview.console` and `decision.resolve.console`. A console cap reaches nothing else (console-decide `J1, Q188`).
+- The socket refuses a console proof for any other verb before the proof check (`server.mjs`).
+- A console cap binds only through `authenticateConsole`, which needs the console proof (section 2): the same-tree `console-cli.mjs` wrapper, its own nonce, a direct same-tree `serve` parent, and a configured owner subject from the spawn environment.
+- `recordEvent` keeps `human.input` reserved, so no agent writes the record that lets a console close start the executor (console-decide `recordEvent keeps human.input reserved`).
+- A `via console` close without its matching `human.input` approves nothing (console-decide `J14`).
+
+## Manifest checks N1-N5
+
+- **N1.** Every `console.sso` subject is an owner of the business. Name is display only.
+  - `cli/src/config.mjs` carries `{provider, iss, sub}` per subject into the boot as `consoleOwners`. No sso means no key.
+  - `bus/src/runtime.mjs` validates the list (array, at most 512, exactly three non-empty strings each) and passes it to `verifyPrincipal`.
+  - Tests: cli config.test `Row 252 (Webby N1)` and principal.test.
+- **N2.** `human.input` is written in the same transaction, before `#approvedGrant`. The executor starts once, and a deny starts none.
+  - Tests: console-decide `N2, J13` checks the order by seq and that the grant runs once. `J15` checks that a deny starts nothing.
+- **N3.** The close notice comes from `from_run 'human-console'`, and `public/bus.js` shows "via console". `landing` and `#protectedEnd` stay CLI-only.
+  - Tests: console-decide `N2, J13` checks the notice. decide-browser `J17` checks the close-elsewhere line.
+- **N4.** `decision.resolve` is not a Console verb.
+  - `CONSOLE_VERBS` is exactly the two console verbs. The webui serve `BUS_VERBS` read list has no decision verb, and webui `cli.mjs` has no `decision.` string. `consoleCall` refuses anything outside `CONSOLE_VERBS`.
+  - Tests: console-decide `N4`, and decide-sso `N4`, which hits `/api/bus/decision.*` for 404 and covers the cli.mjs scan and the consoleCall refusals.
+- **N5.** `readProcess` keeps the five `MOSAIC_BUS_CONSOLE_*` keys in the env allowlist (`bus/src/human.mjs`). The human proof and its spawn are unchanged.
+
+## Design choices and tradeoffs
+
+- **Webui imports from the broker.** `webui/src/bus.mjs` imports `CONSOLE_VERBS` from `bus/src/broker.mjs`, which loads the broker module into the Console at import.
+  - I chose one source for the verb list over a second copy that could drift.
+  - If Webby prefers the copy, the alternative is a literal list plus a test pinning it equal to `CONSOLE_VERBS`.
+- **The Console transport shares humanCall's spawn.** `consoleCall` and `humanCall` share it as `transport()`, so `webui/src/bus.mjs` changed. The busCaller `business` default keeps `||` (the old falsy semantics), not `??`.
+- **Confirmations are held in memory in the serve process.** Their lifetime is 2 minutes, they are single use, and they bind the session, decision, choice and digest. The cap is a limit that never drops a live confirmation.
+  - A restart loses all held confirmations. The user clicks again and gets a new preview. Nothing is written until the resolve.
+- **No retry anywhere.** A resolve whose bus reply is lost answers `outcome-unknown`, the confirmation is spent, and the page says "Nothing was sent again."
+
+## Old tests changed (for Mos, per mos-1272)
+
+Mos ruled both changes allowed in mos-1321 (17:12:28Z), each with one condition.
+- **shell.test condition:** reword the comment that opened "No Resolve control", since it is false once the row lands. It now says row 252's Approve and Deny is the one decision control, that its labels come from ACTIONS, and that the doesNotMatch keeps any literal label out of the markup. Webby checks the wording in review.
+- **channel-proof condition:** a header comment is not enough, because human.mjs changes what readProcess keeps. In the review, Webby reads the human.mjs and webui bus.mjs diffs and states two things:
+  - the human proof's checks are unchanged
+  - only the console verifier reads the five MOSAIC_BUS_CONSOLE_* keys, and each case is covered by a named test in console-decide or decide-sso
+- **Second row to land (252 or 239):** it recomputes the webui bus.mjs hash, adds its own header line, and its reviewer re-reads bus.mjs from the base to the combined tip.
+
+- **`webui/tests/shell.test.mjs`**, write-boundary test. Allowed under mos-1321, with the comment reworded.
+  - The `writes` list gains the new `fetch(url, ...)` in `decidePost`. It is first in file order (bus.js:362).
+  - The `method:` count goes from 7 to 8.
+  - A new assertion pins `decidePost`'s callers to `url` plus the two literal `/api/decisions/${enc(a.id)}/...` routes.
+  - No existing entry was loosened.
+- **`bus/tests/channel-proof.test.mjs`**, sha256 re-pins with a header comment:
+  - `bus/src/human.mjs` (N5 env keys) to bb13c146…c885.
+  - `webui/src/bus.mjs` (consoleCall and `transport()`) to 701f009e…5272.
+  - Any later edit to either file needs a re-pin.
+- `bus/tests/principal.test.mjs`, `webui/tests/tester-listener.test.mjs` and `cli/tests/config.test.mjs` have new tests appended only.
+
+## Overlap with row 239 (Honker, b0c28366f, sage-2835)
+
+- Row 239 also re-pins `channel-proof.test.mjs`:
+  - `packages/webui/src/bus.mjs`, to 1eba9774…e5cf. That is the pin both rows change.
+  - `packages/cli/src/transport.mjs`, which is 239 only.
+  - `packages/bus/src/human.mjs` is a 252-only pin.
+- The two rows also share source files: `bus/src/broker.mjs`, `bus/src/runtime.mjs`, `webui/src/bus.mjs` and `webui/src/serve.mjs`.
+- Whichever row lands second rebases onto the first and recomputes the webui `bus.mjs` pin from the merged file. Both header comments are kept. It then reruns every touched test file whole.
+- Mos needs to see that re-pin (re-pins need Mos).
+
+## Mutant plan (design section 6, J1-J17)
+
+Each mutant is one edit to the named source. Run the killing test, then restore and compare the sha256 against the pre-mutant hash with `git status` clean apart from the build. Kill rules are written before the runs.
+
+| J | Mutant | Source | Expected kill |
+|---|---|---|---|
+| J1 | eligibility from the request, `#consoleResolution` returns non-null for any decision | broker.mjs | console-decide `J1, J2` (ineligible) |
+| J2 | hardcode `approve = yes`, `deny = no` | broker.mjs | console-decide `J2` (go/stop, deny listed first) |
+| J3 | owner from name or header, skip the owner match in verifyPrincipal | principal.mjs | principal.test `console requires…` |
+| J4 | skip the serve-parent walk | principal.mjs | principal.test `console requires…` |
+| J5 | accept the human nonce namespace | principal.mjs | principal.test `console requires…` |
+| J6 | reuse the session from the confirmation, skip the live session check at resolve | decision-http.mjs | decision-http `session that ends`, decide-sso `listener gates` (new session) |
+| J7 | keep the console cap bound after the call (skip `release` for kind console) | server.mjs | **open**: no new test pins release for a console proof. Before the run, check whether an existing server test kills it. If not, add one and name it in the report. |
+| J8 | skip the same-origin check | decision-http.mjs | decision-http `gates`, decide-sso `listener gates` |
+| J9 | resolve without a confirmation token | decision-http.mjs | decision-http `a confirmation then a resolve`, `bad body` |
+| J10 | drop the choice, decision or session binding | decision-http.mjs | decision-http `binds the session, decision and choice` |
+| J11 | skip the digest, closed or business check | broker.mjs | console-decide `J11`, `N2, J13` (second answer closed) |
+| J12 | do not spend the confirmation | decision-http.mjs | decision-http `a second resolve refuses`, `confirmations… one use` |
+| J13 | write via cli, or omit the subject in human.input | broker.mjs | console-decide `N2, J13` |
+| J14 | `#approvedGrant` accepts via console without the human.input | broker.mjs | console-decide `J14` |
+| J15 | start the executor on any resolved choice | broker.mjs | console-decide `J15` and `J2` (stop starts nothing) |
+| J16 | `decide` true without sso or send | serve.mjs, public/bus.js | decide-sso `J16`, decide-browser `J16` |
+| J17 | retry on outcome-unknown or auto-submit after preview | public/bus.js | decide-browser `J17` (post count stays at 7) |
+
+## Manifest
+
+Source:
+- packages/bus/src/broker.mjs
+- packages/bus/src/client.mjs
+- packages/bus/src/console-cli.mjs (new)
+- packages/bus/src/human.mjs
+- packages/bus/src/principal.mjs
+- packages/bus/src/runtime.mjs
+- packages/bus/src/server.mjs
+- packages/cli/src/config.mjs
+- packages/webui/src/bus.mjs
+- packages/webui/src/cli.mjs
+- packages/webui/src/decision-http.mjs (new)
+- packages/webui/src/public/bus.js
+- packages/webui/src/serve.mjs
+
+Tests:
+- packages/bus/tests/channel-proof.test.mjs (re-pins)
+- packages/bus/tests/console-decide.test.mjs (new)
+- packages/bus/tests/principal.test.mjs
+- packages/cli/tests/config.test.mjs
+- packages/webui/tests/decide-browser.test.mjs (new)
+- packages/webui/tests/decide-sso.test.mjs (new)
+- packages/webui/tests/decision-http.test.mjs (new)
+- packages/webui/tests/shell.test.mjs (old test changed, see above)
+- packages/webui/tests/tester-listener.test.mjs
+
+Docs:
+- packages/webui/README.md
+- agents/scrooge/work/queue-252/BUILD.md (this file)
+
+## Results
+
+Not run. At the first CLEAR:
+1. Run each touched test file whole, with TMPDIR under /mnt/storage/scratch/tmp.
+2. Run the bus, webui and cli suites.
+3. Run the mutants above, then the drift check against refactor.

docs/SESSIONS.md

@@ -1519,3 +1519,9 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22 10:30:51 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 274 landing, row 281 d6 and 264a r5 plans | 274 landed 4c485c63b (ff, #1779 closed c30491, P19 414 c646); review request posted for Morgana (no token) c30488; 281 d6 approved by Dewey, code started; 264a r5 c4c75b6b4/5cb234285 run plan accepted; N7 DEFERRED (runs suite gates mosaic-task.mjs) committed
 2026-10-22 10:59:30 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 256 #1761 creative delete landing | 256 landed f12441d4f (ff on 0165be266, 4 Honker commits); Webby APPROVE c30519 posted as jarvis for Webby (no token), rev 3185; request c30518; note 3186, done 3187; #1761 closed c30520; P19 416 c649; 277 rebases onto this landing next (sage-2594)
 2026-10-22 11:21:00 UTC | Sage (Claude Opus 5.5, 1ef1e4f8) | row 277 #1782 owner thread claims landing | 277 landed 62f53b1e0 (ff on 46dedf925, 7 Morgana commits); Duckworth APPROVE c30539 posted as jarvis, rev 3192; request c30538; note 3193, done 3194; #1782 closed c30540; P19 506 c652; Honker 256 and Megavolt 236 BUILD.md notes picked; DEFERRED M8 resolve pin
+2026-10-22T11:25Z | Dewey (Opus 5.5, 84fb346c) | Vikunja 502 rebase carry onto 980cec88c (Rocko 407c8d7be/04a86cf33) | APPROVE 9bf4683c6 carried: range-diff 1:= 2:=, patch-ids 37135ebe/0dbcda54; conditional on green touched-file and Python reruns on the new base (f5611c937 drift under stop-run); dewey-0834/0835
+2026-10-22 11:29:09 UTC | Rocko (Codex gpt-6.1-sol, d99326cc) | Vikunja 502 on 980cec88c | clean picks407c8d7be/04a86cf33, patch-ids match; whole Node28/28,Python4/4,no skips/timeouts,sweepclear; rerun packet6af85df4b pushed explicitly to rocko/vikunja502-980c-20261022; Sage lands.
+2026-10-22T13:06Z | Dewey (Opus 5.5, 84fb346c) | row 281 (#1786) manifest round 1 on megavolt/row281-e e479521d3 (manifest b73d4c81, 7 paths, on 385a7194c) | APPROVE c30614, rev 3207; N1 hosts.remove/open-decision hint and N2 fire-tool text non-blocking, DEFERRED via Sage
+2026-10-22 11:32 UTC | Sage (Opus 5.5, 1ef1e4f8) | Vikunja 502 landing; 281 and 264a slot reds placed | V502 LANDED 6af85df4b (ff from 980cec88c, Dewey carry dewey-0836). Row 281 c174f37ac and 264a r7 a23afbf95 each went red on first-run test defects. 281 b3 is test-only (T6b ruling accepted by Dewey 0837). 264a r8 pins the 3l seq-0 rows. Megavolt reruns 281 on 6af85df4b.
+2026-10-22 13:10 UTC | Sage (Opus 5.5, 1ef1e4f8) | Rows 278 and 281 landings; slot order 281 then 264a r10 then 253 | 278 LANDED 385a7194c (Webby c30588), 281 LANDED e479521d3 (Dewey c30614). DEFERRED: grant gap closed, N1/N2 open. 264a rebasing to r10 on e479521d3; 253 waits on 264a.
+2026-10-22 14:22 UTC | Sage (Opus 5.5, 1ef1e4f8) | Row 264a landing; doc sweep | 264a LANDED 84f53540d (Duckworth c30640, #1769 closed c30646, P19 463 c669) after four slot reds ruled in mos-1276 to mos-1279. Doc sweep: V502, 278/281 and 264a BUILD-LOG lines, DEFERRED 281 N1/N2 and 264a N1/N2. 253 rebases onto the landing next.

docs/plans/DEFERRED.md

@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
   comes near 64 runs. The follow-up row either raises the cap or splits
   the done. Its test: a fire's done over the cap refuses, and the runs it
   left alive still get the alive flag. (2026-10-22)
-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
-  rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
-  `instance.fire` and row 256's delete revoke only the roles entry's
-  credential services through `revoke()` in `runtime.mjs`. The agent's
-  host grants (row 235) and its Gitea user and token (row 236) stay live
-  until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
-  Console has no revoke route and doesn't say a grant is left. Row 281
-  (#1786) closes it: a fire or a delete revokes every host and Gitea grant
-  the instance holds, fail closed, with a test for each kind. It lands
-  before the .53 Case 1 install hires an instance with a grant.
-  (2026-10-22)
 
 - **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
   (Dewey N7 on row 191, repeated on the Vikunja 502 review.)
@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
   changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
   dies on an assertion. (2026-10-22)
 
+- **Row 274's user reply check is scoped to the thread, not the session.**
+  (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
+  a run answers a user only in reply to that user's message in its thread
+  joins `message_threads` by thread. That holds while a user's thread has
+  only its default session: a user can't call `session.create`, and
+  `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
+  any row that lets a user add sessions: make the check session-scoped and
+  test it with two sessions. (2026-10-22)
+
+- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
+  the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
+  sage-2653.) N1: when a host decision is still open and the host is
+  removed, step G's fire or delete job refuses `host-unknown`, and the
+  inbox hint names a verb that can't help. The way out is to decline or
+  withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
+  near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
+  N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
+  (near :186) doesn't say the fire's job can come back for an answer.
+  Neither changes behaviour. Binds the next row that changes the step G
+  hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
+  both wording gaps and pin the hint in a test. (2026-10-22)
+
+- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
+  (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
+  `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
+  refused call adds one `action.refused` event with code `not-holder`, but
+  not that the event's `actor_run` is the refused run. Binds row 269 (264b,
+  #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
+  in `refusedOnce`. (2026-10-22)
+
+- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
+  N2 on the row 264a manifest round, duckworth-0146.) The webui test
+  "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
+  the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
+  is at base and was not in 264a's manifest. Binds the next gate that
+  touches the webui build: install the pinned esbuild in the gate checkout
+  so the check runs, or record why it can't. (2026-10-22)
+
 ## Queue
 
 Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
   `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
   the host default. The real-model cases this moved off the gate are open
   above.
+- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
+  row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
+  e479521d3. A fire or a delete now runs a step G job that revokes every
+  host and Gitea grant the instance holds, fail closed, and tells the
+  human in the inbox when it can't. Megavolt built it; Dewey approved the
+  design (d6) and the manifest (c30614). The text gaps it left are open
+  above.

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 3194 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3216 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -300,7 +300,7 @@ Generated from `docs/plans/queue.json` revision 3194 by `queue render`. Do not e
 | 261 | Email E05: Graph source module against a test-local registry (post-v1) | unassigned | #1766 | queued | 259 done, 260 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E05 Graph source module against a test-local registry | — |
 | 262 | Email E06: IMAP source module (post-v1) | unassigned | #1767 | queued | 261 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E06 IMAP source module | — |
 | 263 | Email E07: address and rule evaluator (post-v1) | unassigned | #1768 | queued | 258 done, 259 done, 260 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E07 address and rule evaluator | — |
-| 264 | T1 item 7: independent sessions, compaction counts and clear context | gizmoduck; reviewers duckworth | #1769 | in-progress | — | The named reviewer approves the manifest. The design's T1-T7 acceptance tests run whole plus every touched suite on Sage's slot; T3 waits on Vikunja 466 (N2, Claude's compaction count format and the managed dataRoot reader). The design's section 6 mutants are killed. (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | Vikunja 463 (T1 item 7, PRD 1.13 REQ-SESS-1 to 3). Acceptance test T3 depends on Vikunja 466 (N2), mos-1237. v1 under Q211, ahead of Q198 S1. Owner and reviewer to be named (Scrooge approved the design but has no agents/ seat). |
+| 264 | T1 item 7: independent sessions, compaction counts and clear context | gizmoduck; reviewers duckworth | #1769 | done | — | The named reviewer approves the manifest. The design's T1-T7 acceptance tests run whole plus every touched suite on Sage's slot; T3 waits on Vikunja 466 (N2, Claude's compaction count format and the managed dataRoot reader). The design's section 6 mutants are killed. (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | LANDED 84f53540d ff on e479521d3 14:18:23Z, 21 commits = gizmoduck/row264-r13 tip (no rewrite, range-diff identity). Manifest 257408e9 approved Duckworth rev 3214 (c30640). Gate r13 2cc34aef8: 20 files, bus 827, cli 837, webui 345/1 skip, 10 shells; M1-M4 assertion kills (mos-1279 B, M2 4 files). Overlap none (13, 257). N1 actor_run binds row 269; N2 esbuild skip later gate (sage-2695). |
 | 265 | Case 2 C2-09b rooms: room.open, room.send with @tags, room.read | rocko; reviewers dewey | #1770 | queued | 219 done | Dewey approves the manifest. The brief's tests run whole plus the bus suite and every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09b rooms: room.open, room.send with @tags, room.read | — |
 | 266 | Case 2 C2-10c Console room view: merged timeline and @name completion | researcher; reviewers dewey | #1771 | queued | 225 done, 265 done | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every touched suite. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10c Console room view: merged timeline and @name completion | Haiku high subagent under decision 129. |
 | 267 | Case 2 C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | morgana; reviewers filbert | #1772 | queued | 216 done, 217 done, 224 done | Filbert approves the manifest. The brief's tests and the end-to-end crossover run whole plus every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | R8 accepted (sage-2218). Webby's R8 noise note (gosalyn-0127) is for the builder. |
@@ -314,10 +314,10 @@ Generated from `docs/plans/queue.json` revision 3194 by `queue render`. Do not e
 | 275 | 193b1b: viewer verbs and board refusals (also after FED R4 when filed) | morgana; reviewers duckworth | #1780 | briefed | 205 done, 274 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1b, viewer verbs and board refusals | — |
 | 276 | Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts | gander; reviewers duckworth | #1781 | briefed | 253 done | Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_case-sudo-legacy-followup.md` § Brief: supervised legacy AS_USER calls | — |
 | 277 | The owner sees a thread agent's claims: an owner or reader read lists held thread claims (10-27, mos-1262; no user thread live before it) | morgana; reviewers duckworth | #1782 | done | 205 done | Duckworth approves the manifest. The touched test files run whole, the bus and cli suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_owner-thread-claims.md` § Brief: the owner sees thread claims | LANDED 62f53b1e0 ff from 46dedf925 (7 Morgana commits, range patch-id 7f0533520bd2). Duckworth APPROVE manifest e281aa2c (10 paths), comment 30539. Gate 11:01-11:14Z: 7 touched files 0 fail, bus 793, cli 836, harness 151, business 231, seat 167, 10 scripts rc=0, M1-M9 killed; skips named, env only (test-queue root, test-task live x2). Overlap 13/257 clean. N3 per-session claims carry to 264a r7. |
-| 278 | The Console Agents view shows thread claims (follow-up to row 277; no user thread live before it) | gander; reviewers webby | #1783 | briefed | 277 done | Webby approves the manifest. The touched test files run whole, the webui and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_owner-thread-claims.md` § Brief: the Console shows thread claims | — |
+| 278 | The Console Agents view shows thread claims (follow-up to row 277; no user thread live before it) | gander; reviewers webby | #1783 | done | 277 done | Webby approves the manifest. The touched test files run whole, the webui and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_owner-thread-claims.md` § Brief: the Console shows thread claims | LANDED 385a7194c ff on 6af85df4b (9 commits, manifest 8fa859a0). Run 3 green: bus 793/0/0, webui 345/0/1, ten shells 425/0 under SHELL-LIMITS 3x, M1-M6 killed. Runs 1-2 void (fixture fixes 964b6b184, 9696d1fcb per mos-1275). Skips named (Webby N1): webui esbuild 0.28.1/0.28.2 rebuild; test-queue canonical-root check; test-task two live-provider cases (row 244). Webby APPROVE c30588. #1783 closes. |
 | 279 | stopRun reads a live run's status at the deadline: the deadline branch is the only time exit (191 follow-up, MVP, mos-1269; lands before 194 b16) | rocko; reviewers dewey | #1784 | done | — | Dewey approves the manifest. The processing-control package's tests and every other touched test file run whole, the business and cli suites are green on Sage's gate, and M1 is killed. (sage) | `docs/plans/2026-10-22_stoprun-deadline.md` § Brief: stopRun's deadline branch is the only time exit | LANDED ceadad993 (carry of cad927137 onto 343b6dd76: range-diff 1:= 2:=, patch-ids 6d8ae7f4/e484c297 equal, Dewey APPROVE dewey-0809 c30409 + carry). Fix: stopRun loop is for(;;), deadline branch is the only time exit. Sage gate green: business 209/0/0, cli 794/0/0, discord processing+stop 9/0/0; Rocko stop-run 13/13, processing-control 62/62, M1 killed. Overlap sweep clean (13, 257). Next: 194 b16 rebases onto it (mos-1269). |
 | 280 | Bus tests: the scratch sshd proves it owns its port (194 gate follow-up, MVP, mos-1270) | rocko; reviewers duckworth | #1785 | done | — | Duckworth approves the manifest. Both files run whole, the bus suite is green on Sage's gate, the 30-run repeat has no timeout, and M1 is killed. Row 194 b17's full gate then runs on top. Any red goes to Mos (mos-1270). (sage) | `docs/plans/2026-10-22_sshd-port-race.md` § Brief: the scratch sshd's port is ours before a test uses it | Landed b0fd28b6f 07:57:30Z, ff from da5d3651d: b765f5cb8 (Duckworth approve rev 3153, manifest 27806c05) + slim packet. Sage gate bus 656/0/0, ge 41, hr 26 (c30431). Repeat 2010/2010 under cli 1588/1588, no timeout; M1/M2 killed 4/4. Full evidence d6c924764 on rocko/row280-da5d-20261022. N2-N4 carry in BUILD.md. 194 b17 rebases on b0fd28b6f. |
-| 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | in-progress | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | — |
+| 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
 
 <!-- mosaic-queue:end -->
 

docs/plans/queue.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 3194,
+  "revision": 3216,
   "rows": [
     {
       "id": 1,
@@ -26839,7 +26839,7 @@
       "closes": [
         1769
       ],
-      "state": "in-progress",
+      "state": "done",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -26854,16 +26854,70 @@
       "reviewers": [
         "duckworth"
       ],
-      "review": null,
-      "claim": {
-        "seat": "gizmoduck",
-        "op": "gizmoduck-264-claim-1"
+      "review": {
+        "rounds": [
+          {
+            "n": 1,
+            "op": "gizmoduck-264-review-r13b",
+            "by": "gizmoduck",
+            "at": "2026-10-22T14:11:07.284Z",
+            "issue": 1769,
+            "candidate": {
+              "kind": "manifest",
+              "digest": "257408e9e3e9e9bbc751729c2693eb3f199724374ed05db467656a95aa873c8e",
+              "text": "0f14a8e813a75abc8ab2a49d4574496e68a83ae3a37019c5bbfbbbc439fbe2ab  agents/gizmoduck/work/queue-264/BUILD.md\nee456d3f7f5f36c499b1144f5c1a51bd3400662bd576c0a2c403a70cd49772c8  docs/plans/DEFERRED.md\n764b3d7865bfa3a0829f3c7d5553446fc61478cc8b46c0da5dd9463ea7ef1543  packages/bus/README.md\ncd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a  packages/bus/schema.sql\na581d9e687ec2784751e293bd320885ba2ee75cbff38dd0f7f0816c3b6ccf1f1  packages/bus/src/broker.mjs\neb2822c73e527697399691ae520092277ddbd4d2a9a42a0731b3c81cc3569e58  packages/bus/src/migrations/3k-3l.sql\nca4a8eceef394dae290a5ad7bdb9f335ebbe53ba02aa3af71be7001ba2725a93  packages/bus/src/store.mjs\n4e2f46031bb2025bb7d674a7da5b663312ed827d346f354df0453d3595fa8781  packages/bus/tests/account-migration.test.mjs\necf7536dbb12765ef30897fbd0436f68d11233da7e79ff12d4cf80baf3b961fd  packages/bus/tests/chief-of-staff.test.mjs\n7d8ddb1f603bda89488e521e27b68ada373efb19f23864da78613eb14baf6f6d  packages/bus/tests/comment-migration.test.mjs\n45b3a93609179a2f856a9f2620acca2f0b07ab239d2d5957a792d6c6fadeb0af  packages/bus/tests/end-launch.test.mjs\naba9240825a35fdcc741439d0708efa33afcf519d11cac9952c7207ad99250f0  packages/bus/tests/fixtures/schema-3k.sql\n06c33d2101278f71b315327d7be1650d97f828b0dc2aafcc28c73a57d0fe0024  packages/bus/tests/gitea-migration.test.mjs\nb7a560894b9a6eb999b80dc9b2989ac4745b568f74d0b52eec3ab0459b46ad2b  packages/bus/tests/grant-migration.test.mjs\n6e41496a5d55705f484e074e2264a84f5299e04211cd1a2f384f18c5b4f6f9c5  packages/bus/tests/message-filter.test.mjs\nb1921b88ba6ee0c28b4d9652ff529abba4b7e8b12423e99cf7996c3e207ef3f5  packages/bus/tests/name-migration.test.mjs\n52e7de4bdf04f7787f70079f78017fd034abd968370059f22d859ce5a58e27a8  packages/bus/tests/schema.test.mjs\nc09cdcca750d44ae1cebd3e8970708d39edd70682b99eeb77e19258d9fa8c068  packages/bus/tests/sessions.test.mjs\nc2f9002a8ba4474fa1bafc84d8ffd67756d450cf9a1346194a871cd0d541d524  packages/bus/tests/spec-migration.test.mjs\n4fd9c541735a8e654bee84ecab0172f9b1f21c668091fe12624ce812919327e4  packages/bus/tests/tester-writes.test.mjs\n0007f55235ef25e70bf89cfb9407e07c4780b54566163183d19b1f902fc0251e  packages/bus/tests/thread-claims.test.mjs\n19e4200961fd81a23f2bf7089f81b2a57165a6a81c026ef879ab756587d705dc  packages/bus/tests/thread-migration.test.mjs\n90d25f35389478cd3307b2383d93dc0a2519dd88eddc3c26bd37c39161083269  packages/bus/tests/threads.test.mjs\ncdd758deb9bcbb33eb1f4138673a11b9a5fd82fdd4fd88c14197d5240fe4b780  packages/bus/tests/usage-migration.test.mjs\n43f09ab4e7d3f8178a6cab6889ce2d85c83b8151a0f0dc26325d39bbe4236dc0  packages/cli/tests/stack-release.test.mjs\ncf6c1310f32d8495b5838620760646abcff7be0d38924511e14c53528d581802  packages/cli/tests/thread-cli.test.mjs\n4d4885bc624056b559e4c5cbdd7650c4fdeedc83695c8f1884a0bfa27b00a0cf  packages/cli/tests/thread-launch.test.mjs\n3e794faab71337d13a531564183b5e0fd316c666bffbe834c8e5eedf9fad4a6a  packages/webui/tests/chat.test.mjs\nd03dd152cde23c895bfbd07f1df8084925ae6638854d3a99a6aca82779ad4f12  scripts/stack-release.sh\n"
+            },
+            "request": "comment",
+            "attempts": [
+              {
+                "op": "gizmoduck-264-review-r13b",
+                "by": "gizmoduck",
+                "at": "2026-10-22T14:11:07.284Z",
+                "state": "failed",
+                "comment": null,
+                "transport": {
+                  "outcome": "failed",
+                  "status": null,
+                  "comment": null,
+                  "detail": "pre-send: the credential or account check failed"
+                },
+                "resolutions": []
+              },
+              {
+                "op": "sage-264-review-r13b",
+                "by": "sage",
+                "at": "2026-10-22T14:12:46.925Z",
+                "state": "posted",
+                "comment": 30639,
+                "transport": {
+                  "outcome": "posted",
+                  "status": 201,
+                  "comment": 30639,
+                  "detail": "created"
+                },
+                "resolutions": []
+              }
+            ],
+            "duplicateRisk": false,
+            "receipts": [
+              {
+                "reviewer": "duckworth",
+                "op": "duckworth-0146-record",
+                "at": "2026-10-22T14:17:52.013Z",
+                "verdict": "approve",
+                "comment": 30640,
+                "candidate": "257408e9e3e9e9bbc751729c2693eb3f199724374ed05db467656a95aa873c8e"
+              }
+            ]
+          }
+        ]
       },
-      "note": "Vikunja 463 (T1 item 7, PRD 1.13 REQ-SESS-1 to 3). Acceptance test T3 depends on Vikunja 466 (N2), mos-1237. v1 under Q211, ahead of Q198 S1. Owner and reviewer to be named (Scrooge approved the design but has no agents/ seat).",
+      "claim": null,
+      "note": "LANDED 84f53540d ff on e479521d3 14:18:23Z, 21 commits = gizmoduck/row264-r13 tip (no rewrite, range-diff identity). Manifest 257408e9 approved Duckworth rev 3214 (c30640). Gate r13 2cc34aef8: 20 files, bus 827, cli 837, webui 345/1 skip, 10 shells; M1-M4 assertion kills (mos-1279 B, M2 4 files). Overlap none (13, 257). N1 actor_run binds row 269; N2 esbuild skip later gate (sage-2695).",
       "blockedReason": null,
       "createdAt": "2026-10-21T22:42:17.481Z",
-      "updatedAt": "2026-10-22T00:04:18.160Z",
-      "updatedBy": "gizmoduck"
+      "updatedAt": "2026-10-22T14:19:39.888Z",
+      "updatedBy": "sage"
     },
     {
       "id": 265,
@@ -27642,7 +27696,7 @@
       "closes": [
         1783
       ],
-      "state": "briefed",
+      "state": "done",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -27662,12 +27716,69 @@
       "reviewers": [
         "webby"
       ],
-      "review": null,
+      "review": {
+        "rounds": [
+          {
+            "n": 1,
+            "op": "gander-278-inreview-r1",
+            "by": "gander",
+            "at": "2026-10-22T12:34:26.185Z",
+            "issue": 1783,
+            "candidate": {
+              "kind": "manifest",
+              "digest": "8fa859a0c617defe42e50028b057a603c6634f6db47ac2e3f7c01dfb290228a3",
+              "text": "426007525d15ad0fa11ba02d6cc5d8436c7ff3fa38beb01e9a651c202169d6a5  packages/webui/README.md\n7ac85787f614aabce4b8eccef01fcdbf1018003e806c5de97d40f47c4041710a  packages/webui/src/cli.mjs\nc0306a4db82c286826b157cceb036496666f58ce8073d14280e58c10377ed0d0  packages/webui/src/public/bus.js\naa25b50543b5bc632ac984e85b0d8b43b1c9af2d617bfc7c19351d07310f396d  packages/webui/src/serve.mjs\nfd7ad903b682f8f6ceee2d75111b01aa97f50233cd875dd5553e3e83de33ce32  packages/webui/tests/shell.test.mjs\n3b2770db03a2fcce87512b600f386a51f822b251ccb992a46208ee484ee99f7e  packages/webui/tests/thread-claims-browser.test.mjs\n48117fe02ef9b76ad12f15dfb0d25e77d187c088c0bff572f33e18418e566913  packages/webui/tests/thread-claims.test.mjs\n"
+            },
+            "request": "comment",
+            "attempts": [
+              {
+                "op": "gander-278-inreview-r1",
+                "by": "gander",
+                "at": "2026-10-22T12:34:26.185Z",
+                "state": "failed",
+                "comment": null,
+                "transport": {
+                  "outcome": "failed",
+                  "status": null,
+                  "comment": null,
+                  "detail": "pre-send: the credential or account check failed"
+                },
+                "resolutions": []
+              },
+              {
+                "op": "sage-278-review-r1b",
+                "by": "sage",
+                "at": "2026-10-22T12:37:23.447Z",
+                "state": "posted",
+                "comment": 30587,
+                "transport": {
+                  "outcome": "posted",
+                  "status": 201,
+                  "comment": 30587,
+                  "detail": "created"
+                },
+                "resolutions": []
+              }
+            ],
+            "duplicateRisk": false,
+            "receipts": [
+              {
+                "reviewer": "webby",
+                "op": "webby-278-verdict-r1",
+                "at": "2026-10-22T12:38:51.557Z",
+                "verdict": "approve",
+                "comment": 30588,
+                "candidate": "8fa859a0c617defe42e50028b057a603c6634f6db47ac2e3f7c01dfb290228a3"
+              }
+            ]
+          }
+        ]
+      },
       "claim": null,
-      "note": null,
+      "note": "LANDED 385a7194c ff on 6af85df4b (9 commits, manifest 8fa859a0). Run 3 green: bus 793/0/0, webui 345/0/1, ten shells 425/0 under SHELL-LIMITS 3x, M1-M6 killed. Runs 1-2 void (fixture fixes 964b6b184, 9696d1fcb per mos-1275). Skips named (Webby N1): webui esbuild 0.28.1/0.28.2 rebuild; test-queue canonical-root check; test-task two live-provider cases (row 244). Webby APPROVE c30588. #1783 closes.",
       "blockedReason": null,
       "createdAt": "2026-10-22T05:15:43.015Z",
-      "updatedAt": "2026-10-22T05:16:17.583Z",
+      "updatedAt": "2026-10-22T12:40:51.151Z",
       "updatedBy": "sage"
     },
     {
@@ -27860,7 +27971,7 @@
       "closes": [
         1786
       ],
-      "state": "in-progress",
+      "state": "done",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -27880,16 +27991,70 @@
       "reviewers": [
         "dewey"
       ],
-      "review": null,
-      "claim": {
-        "seat": "megavolt",
-        "op": "megavolt-281-claim"
+      "review": {
+        "rounds": [
+          {
+            "n": 1,
+            "op": "megavolt-281-inreview-r1",
+            "by": "megavolt",
+            "at": "2026-10-22T13:01:27.161Z",
+            "issue": 1786,
+            "candidate": {
+              "kind": "manifest",
+              "digest": "b73d4c81d57204c95f86acd1f901ee9cf83619707ccd414406e057866c4dcd56",
+              "text": "7ce8139b6ffa3077d858f0cb059f6d2b8d5c09f6a8acf867611d84830be35868  agents/megavolt/work/queue-281/BUILD.md\n5fb103dccf550a0d0568771ca3ddec47196d7f5f24775501c5aecff7599343db  packages/bus/src/broker.mjs\n6fe79a481bb35c6ab5bcda487bcc346fcb812e8ed96bd62f7198ebb09e6d292a  packages/bus/tests/fire-revokes-grants.test.mjs\n5f9a8b73b6df8b83db990f6c9f15935e51dcc00ddf59d10eabe0f1dfd23d718c  packages/bus/tests/gitea-grant.test.mjs\n88c5193c723f9362008995b46b697b8f455574b3fc2ddc7f31f549082f941efd  packages/bus/tests/grant-executor.test.mjs\ndd3d99d48d28e2a001a013bafb486385c777056ea9d29e9c5ec9e38174aa02cd  packages/bus/tests/lifecycle-revoke.test.mjs\n5ce79205c4ca6e5f6e77671968ce9d8b8ebfdbdde07b31676f2d05b284acb938  packages/cli/tests/lifecycle.test.mjs\n"
+            },
+            "request": "comment",
+            "attempts": [
+              {
+                "op": "megavolt-281-inreview-r1",
+                "by": "megavolt",
+                "at": "2026-10-22T13:01:27.161Z",
+                "state": "failed",
+                "comment": null,
+                "transport": {
+                  "outcome": "failed",
+                  "status": null,
+                  "comment": null,
+                  "detail": "pre-send: the credential or account check failed"
+                },
+                "resolutions": []
+              },
+              {
+                "op": "sage-281-review-r1b",
+                "by": "sage",
+                "at": "2026-10-22T13:02:59.024Z",
+                "state": "posted",
+                "comment": 30613,
+                "transport": {
+                  "outcome": "posted",
+                  "status": 201,
+                  "comment": 30613,
+                  "detail": "created"
+                },
+                "resolutions": []
+              }
+            ],
+            "duplicateRisk": false,
+            "receipts": [
+              {
+                "reviewer": "dewey",
+                "op": "dewey-281-verdict-r1",
+                "at": "2026-10-22T13:05:20.490Z",
+                "verdict": "approve",
+                "comment": 30614,
+                "candidate": "b73d4c81d57204c95f86acd1f901ee9cf83619707ccd414406e057866c4dcd56"
+              }
+            ]
+          }
+        ]
       },
-      "note": null,
+      "claim": null,
+      "note": "LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614.",
       "blockedReason": null,
       "createdAt": "2026-10-22T09:44:24.187Z",
-      "updatedAt": "2026-10-22T09:51:21.600Z",
-      "updatedBy": "megavolt"
+      "updatedAt": "2026-10-22T13:07:09.587Z",
+      "updatedBy": "sage"
     }
   ],
   "log": [
@@ -112108,6 +112273,518 @@
         "receipt": "ok sage-277-done rev 3194 row 277 in-review→done round 1"
       },
       "viewSha": "47105a02fc98e4b65b8f9b39fbbcfea3a7a295516e992e95c26f6e5f2d052fdb"
+    },
+    {
+      "rev": 3195,
+      "op": "gander-278-start",
+      "verb": "move",
+      "args": {
+        "id": 278,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "gander",
+      "at": "2026-10-22T12:04:51.778Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "from": "briefed",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok gander-278-start rev 3195 row 278 briefed→in-progress"
+      },
+      "viewSha": "d3e0918fab9cd369618d3cce25053035c3593cc157ef02b3e67824577540a383"
+    },
+    {
+      "rev": 3196,
+      "op": "gander-278-inreview-r1",
+      "verb": "move",
+      "args": {
+        "id": 278,
+        "to": "in-review",
+        "reason": null,
+        "candidate": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-278/MANIFEST.sha256",
+        "evidence": null,
+        "issue": null
+      },
+      "by": "gander",
+      "at": "2026-10-22T12:34:26.185Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "from": "in-progress",
+        "to": "in-review",
+        "round": 1,
+        "issue": 1783,
+        "candidate": {
+          "kind": "manifest",
+          "digest": "8fa859a0c617defe42e50028b057a603c6634f6db47ac2e3f7c01dfb290228a3",
+          "text": "426007525d15ad0fa11ba02d6cc5d8436c7ff3fa38beb01e9a651c202169d6a5  packages/webui/README.md\n7ac85787f614aabce4b8eccef01fcdbf1018003e806c5de97d40f47c4041710a  packages/webui/src/cli.mjs\nc0306a4db82c286826b157cceb036496666f58ce8073d14280e58c10377ed0d0  packages/webui/src/public/bus.js\naa25b50543b5bc632ac984e85b0d8b43b1c9af2d617bfc7c19351d07310f396d  packages/webui/src/serve.mjs\nfd7ad903b682f8f6ceee2d75111b01aa97f50233cd875dd5553e3e83de33ce32  packages/webui/tests/shell.test.mjs\n3b2770db03a2fcce87512b600f386a51f822b251ccb992a46208ee484ee99f7e  packages/webui/tests/thread-claims-browser.test.mjs\n48117fe02ef9b76ad12f15dfb0d25e77d187c088c0bff572f33e18418e566913  packages/webui/tests/thread-claims.test.mjs\n"
+        },
+        "receipt": "ok gander-278-inreview-r1 rev 3196 row 278 in-progress→in-review round 1 on #1783; request gander-278-inreview-r1 requesting"
+      },
+      "viewSha": "10e0b103a4099660e8e0f332214db3ffec46d7e31afce0be052efa11b29aca43"
+    },
+    {
+      "rev": 3197,
+      "op": "gander-278-inreview-r1.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 278,
+        "attempt": "gander-278-inreview-r1",
+        "outcome": "failed",
+        "status": null,
+        "comment": null,
+        "detail": "pre-send: the credential or account check failed"
+      },
+      "by": "gander",
+      "at": "2026-10-22T12:35:03.307Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "round": 1,
+        "attempt": "gander-278-inreview-r1",
+        "state": "failed",
+        "receipt": "ok gander-278-inreview-r1.outcome rev 3197 row 278 round 1 request gander-278-inreview-r1 failed"
+      },
+      "viewSha": "807e3fdfac503cb45c13b8963b38c9131d36b5c9fdc6a071525ca0a115b2c39b"
+    },
+    {
+      "rev": 3198,
+      "op": "sage-278-review-r1b",
+      "verb": "review-request",
+      "args": {
+        "id": 278
+      },
+      "by": "sage",
+      "at": "2026-10-22T12:37:23.447Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "round": 1,
+        "attempt": "sage-278-review-r1b",
+        "state": "requesting",
+        "receipt": "ok sage-278-review-r1b rev 3198 row 278 round 1 request sage-278-review-r1b requesting"
+      },
+      "viewSha": "6ab64156b87571dcc2e7d9fe0b7750eff8f576419ad147e6af460fd9ba9018b3"
+    },
+    {
+      "rev": 3199,
+      "op": "sage-278-review-r1b.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 278,
+        "attempt": "sage-278-review-r1b",
+        "outcome": "posted",
+        "status": 201,
+        "comment": 30587,
+        "detail": "created"
+      },
+      "by": "sage",
+      "at": "2026-10-22T12:38:00.443Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "round": 1,
+        "attempt": "sage-278-review-r1b",
+        "state": "posted",
+        "receipt": "ok sage-278-review-r1b.outcome rev 3199 row 278 round 1 request sage-278-review-r1b posted comment 30587"
+      },
+      "viewSha": "459834d1aec5d3abd4e09095e189ef39c9696265d30c85a6ee69b1668bfe773d"
+    },
+    {
+      "rev": 3200,
+      "op": "webby-278-verdict-r1",
+      "verb": "review-record",
+      "args": {
+        "id": 278,
+        "verdict": "approve",
+        "comment": 30588,
+        "candidate": "8fa859a0c617defe42e50028b057a603c6634f6db47ac2e3f7c01dfb290228a3"
+      },
+      "by": "webby",
+      "at": "2026-10-22T12:38:51.557Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "round": 1,
+        "verdict": "approve",
+        "receipt": "ok webby-278-verdict-r1 rev 3200 row 278 round 1 approve by webby (comment 30588)"
+      },
+      "viewSha": "7bc559a0a0ee4cd7c6fb80e79dfc96ab797460da2121ec82e784cecb57b72780"
+    },
+    {
+      "rev": 3201,
+      "op": "sage-278-landed-note",
+      "verb": "note",
+      "args": {
+        "id": 278,
+        "text": "LANDED 385a7194c ff on 6af85df4b (9 commits, manifest 8fa859a0). Run 3 green: bus 793/0/0, webui 345/0/1, ten shells 425/0 under SHELL-LIMITS 3x, M1-M6 killed. Runs 1-2 void (fixture fixes 964b6b184, 9696d1fcb per mos-1275). Skips named (Webby N1): webui esbuild 0.28.1/0.28.2 rebuild; test-queue canonical-root check; test-task two live-provider cases (row 244). Webby APPROVE c30588. #1783 closes."
+      },
+      "by": "sage",
+      "at": "2026-10-22T12:40:15.700Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "field": "note",
+        "receipt": "ok sage-278-landed-note rev 3201 row 278 note"
+      },
+      "viewSha": "0c929f230fb391defb269606b2e29c1b3d49bc53723762270d49c71eedd95afb"
+    },
+    {
+      "rev": 3202,
+      "op": "sage-278-done",
+      "verb": "move",
+      "args": {
+        "id": 278,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T12:40:51.151Z",
+      "semantics": 2,
+      "result": {
+        "row": 278,
+        "from": "in-review",
+        "to": "done",
+        "round": 1,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-278-done rev 3202 row 278 in-review→done round 1"
+      },
+      "viewSha": "b9a7f299fbd07afe042bec4491791dd511487e47577e2cf816ef3b00506aca98"
+    },
+    {
+      "rev": 3203,
+      "op": "megavolt-281-inreview-r1",
+      "verb": "move",
+      "args": {
+        "id": 281,
+        "to": "in-review",
+        "reason": null,
+        "candidate": "/mnt/storage/scratch/megavolt-r281/manifest-r1.txt",
+        "evidence": null,
+        "issue": null
+      },
+      "by": "megavolt",
+      "at": "2026-10-22T13:01:27.161Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "from": "in-progress",
+        "to": "in-review",
+        "round": 1,
+        "issue": 1786,
+        "candidate": {
+          "kind": "manifest",
+          "digest": "b73d4c81d57204c95f86acd1f901ee9cf83619707ccd414406e057866c4dcd56",
+          "text": "7ce8139b6ffa3077d858f0cb059f6d2b8d5c09f6a8acf867611d84830be35868  agents/megavolt/work/queue-281/BUILD.md\n5fb103dccf550a0d0568771ca3ddec47196d7f5f24775501c5aecff7599343db  packages/bus/src/broker.mjs\n6fe79a481bb35c6ab5bcda487bcc346fcb812e8ed96bd62f7198ebb09e6d292a  packages/bus/tests/fire-revokes-grants.test.mjs\n5f9a8b73b6df8b83db990f6c9f15935e51dcc00ddf59d10eabe0f1dfd23d718c  packages/bus/tests/gitea-grant.test.mjs\n88c5193c723f9362008995b46b697b8f455574b3fc2ddc7f31f549082f941efd  packages/bus/tests/grant-executor.test.mjs\ndd3d99d48d28e2a001a013bafb486385c777056ea9d29e9c5ec9e38174aa02cd  packages/bus/tests/lifecycle-revoke.test.mjs\n5ce79205c4ca6e5f6e77671968ce9d8b8ebfdbdde07b31676f2d05b284acb938  packages/cli/tests/lifecycle.test.mjs\n"
+        },
+        "receipt": "ok megavolt-281-inreview-r1 rev 3203 row 281 in-progress→in-review round 1 on #1786; request megavolt-281-inreview-r1 requesting"
+      },
+      "viewSha": "64bd164fc938ff48e88bbe1f73b1b2092a44b947ef319f97956425d99324c86b"
+    },
+    {
+      "rev": 3204,
+      "op": "megavolt-281-inreview-r1.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 281,
+        "attempt": "megavolt-281-inreview-r1",
+        "outcome": "failed",
+        "status": null,
+        "comment": null,
+        "detail": "pre-send: the credential or account check failed"
+      },
+      "by": "megavolt",
+      "at": "2026-10-22T13:02:03.649Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "round": 1,
+        "attempt": "megavolt-281-inreview-r1",
+        "state": "failed",
+        "receipt": "ok megavolt-281-inreview-r1.outcome rev 3204 row 281 round 1 request megavolt-281-inreview-r1 failed"
+      },
+      "viewSha": "dffd6ed44dbe0fce968c061f6be08378dde897ddaa251c9b8dd6d2c293fb2db4"
+    },
+    {
+      "rev": 3205,
+      "op": "sage-281-review-r1b",
+      "verb": "review-request",
+      "args": {
+        "id": 281
+      },
+      "by": "sage",
+      "at": "2026-10-22T13:02:59.024Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "round": 1,
+        "attempt": "sage-281-review-r1b",
+        "state": "requesting",
+        "receipt": "ok sage-281-review-r1b rev 3205 row 281 round 1 request sage-281-review-r1b requesting"
+      },
+      "viewSha": "b862b16cf093400a938b3506bace6fae82155c9e651734447760c73f0c20ff8e"
+    },
+    {
+      "rev": 3206,
+      "op": "sage-281-review-r1b.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 281,
+        "attempt": "sage-281-review-r1b",
+        "outcome": "posted",
+        "status": 201,
+        "comment": 30613,
+        "detail": "created"
+      },
+      "by": "sage",
+      "at": "2026-10-22T13:03:38.863Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "round": 1,
+        "attempt": "sage-281-review-r1b",
+        "state": "posted",
+        "receipt": "ok sage-281-review-r1b.outcome rev 3206 row 281 round 1 request sage-281-review-r1b posted comment 30613"
+      },
+      "viewSha": "d4b562903728382f89434caf9e4f41d7ddbaf8daa313f6c5d174bbbab3731ca7"
+    },
+    {
+      "rev": 3207,
+      "op": "dewey-281-verdict-r1",
+      "verb": "review-record",
+      "args": {
+        "id": 281,
+        "verdict": "approve",
+        "comment": 30614,
+        "candidate": "b73d4c81d57204c95f86acd1f901ee9cf83619707ccd414406e057866c4dcd56"
+      },
+      "by": "dewey",
+      "at": "2026-10-22T13:05:20.490Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "round": 1,
+        "verdict": "approve",
+        "receipt": "ok dewey-281-verdict-r1 rev 3207 row 281 round 1 approve by dewey (comment 30614)"
+      },
+      "viewSha": "ed7c23dfa5ee98a2502e4b6410b2527b6f357c775cb6b2afa7386f7feafb50fd"
+    },
+    {
+      "rev": 3208,
+      "op": "sage-281-landed-note",
+      "verb": "note",
+      "args": {
+        "id": 281,
+        "text": "LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614."
+      },
+      "by": "sage",
+      "at": "2026-10-22T13:06:32.779Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "field": "note",
+        "receipt": "ok sage-281-landed-note rev 3208 row 281 note"
+      },
+      "viewSha": "e777e0997655c84a7f3d842126db35fcb0d3e5b02a57aa9358eebda281f49e76"
+    },
+    {
+      "rev": 3209,
+      "op": "sage-281-done",
+      "verb": "move",
+      "args": {
+        "id": 281,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T13:07:09.587Z",
+      "semantics": 2,
+      "result": {
+        "row": 281,
+        "from": "in-review",
+        "to": "done",
+        "round": 1,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-281-done rev 3209 row 281 in-review→done round 1"
+      },
+      "viewSha": "9ac1eeb17b185f038531d58b8ba85ccca0cd9607902614d3b1bc2f5e8085c0c0"
+    },
+    {
+      "rev": 3210,
+      "op": "gizmoduck-264-review-r13b",
+      "verb": "move",
+      "args": {
+        "id": 264,
+        "to": "in-review",
+        "reason": null,
+        "candidate": "/mnt/storage/scratch/gizmo-264-out/manifest-264-r13b.txt",
+        "evidence": null,
+        "issue": null
+      },
+      "by": "gizmoduck",
+      "at": "2026-10-22T14:11:07.284Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "from": "in-progress",
+        "to": "in-review",
+        "round": 1,
+        "issue": 1769,
+        "candidate": {
+          "kind": "manifest",
+          "digest": "257408e9e3e9e9bbc751729c2693eb3f199724374ed05db467656a95aa873c8e",
+          "text": "0f14a8e813a75abc8ab2a49d4574496e68a83ae3a37019c5bbfbbbc439fbe2ab  agents/gizmoduck/work/queue-264/BUILD.md\nee456d3f7f5f36c499b1144f5c1a51bd3400662bd576c0a2c403a70cd49772c8  docs/plans/DEFERRED.md\n764b3d7865bfa3a0829f3c7d5553446fc61478cc8b46c0da5dd9463ea7ef1543  packages/bus/README.md\ncd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a  packages/bus/schema.sql\na581d9e687ec2784751e293bd320885ba2ee75cbff38dd0f7f0816c3b6ccf1f1  packages/bus/src/broker.mjs\neb2822c73e527697399691ae520092277ddbd4d2a9a42a0731b3c81cc3569e58  packages/bus/src/migrations/3k-3l.sql\nca4a8eceef394dae290a5ad7bdb9f335ebbe53ba02aa3af71be7001ba2725a93  packages/bus/src/store.mjs\n4e2f46031bb2025bb7d674a7da5b663312ed827d346f354df0453d3595fa8781  packages/bus/tests/account-migration.test.mjs\necf7536dbb12765ef30897fbd0436f68d11233da7e79ff12d4cf80baf3b961fd  packages/bus/tests/chief-of-staff.test.mjs\n7d8ddb1f603bda89488e521e27b68ada373efb19f23864da78613eb14baf6f6d  packages/bus/tests/comment-migration.test.mjs\n45b3a93609179a2f856a9f2620acca2f0b07ab239d2d5957a792d6c6fadeb0af  packages/bus/tests/end-launch.test.mjs\naba9240825a35fdcc741439d0708efa33afcf519d11cac9952c7207ad99250f0  packages/bus/tests/fixtures/schema-3k.sql\n06c33d2101278f71b315327d7be1650d97f828b0dc2aafcc28c73a57d0fe0024  packages/bus/tests/gitea-migration.test.mjs\nb7a560894b9a6eb999b80dc9b2989ac4745b568f74d0b52eec3ab0459b46ad2b  packages/bus/tests/grant-migration.test.mjs\n6e41496a5d55705f484e074e2264a84f5299e04211cd1a2f384f18c5b4f6f9c5  packages/bus/tests/message-filter.test.mjs\nb1921b88ba6ee0c28b4d9652ff529abba4b7e8b12423e99cf7996c3e207ef3f5  packages/bus/tests/name-migration.test.mjs\n52e7de4bdf04f7787f70079f78017fd034abd968370059f22d859ce5a58e27a8  packages/bus/tests/schema.test.mjs\nc09cdcca750d44ae1cebd3e8970708d39edd70682b99eeb77e19258d9fa8c068  packages/bus/tests/sessions.test.mjs\nc2f9002a8ba4474fa1bafc84d8ffd67756d450cf9a1346194a871cd0d541d524  packages/bus/tests/spec-migration.test.mjs\n4fd9c541735a8e654bee84ecab0172f9b1f21c668091fe12624ce812919327e4  packages/bus/tests/tester-writes.test.mjs\n0007f55235ef25e70bf89cfb9407e07c4780b54566163183d19b1f902fc0251e  packages/bus/tests/thread-claims.test.mjs\n19e4200961fd81a23f2bf7089f81b2a57165a6a81c026ef879ab756587d705dc  packages/bus/tests/thread-migration.test.mjs\n90d25f35389478cd3307b2383d93dc0a2519dd88eddc3c26bd37c39161083269  packages/bus/tests/threads.test.mjs\ncdd758deb9bcbb33eb1f4138673a11b9a5fd82fdd4fd88c14197d5240fe4b780  packages/bus/tests/usage-migration.test.mjs\n43f09ab4e7d3f8178a6cab6889ce2d85c83b8151a0f0dc26325d39bbe4236dc0  packages/cli/tests/stack-release.test.mjs\ncf6c1310f32d8495b5838620760646abcff7be0d38924511e14c53528d581802  packages/cli/tests/thread-cli.test.mjs\n4d4885bc624056b559e4c5cbdd7650c4fdeedc83695c8f1884a0bfa27b00a0cf  packages/cli/tests/thread-launch.test.mjs\n3e794faab71337d13a531564183b5e0fd316c666bffbe834c8e5eedf9fad4a6a  packages/webui/tests/chat.test.mjs\nd03dd152cde23c895bfbd07f1df8084925ae6638854d3a99a6aca82779ad4f12  scripts/stack-release.sh\n"
+        },
+        "receipt": "ok gizmoduck-264-review-r13b rev 3210 row 264 in-progress→in-review round 1 on #1769; request gizmoduck-264-review-r13b requesting"
+      },
+      "viewSha": "7a3ea1661ded736fbe138c569e5ab120d96bd48c8348a394f2da89f669bb7fc9"
+    },
+    {
+      "rev": 3211,
+      "op": "gizmoduck-264-review-r13b.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 264,
+        "attempt": "gizmoduck-264-review-r13b",
+        "outcome": "failed",
+        "status": null,
+        "comment": null,
+        "detail": "pre-send: the credential or account check failed"
+      },
+      "by": "gizmoduck",
+      "at": "2026-10-22T14:11:43.637Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "round": 1,
+        "attempt": "gizmoduck-264-review-r13b",
+        "state": "failed",
+        "receipt": "ok gizmoduck-264-review-r13b.outcome rev 3211 row 264 round 1 request gizmoduck-264-review-r13b failed"
+      },
+      "viewSha": "cadd960bd868b8c63ecb7a1128b9e2628434706849bdcac6f2b8a24c26bc6701"
+    },
+    {
+      "rev": 3212,
+      "op": "sage-264-review-r13b",
+      "verb": "review-request",
+      "args": {
+        "id": 264
+      },
+      "by": "sage",
+      "at": "2026-10-22T14:12:46.925Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "round": 1,
+        "attempt": "sage-264-review-r13b",
+        "state": "requesting",
+        "receipt": "ok sage-264-review-r13b rev 3212 row 264 round 1 request sage-264-review-r13b requesting"
+      },
+      "viewSha": "fe49d268532fe1223929e2c660b3acc815daf109b5607f7909d30c9d53bf18fb"
+    },
+    {
+      "rev": 3213,
+      "op": "sage-264-review-r13b.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 264,
+        "attempt": "sage-264-review-r13b",
+        "outcome": "posted",
+        "status": 201,
+        "comment": 30639,
+        "detail": "created"
+      },
+      "by": "sage",
+      "at": "2026-10-22T14:13:24.411Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "round": 1,
+        "attempt": "sage-264-review-r13b",
+        "state": "posted",
+        "receipt": "ok sage-264-review-r13b.outcome rev 3213 row 264 round 1 request sage-264-review-r13b posted comment 30639"
+      },
+      "viewSha": "a7fb599ce8e5c0320b4b9dbd9f812934b1098406169790370dc37bce946668c1"
+    },
+    {
+      "rev": 3214,
+      "op": "duckworth-0146-record",
+      "verb": "review-record",
+      "args": {
+        "id": 264,
+        "verdict": "approve",
+        "comment": 30640,
+        "candidate": "257408e9e3e9e9bbc751729c2693eb3f199724374ed05db467656a95aa873c8e"
+      },
+      "by": "duckworth",
+      "at": "2026-10-22T14:17:52.013Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "round": 1,
+        "verdict": "approve",
+        "receipt": "ok duckworth-0146-record rev 3214 row 264 round 1 approve by duckworth (comment 30640)"
+      },
+      "viewSha": "765bffd5742a3e0d8fac6bc4971ddba7fea0a937ce63529fd1ff3a82baa66d35"
+    },
+    {
+      "rev": 3215,
+      "op": "sage-264-landed-note",
+      "verb": "note",
+      "args": {
+        "id": 264,
+        "text": "LANDED 84f53540d ff on e479521d3 14:18:23Z, 21 commits = gizmoduck/row264-r13 tip (no rewrite, range-diff identity). Manifest 257408e9 approved Duckworth rev 3214 (c30640). Gate r13 2cc34aef8: 20 files, bus 827, cli 837, webui 345/1 skip, 10 shells; M1-M4 assertion kills (mos-1279 B, M2 4 files). Overlap none (13, 257). N1 actor_run binds row 269; N2 esbuild skip later gate (sage-2695)."
+      },
+      "by": "sage",
+      "at": "2026-10-22T14:19:03.485Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "field": "note",
+        "receipt": "ok sage-264-landed-note rev 3215 row 264 note"
+      },
+      "viewSha": "830e39c04975c14ffe061b4a292ac05b088574a6932f47bd91ac43d982e92ef6"
+    },
+    {
+      "rev": 3216,
+      "op": "sage-264-done",
+      "verb": "move",
+      "args": {
+        "id": 264,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-22T14:19:39.888Z",
+      "semantics": 2,
+      "result": {
+        "row": 264,
+        "from": "in-review",
+        "to": "done",
+        "round": 1,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-264-done rev 3216 row 264 in-review→done round 1"
+      },
+      "viewSha": "e81b02877f6780a2cc04aaa05922ddcfec132716d03de5613412d8c6f85a579a"
     }
   ]
 }

packages/bus/README.md

@@ -241,9 +241,11 @@ a receipt with empty `changes`. A refusal is `action.refused` with its code alon
 | `project.list` | No args; human sessions only. The business's projects, oldest first. |
 | `thread.create` | `{project,name}`; human sessions only. The thread belongs to the caller and to the business's one thread instance (Projects and threads, below). Returns `{id,instance}`. Refuses `project-not-found`, `thread-exists`, `thread-instance-missing` or `thread-instance-ambiguous`. |
 | `thread.list` | `{project?}`; human sessions only. The caller's own threads, oldest first. |
-| `thread.open` | `{thread}`; human sessions only. Records a `thread_opens` row, which asks the launcher to start the thread's session. Returns `{opened}`. |
-| `thread.send` | `{thread,body,class?}`; human sessions only. A message to the thread's instance, in that thread, with its `human.input` event as `request`. Returns `{id,request}`. |
-| `thread.messages` | `{thread,after?,limit?}`; human sessions only. The thread's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the thread), at most `limit` (default 50, 1 to 200). Writes nothing. |
+| `thread.open` | `{thread,session?}`; human sessions only. Records a `thread_opens` row, which asks the launcher to start the thread's session. Returns `{opened}`. |
+| `thread.send` | `{thread,session?,body,class?}`; human sessions only. A message to the thread's instance, in that thread, with its `human.input` event as `request`. Returns `{id,request}`. |
+| `thread.messages` | `{thread,session?,after?,limit?}`; human sessions only. The session's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the session), at most `limit` (default 50, 1 to 200). Writes nothing. |
+| `session.list` | `{thread}`; human and tester sessions (row 264a, #1769). The thread's sessions oldest first, `[{id,at,name,predecessor,default}]`. Writes nothing. |
+| `session.create` | `{thread,name,op}`; human and tester sessions. A new session of the thread, metadata only. A retry with the same `op` and name returns the first row; another name under that `op` refuses `session-op-conflict`, and a taken name `session-exists`. Returns `{id,thread,name}`. |
 
 ### Projects and threads (row 121, #1615)
 
@@ -311,6 +313,42 @@ the threads they made. A revoked run can't claim its thread again (`run-revoked`
 thread run can still be stopped another way: the launcher stops it once the thread is idle, the
 human stops it with `mosaic stop <run>`, and the run's end releases its claim. `thread_revoke_needs_decision` guards the table against a direct write.
 
+### Sessions (row 264a, #1769)
+
+Schema `3l` puts sessions below a thread. `sessions` and `session_defaults` are new and
+append-only. `thread_claims`, `message_threads` and `thread_opens` each gain a `session`
+column, and `thread_claims` gains `generation`, the claim's number in its session counting
+from 1. A release or revoke carries its claim's number.
+
+Every thread has a default session, the latest `session_defaults` row (D3). `thread.create`
+writes one with a random id. The 3k→3l step gives each existing thread a default session whose
+id is the thread's own, named `default` with op `legacy-3l`, and files every old claim, message
+and open under it. A thread verb, or a `bindLaunch` record, that names no `session` works the
+default, so a client from before 3l keeps working. A `session` from another thread refuses
+`session-not-found`, and a non-thread role that names one refuses `thread-not-allowed`.
+
+The thread rules above hold per session. One run holds a session at a time, and a run holds at
+most one session in its business, while sibling sessions of a thread may each have a holder.
+A thread run receives and replies in its own session, and the chief of staff's reply returns
+to the session that sent the work. `threadsState` and `threadIdle` keep one row per thread,
+computed on its default session; 264b's launcher starts the others.
+
+A thread run's claim fences by generation (T2). A run acts only while its session's latest claim
+row has the generation of the run's own latest claim. After a release or revoke, once another run
+claims the session, the old run's `decision.withdraw`, `message.receive` and `message.read`
+refuse `not-holder` and write nothing.
+
+`thread.create` writes the default session with op `default`, so a `session.create` retry naming
+`default` with op `default` answers with it. A migrated thread's default has op `legacy-3l`, and
+the same retry there refuses `session-exists`.
+
+The triggers check that a session has its thread's business, instance and owner, that its
+predecessor and any default, claim, message or open name a session of the same thread, and that
+a claim's generation is the one its session expects. `delivery_same_session` replaces
+`delivery_same_thread`. `sessions_id_not_thread` and `threads_id_not_session` keep a session id
+from naming another thread and a thread id from naming a session. A 3k engine refuses a 3l
+store with `schema-mismatch`.
+
 ### Agent state (row 59, #1548)
 
 For a human or reader session, `agents` derives each held role's state from
@@ -349,8 +387,9 @@ Thread claims (row 277, #1782): a thread run's `role.claim` claims its thread
 in `thread_claims`, which `agents` doesn't read, so `agents` lists roles only.
 `thread.claims` takes no arguments and lists the held thread claims in the
 business, oldest thread first, as `{thread, instance, holder_run, harness,
-at}`. A claim is held while its thread's latest `thread_claims` row is a
-claim, so a released or revoked thread drops out. Human and reader sessions
+at}`. A claim is held while its session's latest `thread_claims` row is a
+claim (row 264a), so a released or revoked session drops out and a thread
+with two held sessions lists twice. Human and reader sessions
 only: a role session refuses `human-required` and the tester
 `tester-refused`. The result carries the thread id but never its name, which
 a user wrote, nor any message. `mosaic agents` prints these as `thread` lines
@@ -727,10 +766,10 @@ scope probes and rotation/expiry notifications; S2 never probes real services.
 
 ## Schema and verification
 
-`schema.sql` is v3k, SHA-256
-`aba9240825a35fdcc741439d0708efa33afcf519d11cac9952c7207ad99250f0`.
-It has 20 tables, 72 triggers and five views. Source digest and a trusted full
-sqlite_master digest are checked at open, alongside schema version `3k`, WAL,
+`schema.sql` is v3l, SHA-256
+`cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a`.
+It has 22 tables, 87 triggers and five views. Source digest and a trusted full
+sqlite_master digest are checked at open, alongside schema version `3l`, WAL,
 quick_check and foreign-key integrity. Missing metadata refuses; it never
 reinitializes an existing file. Full synchronous WAL transactions either commit
 or roll back. SQL UPDATE, DELETE and INSERT OR REPLACE refuse on evidence tables.

packages/bus/schema.sql

@@ -248,11 +248,34 @@ CREATE TABLE threads (
   name TEXT NOT NULL,
   UNIQUE (project, name)
 ) STRICT;
+CREATE TABLE sessions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  op TEXT NOT NULL,
+  predecessor TEXT REFERENCES sessions(id),
+  UNIQUE (thread, name),
+  UNIQUE (thread, op)
+) STRICT;
+CREATE TABLE session_defaults (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
 CREATE TABLE thread_claims (
   seq INTEGER PRIMARY KEY AUTOINCREMENT,
   at TEXT NOT NULL,
   business TEXT NOT NULL,
   thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  generation INTEGER NOT NULL CHECK (generation >= 1),
   op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
   holder_run TEXT NOT NULL,
   harness TEXT NOT NULL, address TEXT,
@@ -261,55 +284,95 @@ CREATE TABLE thread_claims (
 ) STRICT;
 CREATE TABLE message_threads (
   message TEXT PRIMARY KEY REFERENCES messages(id),
-  thread TEXT NOT NULL REFERENCES threads(id)
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id)
 ) STRICT;
 CREATE TABLE thread_opens (
   seq INTEGER PRIMARY KEY AUTOINCREMENT,
   at TEXT NOT NULL,
   thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
   by TEXT NOT NULL
 ) STRICT;
 CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX thread_claims_session ON thread_claims (session, seq);
 CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE INDEX message_threads_session ON message_threads (session);
+CREATE INDEX session_defaults_thread ON session_defaults (thread, seq);
 CREATE TRIGGER threads_project_business BEFORE INSERT ON threads
   WHEN (SELECT business FROM projects WHERE id = NEW.project) IS NOT NEW.business
   BEGIN SELECT RAISE(ABORT, 'a thread belongs to its project''s business'); END;
+CREATE TRIGGER sessions_thread_match BEFORE INSERT ON sessions
+  WHEN NOT EXISTS (SELECT 1 FROM threads t WHERE t.id = NEW.thread AND t.business = NEW.business AND t.instance = NEW.instance AND t.owner = NEW.owner)
+  BEGIN SELECT RAISE(ABORT, 'a session has its thread''s business, instance and owner'); END;
+CREATE TRIGGER sessions_predecessor BEFORE INSERT ON sessions
+  WHEN NEW.predecessor IS NOT NULL AND (SELECT thread FROM sessions WHERE id = NEW.predecessor) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a session''s predecessor is in its thread'); END;
+CREATE TRIGGER sessions_id_not_thread BEFORE INSERT ON sessions
+  WHEN NEW.id IS NOT NEW.thread AND EXISTS (SELECT 1 FROM threads WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a session id names another thread'); END;
+CREATE TRIGGER threads_id_not_session BEFORE INSERT ON threads
+  WHEN EXISTS (SELECT 1 FROM sessions WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a thread id names a session'); END;
+CREATE TRIGGER session_defaults_match BEFORE INSERT ON session_defaults
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a default session is in its thread'); END;
 CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
-  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) = 'claim'
-  BEGIN SELECT RAISE(ABORT, 'thread already held'); END;
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session already held'); END;
 CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
   WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
-    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = c.thread) AND c.op = 'claim')
-  BEGIN SELECT RAISE(ABORT, 'run already holds a thread'); END;
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE session = c.session) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a session'); END;
 CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
-  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1),'') <> 'claim'
-  BEGIN SELECT RAISE(ABORT, 'thread is not held'); END;
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session is not held'); END;
 CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
-  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
   BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_claim_generation BEFORE INSERT ON thread_claims
+  WHEN NEW.generation IS NOT (CASE WHEN NEW.op = 'claim'
+    THEN 1 + (SELECT count(*) FROM thread_claims WHERE session = NEW.session AND op = 'claim')
+    ELSE (SELECT generation FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) END)
+  BEGIN SELECT RAISE(ABORT, 'a claim row names its session''s generation'); END;
 CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
   WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
   BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
 CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
   WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
   BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER thread_claims_session BEFORE INSERT ON thread_claims
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a claim''s session is in its thread'); END;
 CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
   WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
     WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
   BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
-CREATE TRIGGER delivery_same_thread BEFORE INSERT ON deliveries
+CREATE TRIGGER message_threads_session BEFORE INSERT ON message_threads
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a threaded message''s session is in its thread'); END;
+CREATE TRIGGER thread_opens_session BEFORE INSERT ON thread_opens
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'an open''s session is in its thread'); END;
+CREATE TRIGGER delivery_same_session BEFORE INSERT ON deliveries
   WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
     AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
       WHERE mt.message = NEW.message AND m.to_role = t.instance
-        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = t.id)
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE session = mt.session)
           AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
-  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its thread''s holder'); END;
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its session''s holder'); END;
 CREATE TRIGGER projects_no_update BEFORE UPDATE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
 CREATE TRIGGER projects_no_delete BEFORE DELETE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
 CREATE TRIGGER projects_no_replace BEFORE INSERT ON projects WHEN EXISTS (SELECT 1 FROM projects WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
 CREATE TRIGGER threads_no_update BEFORE UPDATE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
 CREATE TRIGGER threads_no_delete BEFORE DELETE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
 CREATE TRIGGER threads_no_replace BEFORE INSERT ON threads WHEN EXISTS (SELECT 1 FROM threads WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER sessions_no_update BEFORE UPDATE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_delete BEFORE DELETE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_replace BEFORE INSERT ON sessions WHEN EXISTS (SELECT 1 FROM sessions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER session_defaults_no_update BEFORE UPDATE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_delete BEFORE DELETE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_replace BEFORE INSERT ON session_defaults WHEN EXISTS (SELECT 1 FROM session_defaults WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
 CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
 CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
 CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;

packages/bus/src/broker.mjs

@@ -125,11 +125,16 @@ export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'm
   'usage', 'names', 'limits', 'plugins', 'instances', 'project.list', 'thread.list', 'name.set', 'project.create', 'credentials',
   'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop',
   // Row 194 (#1692, D4.1): launch and terminate, and the read of the requests they make.
-  'instance.launch', 'instance.end', 'instance.request']);
+  'instance.launch', 'instance.end', 'instance.request',
+  // Row 264a (#1769): the sessions of the tester's own threads.
+  'session.list', 'session.create']);
 // FED R3 (#414, federation design 3.5): the collaborator level is this exact list. Every other verb
 // refuses a user access-refused before its own checks: owner verbs, board reads, message.*,
 // decision.*, project files, spec.read, assistant.stop, launch.*, name.set and usage.*.
 export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
+// Row 252 (#1753, design sections 2-3): the only verbs a Console owner cap reaches. Every other verb
+// refuses it human-required before its own checks, and these refuse every other cap.
+export const CONSOLE_VERBS = Object.freeze(['decision.preview.console', 'decision.resolve.console']);
 // The level a user's grant must reach for USER_VERBS (R1's covers, morgana-0005).
 const USER_LEVEL = 'collaborator';
 // Row 175: the organization verbs a tester may call. Its writes run every check the human's do
@@ -460,6 +465,8 @@ export class Broker {
       'task_snapshots',
       'projects',
       'threads',
+      'sessions',
+      'session_defaults',
       'thread_claims',
       'thread_opens',
     ]) {
@@ -580,14 +587,26 @@ export class Broker {
   #threaded(business, role) {
     return this.#business(business).roles[role]?.definition === THREAD_DEFINITION;
   }
-  #threadHolder(thread) {
-    return this.#store.get('SELECT * FROM thread_claims WHERE thread=? ORDER BY seq DESC LIMIT 1', thread);
+  // Row 264a (#1769): a claim holds one session of a thread, and each session has its own holder.
+  #sessionHolder(session) {
+    return this.#store.get('SELECT * FROM thread_claims WHERE session=? ORDER BY seq DESC LIMIT 1', session);
   }
-  // Row 155 (#1649): the held claims of every thread of a thread instance, oldest thread first, or
+  // D3: the thread's default session, the latest session_defaults row. thread.create and the 3k-3l
+  // migration write one for every thread.
+  #defaultSession(thread) {
+    return this.#store.get('SELECT session FROM session_defaults WHERE thread=? ORDER BY seq DESC LIMIT 1', thread)?.session ?? fail('session-not-found');
+  }
+  // The session a thread verb names, or the thread's default when it names none.
+  #threadSession(t, session) {
+    if (session === undefined) return this.#defaultSession(t.id);
+    if (!this.#store.get('SELECT 1 FROM sessions WHERE id=? AND thread=?', identifier(session), t.id)) fail('session-not-found');
+    return session;
+  }
+  // Row 155 (#1649): the held claims of every session of a thread instance, oldest thread first, or
   // only the threads `owner` made. An end of the instance ends each of them.
   #threadHolders(business, instance, owner = null) {
     return this.#store.all(
-      "SELECT c.* FROM threads t JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE thread=t.id) WHERE t.business=? AND t.instance=? AND (? IS NULL OR t.owner=?) AND c.op='claim' ORDER BY t.seq",
+      "SELECT c.* FROM threads t JOIN sessions se ON se.thread=t.id JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE session=se.id) WHERE t.business=? AND t.instance=? AND (? IS NULL OR t.owner=?) AND c.op='claim' ORDER BY t.seq, se.seq",
       business,
       instance,
       owner,
@@ -685,23 +704,23 @@ export class Broker {
     if (r.by === 'tester' && this.#testerOn(business) !== true) return 'tester-off';
     return null;
   }
-  // The claim a run acts under: its thread's for a thread run, its role's otherwise.
+  // The claim a run acts under: its session's for a thread run, its role's otherwise.
   #own(s) {
-    return s.thread ? this.#threadHolder(s.thread) : this.#holder(s.business, s.role);
+    return s.thread ? this.#sessionHolder(s.session) : this.#holder(s.business, s.role);
   }
-  // Who a message to `to` goes to now: the thread's holder when the message is in a thread of
-  // `to`, the role's otherwise. Null while nobody holds it, and the message waits.
-  #recipient(business, to, thread) {
-    const h = thread && this.#threaded(business, to) ? this.#threadHolder(thread) : this.#holder(business, to);
+  // Who a message to `to` goes to now: the session's holder when the message is in a session of a
+  // thread of `to`, the role's otherwise. Null while nobody holds it, and the message waits.
+  #recipient(business, to, session) {
+    const h = session && this.#threaded(business, to) ? this.#sessionHolder(session) : this.#holder(business, to);
     return h?.op === 'claim' ? h : null;
   }
-  // The thread a new message belongs to (REQ-MSG-1). A thread run's message is in its thread.
-  // A message to a thread instance from anyone else is in the thread of the nearest message up
-  // its in_reply_to chain that has one, so the chief of staff's reply returns to the thread
+  // The session a new message belongs to (REQ-MSG-1). A thread run's message is in its session.
+  // A message to a thread instance from anyone else is in the session of the nearest message up
+  // its in_reply_to chain that has one, so the chief of staff's reply returns to the session
   // that sent the work. Messages are append-only and in_reply_to names an earlier message, so
   // the chain has an end; `seen` stops the walk there and needs no depth constant.
-  #threadFor(s, to, inReplyTo) {
-    if (s.thread) return s.thread;
+  #sessionFor(s, to, inReplyTo) {
+    if (s.thread) return s.session;
     if (!this.#threaded(s.business, to)) return null;
     // The user names the thread with thread.send, which checks the owner (REQ-USER-2).
     if (s.human || s.user) fail('thread-required-use-thread-send');
@@ -709,18 +728,20 @@ export class Broker {
     for (let at = inReplyTo ?? null; at !== null && !seen.has(at); ) {
       seen.add(at);
       const m = this.#store.get(
-        'SELECT m.in_reply_to, m.from_role, m.body, t.thread FROM messages m LEFT JOIN message_threads t ON t.message=m.id WHERE m.id=? AND m.business=?',
+        'SELECT m.in_reply_to, m.from_role, m.body, t.thread, t.session FROM messages m LEFT JOIN message_threads t ON t.message=m.id WHERE m.id=? AND m.business=?',
         at,
         s.business,
       );
       if (m?.thread) {
         if (this.#store.get('SELECT instance FROM threads WHERE id=?', m.thread).instance !== to) fail('thread-instance-mismatch');
-        return this.#testerOwns(s, m.thread);
+        this.#testerOwns(s, m.thread);
+        return m.session;
       }
-      // Row 143: a chain that reaches a spec notice belongs to the user's thread in that notice's project.
+      // Row 143: a chain that reaches a spec notice belongs to the user's thread in that notice's
+      // project, in its default session.
       if (m?.from_role === NOTICE_ROLE && m.body.startsWith(SPEC_NOTICE)) {
         const spec = this.#specThread(s, to, m.body);
-        if (spec) return this.#testerOwns(s, spec);
+        if (spec) return this.#defaultSession(this.#testerOwns(s, spec));
       }
       at = m?.in_reply_to ?? null;
     }
@@ -794,9 +815,15 @@ export class Broker {
     if (s.reader) fail('read-only');
     if (s.human) fail('agent-required');
     const h = this.#own(s);
-    if (h?.op !== 'claim' || h.holder_run !== s.run) fail('not-holder');
+    if (h?.op !== 'claim' || (s.thread ? h.generation !== this.#runGeneration(s) : h.holder_run !== s.run)) fail('not-holder');
     return h;
   }
+  // Row 264a (#1769, T2): the generation a thread run holds, its latest claim's in its session, or
+  // null if it never claimed. Once another run claims the session, the run's own generation is
+  // retired, and #agent refuses its approvals, deliveries and reads.
+  #runGeneration(s) {
+    return this.#store.get("SELECT max(generation) AS g FROM thread_claims WHERE session=? AND holder_run=? AND op='claim'", s.session, s.run).g;
+  }
   #human(s) {
     if (s.reader) fail('read-only');
     if (!s.human || s.via !== 'cli' || s.outsideAgent !== true) fail('human-required');
@@ -832,26 +859,30 @@ export class Broker {
     const key = record.business + ':' + identifier(record.run);
     const session = this.#runs.get(key) ?? fail('unknown-run');
     if (this.#ended.has(key)) fail('run-ended');
-    // A run holds at most one thread, so this also refuses another thread and a non-thread run.
+    // A run holds at most one session, so this also refuses another thread and a non-thread run.
+    // Row 264a: the row is the thread's default session's, so a run of another session is refused too.
     const [t] = this.#threadRows('t.business=? AND t.id=?', record.business, identifier(record.thread));
     if (t?.holder !== record.run) fail('not-holder');
     if (t.pending || t.unread) return { released: false, pending: t.pending, unread: t.unread };
-    this.#store.transaction(() => this.#claimEnd(session, this.#threadHolder(t.thread), 'release', null));
+    this.#store.transaction(() => this.#claimEnd(session, this.#own(session), 'release', null));
     return { released: true };
   }
+  // Row 264a (#1769): each row is the thread's default session's. Until 264b the launcher starts
+  // default sessions only, so another session's messages wait.
   #threadRows(where, ...params) {
     return this.#store
       .all(
         `SELECT t.id, t.instance,
-          (SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.thread=t.id AND m.to_role=t.instance
+          (SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session AND m.to_role=t.instance
             AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op IN ('delivered','read'))) AS pending,
-          (SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.thread=t.id AND m.to_role=t.instance
+          (SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session AND m.to_role=t.instance
             AND c.op='claim' AND EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op='delivered' AND d.holder_run=c.holder_run)
             AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op='read')) AS unread,
-          (SELECT max(m.at) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.thread=t.id) AS last_message,
-          (SELECT max(at) FROM thread_opens WHERE thread=t.id) AS last_open,
+          (SELECT max(m.at) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session) AS last_message,
+          (SELECT max(at) FROM thread_opens WHERE session=ds.session) AS last_open,
           c.at AS claim_at, c.op AS claim_op, c.holder_run AS holder_run
-        FROM threads t LEFT JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE thread=t.id)
+        FROM threads t JOIN session_defaults ds ON ds.seq=(SELECT max(seq) FROM session_defaults WHERE thread=t.id)
+          LEFT JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE session=ds.session)
         WHERE ${where} ORDER BY t.seq`,
         ...params,
       )
@@ -870,7 +901,7 @@ export class Broker {
   bindLaunch(record) {
     keys(
       record,
-      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'provider', 'model', 'account', 'transcript'],
+      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'session', 'provider', 'model', 'account', 'transcript'],
       ['business', 'role', 'run', 'harness'],
     );
     const b = this.#business(identifier(record.business));
@@ -893,10 +924,13 @@ export class Broker {
       if (record.thread === undefined) fail('thread-required');
       if (!this.#store.get('SELECT 1 FROM threads WHERE id=? AND business=? AND instance=?', identifier(record.thread), record.business, record.role))
         fail('thread-not-found');
-    } else if (record.thread !== undefined) fail('thread-not-allowed');
+    } else if (record.thread !== undefined || record.session !== undefined) fail('thread-not-allowed');
+    // Row 264a (#1769): a thread run works one session of its thread, the thread's default when the
+    // record names none (D3).
+    const bound = record.thread === undefined ? null : this.#threadSession({ id: record.thread }, record.session);
     const key = record.business + ':' + record.run;
     if (this.#runs.has(key)) fail('duplicate-run');
-    const session = { ...record, address: record.address ?? null, thread: record.thread ?? null, human: false };
+    const session = { ...record, address: record.address ?? null, thread: record.thread ?? null, session: bound, human: false };
     this.#secretCheck(record);
     const old = this.#store.get(
       "SELECT actor_role,body FROM events WHERE business=? AND kind='session.launched' AND subject=? ORDER BY seq LIMIT 1",
@@ -910,6 +944,8 @@ export class Broker {
       pid: record.pid ?? null,
       startTime: record.startTime ?? null,
       ...(record.thread === undefined ? {} : { thread: record.thread }),
+      // A record without a session keeps the body it had before row 264a.
+      ...(record.session === undefined ? {} : { session: record.session }),
     };
     // A run an earlier broker bound is bound again unchanged (the host's recover()), even after its
     // harness was switched off, so it can be ended.
@@ -989,6 +1025,26 @@ export class Broker {
     if (!this.#userGrants(s).length) fail('access-revoked');
     return this.#cap(s);
   }
+  // Row 252 (#1753, design section 2): the trusted Console transport invokes this only after
+  // verifyPrincipal checked the console-cli wrapper, its webui `serve` parent and the signed-in owner.
+  // The cap is the business human's with via 'console' and the owner subject. request() lets it reach
+  // CONSOLE_VERBS only, and #human refuses it, so no cli verb accepts it.
+  bindConsole(record) {
+    keys(record, ['business', 'human', 'subject'], ['business', 'human', 'subject']);
+    const b = this.#business(record.business);
+    const x = record.subject;
+    if (record.human !== b.human || !object(x) || Object.keys(x).length !== 3 ||
+      !['provider', 'iss', 'sub'].every((k) => typeof x[k] === 'string' && x[k].length > 0 && x[k].length <= 512))
+      fail('human-required');
+    return this.#cap({
+      business: record.business,
+      human: b.human,
+      via: 'console',
+      console: Object.freeze({ provider: x.provider, iss: x.iss, sub: x.sub }),
+      role: null,
+      run: null,
+    });
+  }
   bindReader({ business }) {
     this.#business(business);
     return this.#cap({ business, reader: true, role: null, run: null, human: false });
@@ -1037,10 +1093,61 @@ export class Broker {
     const raise = this.#raised(business, decision);
     if (d?.action !== 'credential.mint' || d.route_to !== 'human' || !raise?.grant) return null;
     const r = this.#closed(decision);
-    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.via !== 'cli' || r.by !== this.#business(business).human)
-      return null;
+    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.by !== this.#business(business).human) return null;
+    // Row 252 (#1753, design section 3, J14): a console close counts only with its own human.input,
+    // which only the broker writes (recordEvent reserves the kind).
+    if (!(r.via === 'console' ? this.#consoleInput(business, decision, r) : r.via === 'cli')) return null;
     return raise.grant;
   }
+  // Row 252: the console answer's human.input for close row r. Same decision, same seq, same choice,
+  // no role or run, and a three-string owner subject.
+  #consoleInput(business, decision, r) {
+    const e = this.#store.get(
+      `SELECT body FROM events WHERE business=? AND kind='human.input' AND subject=? AND actor_role IS NULL AND actor_run IS NULL
+       AND json_extract(body,'$.via')='console' AND json_extract(body,'$.decisionSeq')=? ORDER BY seq LIMIT 1`,
+      business,
+      decision,
+      r.seq,
+    );
+    const x = e && JSON.parse(e.body);
+    return (
+      !!x &&
+      x.kind === 'answer' &&
+      x.decision === decision &&
+      x.op === 'resolved' &&
+      x.choice === r.choice &&
+      object(x.subject) &&
+      ['provider', 'iss', 'sub'].every((k) => typeof x.subject[k] === 'string' && x.subject[k].length > 0)
+    );
+  }
+  // Row 252 (design section 1): a Console-eligible grant request, or null. Open is the caller's
+  // check. Eligible is route_to human, action credential.mint, a raise with a validated grant binding
+  // and exactly two distinct option keys, one of them approvalChoice. Approve is that key and deny is
+  // the other. The summary carries only the binding's method, agent, host and target projects. The
+  // digest binds the id, business, options, approval key and binding, so any change reads stale.
+  #consoleResolution(d) {
+    if (d.route_to !== 'human' || d.action !== 'credential.mint') return null;
+    const raise = this.#raised(d.business, d.id);
+    if (!object(raise?.grant) || typeof raise.grant.method !== 'string') return null;
+    const options = JSON.parse(d.options);
+    if (options.length !== 2 || options[0].key === options[1].key) return null;
+    const approve = options.find((o) => o.key === raise.approvalChoice);
+    if (!approve) return null;
+    const deny = options.find((o) => o.key !== raise.approvalChoice);
+    const g = raise.grant;
+    const grant = {
+      method: g.method,
+      ...(typeof g.agent === 'string' ? { agent: g.agent } : {}),
+      ...(typeof g.host === 'string' ? { host: g.host } : {}),
+      ...(Array.isArray(g.target?.projects) ? { projects: g.target.projects.filter((p) => typeof p === 'string') } : {}),
+    };
+    return {
+      approve: { key: approve.key, text: approve.text },
+      deny: { key: deny.key, text: deny.text },
+      grant,
+      digest: sha256(JSON.stringify([d.id, d.business, options, raise.approvalChoice, raise.grant])),
+    };
+  }
   // r6 X1: the executor's own spend. The caller owns the transaction. The consume record is the only
   // guarded body with `decision` (#436b section 7), so #spent counts it.
   #consumeGrant(business, decision, method) {
@@ -1078,14 +1185,14 @@ export class Broker {
   // close is.
   #grantNotice(business, decision, body) {
     const d = this.#store.get('SELECT raised_by_role,raised_by_run FROM decisions WHERE id=?', decision);
-    const thread = this.#threaded(business, d.raised_by_role)
+    const session = this.#threaded(business, d.raised_by_role)
       ? (this.#store.get(
-          "SELECT thread FROM thread_claims WHERE business=? AND holder_run=? AND op='claim' ORDER BY seq DESC LIMIT 1",
+          "SELECT session FROM thread_claims WHERE business=? AND holder_run=? AND op='claim' ORDER BY seq DESC LIMIT 1",
           business,
           d.raised_by_run,
-        )?.thread ?? null)
+        )?.session ?? null)
       : null;
-    for (const [to, t] of [['human', null], [d.raised_by_role, thread]]) {
+    for (const [to, t] of [['human', null], [d.raised_by_role, session]]) {
       const mid = randomUUID();
       this.#store.run(
         'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
@@ -3735,7 +3842,7 @@ export class Broker {
       null,
       body,
     );
-    this.#route(s.business, mid, s.role, s.thread);
+    this.#route(s.business, mid, s.role, s.session);
   }
   // Trusted launcher API: whether the role, in the thread (null for a role run), holds a merge
   // decision a landing could use: cross-role, raised there with a task ref as its target, resolved
@@ -4079,6 +4186,9 @@ export class Broker {
         grants = this.#userGrants(s);
         if (!grants.length) fail('access-revoked');
       }
+      // Row 252 (design section 2, N4): a console cap reaches the two console verbs only, and nothing
+      // else reaches them. decision.resolve stays off the list.
+      if (!!s.console !== CONSOLE_VERBS.includes(request.verb)) fail('human-required');
       const args = request.args ?? {};
       if (!object(args)) fail('invalid-request');
       this.#secretCheck(args);
@@ -4601,6 +4711,7 @@ export class Broker {
     const s = this.#session(cap);
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       this.#processingWork();
       keys(request, ['verb', 'args'], ['verb']);
       if (!TASK_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -4639,6 +4750,7 @@ export class Broker {
     let args;
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       keys(request, ['verb', 'args'], ['verb']);
       this.#processingWork();
       if (!verb) fail('unknown-verb');
@@ -4698,6 +4810,7 @@ export class Broker {
     let a, entry, timeout, bound;
     try {
       if (s.user) fail('access-refused');
+      if (s.console) fail('human-required');
       this.#processingWork();
       keys(request, ['verb', 'args'], ['verb']);
       if (!HOST_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -4775,22 +4888,25 @@ export class Broker {
         keys(a, []);
         if (s.human) fail('agent-required');
         // Row 121: a thread run claims its thread, so idle threads hold nothing (REQ-THREAD-2).
+        // Row 264a (#1769): the claim is the run's session's, with the session's next generation.
         if (s.thread) {
-          if (this.#store.get("SELECT 1 FROM thread_claims WHERE thread=? AND holder_run=? AND op='revoke' LIMIT 1", s.thread, s.run))
+          if (this.#store.get("SELECT 1 FROM thread_claims WHERE session=? AND holder_run=? AND op='revoke' LIMIT 1", s.session, s.run))
             fail('run-revoked');
-          if (this.#threadHolder(s.thread)?.op === 'claim') fail('thread-already-held');
+          if (this.#sessionHolder(s.session)?.op === 'claim') fail('thread-already-held');
           this.#store.run(
-            'INSERT INTO thread_claims(at,business,thread,op,holder_run,harness,address,by) VALUES(?,?,?,?,?,?,?,?)',
+            "INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,address,by) VALUES(?,?,?,?,1+(SELECT count(*) FROM thread_claims WHERE session=? AND op='claim'),?,?,?,?,?)",
             this.#now(),
             s.business,
             s.thread,
+            s.session,
+            s.session,
             'claim',
             s.run,
             s.harness,
             s.address,
             by,
           );
-          this.#routeThread(s.thread);
+          this.#routeSession(s.session);
           return { role: s.role, run: s.run, thread: s.thread };
         }
         if (
@@ -4842,7 +4958,8 @@ export class Broker {
           identifier(a.decision);
           this.#consumeAuthority(s, 'role.revoke', { decision: a.decision, target: a.role });
         }
-        // Row 155 (#1649): a thread instance holds a claim per thread, so the end revokes each one.
+        // Row 155 (#1649): a thread instance holds a claim per held thread session (264a), so the end
+        // revokes each one.
         if (this.#threaded(s.business, a.role)) {
           const held = this.#threadHolders(s.business, a.role);
           if (held.length === 0) fail('not-held');
@@ -5010,15 +5127,38 @@ export class Broker {
         }
         return this.#decisionView(this.#decision(s, did));
       }
+      // Row 252 (#1753, design section 3): the Console's read of one grant request before its
+      // confirmation. It returns the two answers, a safe grant summary and the digest the answer must
+      // carry. Anything not eligible refuses, so the browser never decides eligibility (J1).
+      case 'decision.preview.console': {
+        keys(a, ['id'], ['id']);
+        identifier(a.id);
+        if (!s.console || s.human !== b.human) fail('human-required');
+        const d = this.#decision(s, a.id);
+        if (this.#closed(d.id)) fail('decision-closed');
+        const c = this.#consoleResolution(d);
+        if (!c) fail('decision-not-eligible');
+        return { id: d.id, business: d.business, question: d.question, ...c };
+      }
+      case 'decision.resolve.console':
       case 'decision.resolve':
       case 'decision.seen':
       case 'decision.withdraw': {
-        keys(a, ['id', 'choice', 'note'], ['id']);
+        const viaConsole = verb === 'decision.resolve.console';
+        if (viaConsole) keys(a, ['id', 'choice', 'digest'], ['id', 'choice', 'digest']);
+        else keys(a, ['id', 'choice', 'note'], ['id']);
         identifier(a.id);
         if (a.note !== undefined) string(a.note);
         const d = this.#decision(s, a.id);
         if (this.#closed(d.id)) fail('decision-closed');
-        if (verb === 'decision.withdraw') {
+        // Row 252 (design section 3): the Console answer rechecks eligibility, the digest and the choice
+        // in this transaction. It answers one of the two keys, never a key the browser names (J2).
+        if (viaConsole) {
+          if (!s.console || s.human !== b.human) fail('human-required');
+          const c = this.#consoleResolution(d);
+          if (!c) fail('decision-not-eligible');
+          if (a.digest !== c.digest || ![c.approve.key, c.deny.key].includes(a.choice)) fail('decision-stale');
+        } else if (verb === 'decision.withdraw') {
           if (s.human) {
             this.#human(s);
           } else {
@@ -5030,32 +5170,39 @@ export class Broker {
           this.#agent(s);
           if (s.role !== d.route_to) fail('not-resolver');
         }
-        const op = verb === 'decision.resolve' ? 'resolved' : verb === 'decision.seen' ? 'seen' : 'withdrawn';
+        const op = verb === 'decision.resolve' || viaConsole ? 'resolved' : verb === 'decision.seen' ? 'seen' : 'withdrawn';
         if (op === 'resolved' && !JSON.parse(d.options).some((o) => o.key === a.choice))
           fail('invalid-choice');
-        this.#store.run(
-          'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
-          d.id,
-          this.#now(),
-          op,
-          by,
-          op === 'resolved' ? a.choice : null,
-          a.note ?? null,
-          s.human ? 'cli' : 'broker',
+        const seq = Number(
+          this.#store.run(
+            'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
+            d.id,
+            this.#now(),
+            op,
+            by,
+            op === 'resolved' ? a.choice : null,
+            a.note ?? null,
+            s.console ? 'console' : s.human ? 'cli' : 'broker',
+          ).lastInsertRowid,
         );
-        // Row 234 (#1740, r6 X1): the human's cli approve of a grant mint starts the executor once this
-        // transaction commits. It rechecks all of this itself, so a rollback starts nothing.
-        const grant = op === 'resolved' ? this.#approvedGrant(s.business, d.id) : null;
-        if (grant?.method === 'host-enroll') setImmediate(() => this.#runEnrollment(s.business, d.id));
-        if (grant?.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
-        if (grant?.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
+        // Row 252 (N2): the human.input comes before #approvedGrant, which needs a console answer's
+        // record to start the executor. Its body names the owner subject and the close's seq.
         if (s.human)
           this.#event(
             s,
             'human.input',
-            { kind: 'answer', decision: d.id, op, choice: a.choice ?? null },
+            s.console
+              ? { kind: 'answer', decision: d.id, op, choice: a.choice, via: 'console', subject: s.console, decisionSeq: seq }
+              : { kind: 'answer', decision: d.id, op, choice: a.choice ?? null },
             d.id,
           );
+        // Row 234 (#1740, r6 X1): the human's cli approve of a grant mint starts the executor once this
+        // transaction commits. It rechecks all of this itself, so a rollback starts nothing. Row 252: a
+        // Console approve does too. A deny closes the decision with the other key and starts nothing.
+        const grant = op === 'resolved' ? this.#approvedGrant(s.business, d.id) : null;
+        if (grant?.method === 'host-enroll') setImmediate(() => this.#runEnrollment(s.business, d.id));
+        if (grant?.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
+        if (grant?.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
         // Row 115 (#1609): a close by anyone but the raising run tells the raising role, routed like message.send's.
         // Row 133 (#1627): no messaging check here. decision.raise refused a route that can't message the
         // raiser, definitions change only with a pinned copy and arbiters only through the business
@@ -5066,14 +5213,14 @@ export class Broker {
             op === 'resolved'
               ? `resolved by ${by}: ${a.choice} (${JSON.parse(d.options).find((o) => o.key === a.choice).text})`
               : `withdrawn by ${by}`;
-          // A close to a thread instance goes to the thread the raising run held. A decision
+          // A close to a thread instance goes to the session the raising run held. A decision
           // raised before row 121 has no thread claim and stays unthreaded.
-          const thread = this.#threaded(s.business, d.raised_by_role)
+          const session = this.#threaded(s.business, d.raised_by_role)
             ? (this.#store.get(
-                "SELECT thread FROM thread_claims WHERE business=? AND holder_run=? AND op='claim' ORDER BY seq DESC LIMIT 1",
+                "SELECT session FROM thread_claims WHERE business=? AND holder_run=? AND op='claim' ORDER BY seq DESC LIMIT 1",
                 s.business,
                 d.raised_by_run,
-              )?.thread ?? null)
+              )?.session ?? null)
             : null;
           const mid = randomUUID();
           this.#store.run(
@@ -5082,7 +5229,7 @@ export class Broker {
             this.#now(),
             s.business,
             s.human ? 'human' : s.role,
-            s.human ? 'human-cli' : s.run,
+            s.console ? 'human-console' : s.human ? 'human-cli' : s.run,
             d.raised_by_role,
             'DECISION',
             null,
@@ -5090,9 +5237,10 @@ export class Broker {
             null,
             `Decision ${d.id} on ${d.action} was ${outcome}.${a.note === undefined ? '' : `\nNote: ${a.note}`}`,
           );
-          this.#route(s.business, mid, d.raised_by_role, thread);
+          this.#route(s.business, mid, d.raised_by_role, session);
         }
-        return grant ? { id: d.id, op, grant: 'started' } : { id: d.id, op };
+        const answer = viaConsole ? { id: d.id, op, choice: a.choice } : { id: d.id, op };
+        return grant ? { ...answer, grant: 'started' } : answer;
       }
       case 'message.send': {
         keys(a, ['to', 'body', 'class', 'in_reply_to', 'corrects', 'decision'], ['to', 'body']);
@@ -5171,7 +5319,7 @@ export class Broker {
         }
         if (a.class === 'BLOCK') this.#checkBlock(s, to, a.in_reply_to);
         if (a.decision) this.#decision(s, a.decision);
-        const thread = this.#threadFor(s, to, a.in_reply_to);
+        const thread = this.#sessionFor(s, to, a.in_reply_to);
         // Row 170 (#1667): a tester's message to a role nobody holds is refused before it is
         // stored, so a PM test never waits for the role's next run. A run launched but not yet
         // claimed counts as no holder, as in #waiting. No lock: a holder that releases once the
@@ -5208,14 +5356,14 @@ export class Broker {
           this.#received.add(s.business + ':' + s.run);
         }
         const role = s.human ? 'human' : s.role;
-        // A thread run receives its own thread's messages only (REQ-THREAD-1).
+        // A thread run receives its own session's messages only (REQ-THREAD-1, row 264a).
         const rows = this.#store.all(
           "SELECT * FROM messages m WHERE business=? AND to_role=? AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op IN ('delivered','read'))" +
-            (s.thread ? ' AND EXISTS(SELECT 1 FROM message_threads mt WHERE mt.message=m.id AND mt.thread=?)' : '') +
+            (s.thread ? ' AND EXISTS(SELECT 1 FROM message_threads mt WHERE mt.message=m.id AND mt.session=?)' : '') +
             ' ORDER BY seq LIMIT 100',
           s.business,
           role,
-          ...(s.thread ? [s.thread] : []),
+          ...(s.thread ? [s.session] : []),
         );
         for (const m of rows)
           this.#delivery(
@@ -5435,7 +5583,12 @@ export class Broker {
               s.business,
               s.human || s.reader ? 'human' : s.role,
             )
-            .map((d) => this.#decisionView(d));
+            .map((d) => {
+              // Row 252: a grant request the Console can answer carries its two answers. The Console
+              // shows buttons from this, and the answer path rechecks it at the bus.
+              const c = s.human || s.reader ? this.#consoleResolution(d) : null;
+              return c ? { ...this.#decisionView(d), console: c } : this.#decisionView(d);
+            });
         if (verb === 'agents') {
           const claims = this.#store.all(
             "SELECT * FROM role_claims c WHERE business=? AND op='claim' AND seq=(SELECT max(seq) FROM role_claims WHERE business=c.business AND role=c.role) ORDER BY role",
@@ -5449,13 +5602,14 @@ export class Broker {
       }
       // Row 277 (#1782, design D1): the thread claims held in the business, for human and reader
       // sessions only. A thread run's role.claim writes thread_claims, which `agents` doesn't read,
-      // so this is where the owner sees it (PRD :1083-1084). A claim is held when its thread's latest
-      // thread_claims row is a claim, as #threadHolders reads it. No thread name: a user wrote that.
+      // so this is where the owner sees it (PRD :1083-1084). A claim is held when its session's latest
+      // thread_claims row is a claim, as #threadHolders reads it (row 264a, sage-2591), so a thread
+      // with two held sessions lists twice. No thread name: a user wrote that.
       case 'thread.claims': {
         if (!s.human && !s.reader) fail('human-required');
         keys(a, [], []);
         return this.#store.all(
-          "SELECT t.id AS thread, t.instance, c.holder_run, c.harness, c.at FROM threads t JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE thread=t.id) WHERE t.business=? AND c.op='claim' ORDER BY t.seq",
+          "SELECT t.id AS thread, t.instance, c.holder_run, c.harness, c.at FROM threads t JOIN sessions se ON se.thread=t.id JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE session=se.id) WHERE t.business=? AND c.op='claim' ORDER BY t.seq, se.seq",
           s.business,
         );
       }
@@ -5703,6 +5857,8 @@ export class Broker {
           this.#owner(s),
           a.name,
         );
+        // Row 264a (#1769, D3): every thread has a default session from the start.
+        this.#newSession(s, { id: tid, business: s.business, instance: instances[0], owner: this.#owner(s) }, 'default', 'default', true);
         return { id: tid, instance: instances[0] };
       }
       // Row 177 (#1675): each lists its own threads. The human's list leaves out the tester's,
@@ -5721,20 +5877,23 @@ export class Broker {
           ...(a.project === undefined ? [] : [a.project]),
         ).filter((t) => !s.user || this.#granted(s, t.project, t.instance));
       }
-      // Opening a thread asks the launcher to start its session (REQ-LAUNCH-1).
+      // Opening a thread asks the launcher to start its session (REQ-LAUNCH-1). Row 264a: a thread
+      // verb names one session of the thread, or works on its default (D3).
       case 'thread.open': {
         if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['thread'], ['thread']);
+        keys(a, ['thread', 'session'], ['thread']);
         const t = this.#grantedThread(s, this.#thread(s, a.thread));
-        this.#store.run('INSERT INTO thread_opens(at,thread,by) VALUES(?,?,?)', this.#now(), t.id, this.#owner(s));
+        const session = this.#threadSession(t, a.session);
+        this.#store.run('INSERT INTO thread_opens(at,thread,session,by) VALUES(?,?,?,?)', this.#now(), t.id, session, this.#owner(s));
         return { opened: t.id };
       }
       // Row 177 (#1675): a tester's message is the tester's, from tester-cli, and writes no
       // human.input, as on message.send. In its own thread the lists read it as the human.
       case 'thread.send': {
         if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['thread', 'body', 'class'], ['thread', 'body']);
+        keys(a, ['thread', 'session', 'body', 'class'], ['thread', 'body']);
         const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const session = this.#threadSession(t, a.session);
         // Row 120's lists hold here as on message.send: the instance must hear from the human.
         this.#checkMessaging(s.business, 'human', t.instance);
         string(a.body, 32768);
@@ -5754,32 +5913,61 @@ export class Broker {
           null,
           a.body,
         );
-        this.#route(s.business, mid, t.instance, t.id);
+        this.#route(s.business, mid, t.instance, session);
         // A user's message, like a tester's, is never the owner's authority evidence (design 3.5).
         return { id: mid, request: s.tester || s.user ? null : this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid) };
       }
       // The thread's history, oldest first. Reading writes nothing.
       case 'thread.messages': {
         if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['thread', 'after', 'limit'], ['thread']);
+        keys(a, ['thread', 'session', 'after', 'limit'], ['thread']);
         const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const session = this.#threadSession(t, a.session);
         const limit = a.limit ?? THREAD_PAGE;
         if (!Number.isInteger(limit) || limit < 1 || limit > THREAD_PAGE_MAX) fail('invalid-request');
         let after = 0;
         if (a.after !== undefined) {
           after = this.#store.get(
-            'SELECT m.seq FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE m.id=? AND mt.thread=?',
+            'SELECT m.seq FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE m.id=? AND mt.session=?',
             identifier(a.after),
-            t.id,
+            session,
           )?.seq;
           if (after === undefined) fail('message-not-found');
         }
         return this.#store.all(
-          `SELECT m.* FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.thread=? AND m.seq>? ORDER BY m.seq LIMIT ${limit}`,
-          t.id,
+          `SELECT m.* FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=? AND m.seq>? ORDER BY m.seq LIMIT ${limit}`,
+          session,
           after,
         );
       }
+      // Row 264a (#1769, T1 item 7): a thread's sessions, oldest first, and which one is the default.
+      // Each user reaches only their own threads' sessions (REQ-USER-2); there are no shares (Q7).
+      case 'session.list': {
+        if (!s.tester) this.#human(s);
+        keys(a, ['thread'], ['thread']);
+        const t = this.#thread(s, a.thread);
+        const fallback = this.#defaultSession(t.id);
+        return this.#store
+          .all('SELECT id,at,name,predecessor FROM sessions WHERE thread=? ORDER BY seq', t.id)
+          .map((r) => ({ ...r, default: r.id === fallback }));
+      }
+      // D8: a new session is metadata only. Its run starts when the launcher starts it (264b).
+      // The op key makes a retry find the first row: the same op and name answer it, another name
+      // under the same op refuses.
+      case 'session.create': {
+        if (!s.tester) this.#human(s);
+        keys(a, ['thread', 'name', 'op'], ['thread', 'name', 'op']);
+        if (!name(a.name)) fail('invalid-request');
+        identifier(a.op);
+        const t = this.#thread(s, a.thread);
+        const old = this.#store.get('SELECT id,name FROM sessions WHERE thread=? AND op=?', t.id, a.op);
+        if (old) {
+          if (old.name !== a.name) fail('session-op-conflict');
+          return { id: old.id, thread: t.id, name: old.name };
+        }
+        if (this.#store.get('SELECT 1 FROM sessions WHERE thread=? AND name=?', t.id, a.name)) fail('session-exists');
+        return { id: this.#newSession(s, t, a.name, a.op, false), thread: t.id, name: a.name };
+      }
       case 'replies': {
         if (!s.human && !s.reader) fail('human-required');
         keys(a, ['id'], ['id']);
@@ -5840,10 +6028,12 @@ export class Broker {
   #claimEnd(s, h, op, decision, reason = null, by = s.run ?? s.human) {
     if (h.thread)
       return this.#store.run(
-        'INSERT INTO thread_claims(at,business,thread,op,holder_run,harness,address,by,decision,reason) VALUES(?,?,?,?,?,?,?,?,?,?)',
+        'INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,address,by,decision,reason) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',
         this.#now(),
         s.business,
         h.thread,
+        h.session,
+        h.generation,
         op,
         h.holder_run,
         h.harness,
@@ -5886,7 +6076,7 @@ export class Broker {
   }
   // The message a review verb sends, routed like message.send's.
   #reviewMessage(s, mid, { to, cls, in_reply_to = null, decision = null, body }) {
-    const thread = this.#threadFor(s, to, in_reply_to);
+    const thread = this.#sessionFor(s, to, in_reply_to);
     this.#store.run(
       'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
       mid,
@@ -5904,9 +6094,35 @@ export class Broker {
     this.#route(s.business, mid, to, thread);
   }
   // Row 121: a message names its thread (REQ-MSG-1) and goes to the holder that may have it.
-  #route(business, mid, to, thread) {
-    if (thread) this.#store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', mid, thread);
-    this.#delivery(mid, 'routed', this.#recipient(business, to, thread));
+  // Row 264a (#1769): it names one session of the thread, and the session's holder may have it.
+  #route(business, mid, to, session) {
+    if (session) {
+      const { thread } = this.#store.get('SELECT thread FROM sessions WHERE id=?', session) ?? fail('session-not-found');
+      this.#store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', mid, thread, session);
+    }
+    this.#delivery(mid, 'routed', this.#recipient(business, to, session));
+  }
+  // Row 264a (#1769): a session row and, for a new thread, its default. The 3k-3l migration made the
+  // legacy defaults, whose id is the thread id; a new session's id is random, and a trigger refuses
+  // one that names another thread.
+  #newSession(s, t, sessionName, op, makeDefault) {
+    const sid = randomUUID();
+    const at = this.#now();
+    this.#store.run(
+      'INSERT INTO sessions(id,at,business,thread,instance,owner,name,op,predecessor) VALUES(?,?,?,?,?,?,?,?,?)',
+      sid,
+      at,
+      t.business,
+      t.id,
+      t.instance,
+      t.owner,
+      sessionName,
+      op,
+      null,
+    );
+    if (makeDefault)
+      this.#store.run('INSERT INTO session_defaults(at,thread,session,by) VALUES(?,?,?,?)', at, t.id, sid, this.#owner(s));
+    return sid;
   }
   // Row 146 (#1640): a message.send that nobody holds the target for waits for a claim. Null when
   // the message was routed to a holder, or is the human's, a tester's, or in a thread to a thread
@@ -6033,12 +6249,12 @@ export class Broker {
     );
     for (const m of rows) this.#delivery(m.id, 'routed', h);
   }
-  // A new thread holder gets the thread's waiting messages to the instance.
-  #routeThread(thread) {
-    const h = this.#threadHolder(thread);
+  // A new session holder gets the session's waiting messages to the instance.
+  #routeSession(session) {
+    const h = this.#sessionHolder(session);
     const rows = this.#store.all(
-      "SELECT m.id FROM messages m JOIN message_threads mt ON mt.message=m.id JOIN threads t ON t.id=mt.thread WHERE mt.thread=? AND m.to_role=t.instance AND NOT EXISTS(SELECT 1 FROM deliveries WHERE message=m.id AND op IN ('delivered','read'))",
-      thread,
+      "SELECT m.id FROM messages m JOIN message_threads mt ON mt.message=m.id JOIN threads t ON t.id=mt.thread WHERE mt.session=? AND m.to_role=t.instance AND NOT EXISTS(SELECT 1 FROM deliveries WHERE message=m.id AND op IN ('delivered','read'))",
+      session,
     );
     for (const m of rows) this.#delivery(m.id, 'routed', h);
   }

packages/bus/src/client.mjs

@@ -1,18 +1,19 @@
 import { connect } from 'node:net';
 import { BusError, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
 export class Client {
-  constructor({ path, cap, human, tester, user, timeout = 5000 }) {
+  constructor({ path, cap, human, tester, user, console: owner, timeout = 5000 }) {
     this.path = path;
     this.cap = cap;
     this.human = human;
     this.tester = tester;
     this.user = user;
+    this.console = owner;
     this.timeout = timeout;
   }
   call(verb, args = {}) {
     const request =
       JSON.stringify({
-        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : this.user ? { user: this.user } : { cap: this.cap }),
+        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : this.user ? { user: this.user } : this.console ? { console: this.console } : { cap: this.cap }),
         verb,
         args,
       }) + '\n';

packages/bus/src/console-cli.mjs

@@ -0,0 +1,41 @@
+// Row 252 (#1753, design section 2): the Console owner's transport shim, spawned only by the webui
+// `cli.mjs serve` process for one preview or one answer. Not a second product CLI. The Console sets
+// the nonce, the business and the signed-in (provider, iss, sub) in the spawn environment, and the
+// bus reads them back from this process's initial environment. Nothing respawns here, so the
+// Console stays the direct parent. Input is a verb and its args only: a body that names a business,
+// a subject or any other key is refused, never merged.
+import { readFileSync } from 'node:fs';
+import { Client } from './client.mjs';
+import { readProcess } from './human.mjs';
+import { CONSOLE_VERBS } from './broker.mjs';
+const env = process.env;
+try {
+  if (!/^[a-f0-9]{64}$/.test(env.MOSAIC_BUS_CONSOLE_NONCE ?? '')) throw Object.assign(Error(), { code: 'human-required' });
+  const request = JSON.parse(readFileSync(0, 'utf8'));
+  if (
+    !request ||
+    typeof request !== 'object' ||
+    Array.isArray(request) ||
+    Object.keys(request).some((k) => !['verb', 'args'].includes(k)) ||
+    !CONSOLE_VERBS.includes(request.verb)
+  )
+    throw Error();
+  const me = readProcess(process.pid);
+  const client = new Client({
+    path: process.argv[2],
+    console: {
+      business: env.MOSAIC_BUS_CONSOLE_BUSINESS,
+      provider: env.MOSAIC_BUS_CONSOLE_PROVIDER,
+      iss: env.MOSAIC_BUS_CONSOLE_ISS,
+      sub: env.MOSAIC_BUS_CONSOLE_SUB,
+      pid: me.pid,
+      startTime: me.startTime,
+      nonce: env.MOSAIC_BUS_CONSOLE_NONCE,
+    },
+  });
+  const result = await client.call(request.verb, request.args ?? {});
+  process.stdout.write(JSON.stringify(result) + '\n');
+} catch (e) {
+  process.stderr.write((/^[a-z-]{1,64}$/.test(e.code ?? '') ? e.code : 'invalid-request') + '\n');
+  process.exitCode = 2;
+}

packages/bus/src/human.mjs

@@ -10,6 +10,10 @@ const MARKERS = [
   'CODEX_THREAD_ID',
   'PI_AGENT_DIR',
 ];
+// Row 252 (#1753, Webby N5): the Console wrapper's nonce and the subject its spawn bound. The
+// verifier reads each from the wrapper's initial environment, never from its proof alone.
+export const CONSOLE_ENV = Object.freeze(['MOSAIC_BUS_CONSOLE_NONCE', 'MOSAIC_BUS_CONSOLE_BUSINESS', 'MOSAIC_BUS_CONSOLE_PROVIDER', 'MOSAIC_BUS_CONSOLE_ISS', 'MOSAIC_BUS_CONSOLE_SUB']);
+const NONCE_KEYS = ['MOSAIC_BUS_CLI_NONCE', 'MOSAIC_BUS_USER_NONCE', ...CONSOLE_ENV];
 const refuse = () => {
   throw new BusError('human-required');
 };
@@ -31,7 +35,7 @@ export function readProcess(pid, { readFile = readFileSync, stat = lstatSync } =
       for (const entry of environment.split('\0')) {
         const i = entry.indexOf('=');
         const key = entry.slice(0, i);
-        if (['MOSAIC_BUS_CLI_NONCE', 'MOSAIC_BUS_USER_NONCE'].includes(key) || MARKERS.includes(key)) env[key] = entry.slice(i + 1);
+        if (NONCE_KEYS.includes(key) || MARKERS.includes(key)) env[key] = entry.slice(i + 1);
       }
     return {
       pid,

packages/bus/src/migrations/3k-3l.sql

@@ -0,0 +1,168 @@
+-- Row 264a (#1769, T1 item 7): sessions below a thread. Each existing thread gets one legacy default
+-- session whose id is the thread id, and its claims, messages and opens name that session (D9's
+-- mapping). thread_claims, message_threads and thread_opens are rebuilt with a session column, and
+-- thread_claims gains generation, the claim's number in its session. Rows are copied with their seq
+-- values and old columns as they were, and the sequences carry over, as 3h-3i did. The guards and the
+-- delivery trigger that read the old tables are dropped first, so the renames rewrite nothing.
+DROP TRIGGER thread_one_holder;
+DROP TRIGGER thread_one_per_run;
+DROP TRIGGER thread_release_by_holder;
+DROP TRIGGER thread_release_same_run;
+DROP TRIGGER thread_revoke_needs_decision;
+DROP TRIGGER thread_claims_business;
+DROP TRIGGER message_threads_match;
+DROP TRIGGER delivery_same_thread;
+DROP TRIGGER thread_claims_no_update;
+DROP TRIGGER thread_claims_no_delete;
+DROP TRIGGER thread_claims_no_replace;
+DROP TRIGGER message_threads_no_update;
+DROP TRIGGER message_threads_no_delete;
+DROP TRIGGER message_threads_no_replace;
+DROP TRIGGER thread_opens_no_update;
+DROP TRIGGER thread_opens_no_delete;
+DROP TRIGGER thread_opens_no_replace;
+DROP INDEX thread_claims_thread;
+DROP INDEX message_threads_thread;
+ALTER TABLE thread_claims RENAME TO thread_claims_3k;
+ALTER TABLE message_threads RENAME TO message_threads_3k;
+ALTER TABLE thread_opens RENAME TO thread_opens_3k;
+CREATE TABLE sessions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  op TEXT NOT NULL,
+  predecessor TEXT REFERENCES sessions(id),
+  UNIQUE (thread, name),
+  UNIQUE (thread, op)
+) STRICT;
+CREATE TABLE session_defaults (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+INSERT INTO sessions(at,business,thread,id,instance,owner,name,op,predecessor)
+  SELECT at,business,id,id,instance,owner,'default','legacy-3l',NULL FROM threads ORDER BY seq;
+INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,'migration-3l' FROM threads ORDER BY seq;
+CREATE TABLE thread_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  generation INTEGER NOT NULL CHECK (generation >= 1),
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE message_threads (
+  message TEXT PRIMARY KEY REFERENCES messages(id),
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id)
+) STRICT;
+CREATE TABLE thread_opens (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+INSERT INTO thread_claims(seq,at,business,thread,session,generation,op,holder_run,harness,address,by,reason,decision)
+  SELECT c.seq,c.at,c.business,c.thread,c.thread,
+    (SELECT count(*) FROM thread_claims_3k p WHERE p.thread = c.thread AND p.op = 'claim' AND p.seq <= c.seq),
+    c.op,c.holder_run,c.harness,c.address,c.by,c.reason,c.decision FROM thread_claims_3k c ORDER BY c.seq;
+INSERT INTO message_threads(message,thread,session) SELECT message,thread,thread FROM message_threads_3k ORDER BY rowid;
+INSERT INTO thread_opens(seq,at,thread,session,by) SELECT seq,at,thread,thread,by FROM thread_opens_3k ORDER BY seq;
+DELETE FROM sqlite_sequence WHERE name IN ('thread_claims','thread_opens');
+INSERT INTO sqlite_sequence(name,seq) SELECT 'thread_claims', seq FROM sqlite_sequence WHERE name='thread_claims_3k';
+INSERT INTO sqlite_sequence(name,seq) SELECT 'thread_opens', seq FROM sqlite_sequence WHERE name='thread_opens_3k';
+DROP TABLE thread_claims_3k;
+DROP TABLE message_threads_3k;
+DROP TABLE thread_opens_3k;
+CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX thread_claims_session ON thread_claims (session, seq);
+CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE INDEX message_threads_session ON message_threads (session);
+CREATE INDEX session_defaults_thread ON session_defaults (thread, seq);
+CREATE TRIGGER sessions_thread_match BEFORE INSERT ON sessions
+  WHEN NOT EXISTS (SELECT 1 FROM threads t WHERE t.id = NEW.thread AND t.business = NEW.business AND t.instance = NEW.instance AND t.owner = NEW.owner)
+  BEGIN SELECT RAISE(ABORT, 'a session has its thread''s business, instance and owner'); END;
+CREATE TRIGGER sessions_predecessor BEFORE INSERT ON sessions
+  WHEN NEW.predecessor IS NOT NULL AND (SELECT thread FROM sessions WHERE id = NEW.predecessor) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a session''s predecessor is in its thread'); END;
+CREATE TRIGGER sessions_id_not_thread BEFORE INSERT ON sessions
+  WHEN NEW.id IS NOT NEW.thread AND EXISTS (SELECT 1 FROM threads WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a session id names another thread'); END;
+CREATE TRIGGER threads_id_not_session BEFORE INSERT ON threads
+  WHEN EXISTS (SELECT 1 FROM sessions WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a thread id names a session'); END;
+CREATE TRIGGER session_defaults_match BEFORE INSERT ON session_defaults
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a default session is in its thread'); END;
+CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session already held'); END;
+CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE session = c.session) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a session'); END;
+CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session is not held'); END;
+CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_claim_generation BEFORE INSERT ON thread_claims
+  WHEN NEW.generation IS NOT (CASE WHEN NEW.op = 'claim'
+    THEN 1 + (SELECT count(*) FROM thread_claims WHERE session = NEW.session AND op = 'claim')
+    ELSE (SELECT generation FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) END)
+  BEGIN SELECT RAISE(ABORT, 'a claim row names its session''s generation'); END;
+CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
+  WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER thread_claims_session BEFORE INSERT ON thread_claims
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a claim''s session is in its thread'); END;
+CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
+  WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
+    WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
+CREATE TRIGGER message_threads_session BEFORE INSERT ON message_threads
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a threaded message''s session is in its thread'); END;
+CREATE TRIGGER thread_opens_session BEFORE INSERT ON thread_opens
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'an open''s session is in its thread'); END;
+CREATE TRIGGER delivery_same_session BEFORE INSERT ON deliveries
+  WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
+    AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
+      WHERE mt.message = NEW.message AND m.to_role = t.instance
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE session = mt.session)
+          AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its session''s holder'); END;
+CREATE TRIGGER sessions_no_update BEFORE UPDATE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_delete BEFORE DELETE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_replace BEFORE INSERT ON sessions WHEN EXISTS (SELECT 1 FROM sessions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER session_defaults_no_update BEFORE UPDATE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_delete BEFORE DELETE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_replace BEFORE INSERT ON session_defaults WHEN EXISTS (SELECT 1 FROM session_defaults WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER message_threads_no_update BEFORE UPDATE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_delete BEFORE DELETE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_replace BEFORE INSERT ON message_threads WHEN EXISTS (SELECT 1 FROM message_threads WHERE message = NEW.message) BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER thread_opens_no_update BEFORE UPDATE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_delete BEFORE DELETE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_replace BEFORE INSERT ON thread_opens WHEN EXISTS (SELECT 1 FROM thread_opens WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;

packages/bus/src/principal.mjs

@@ -5,8 +5,8 @@ import { verifyTester, testerNonce } from './tester.mjs';
 
 // Trusted transport API. Identity is held only by this connection's transient session.
 // User mapping and live grant authorization belong to R3, not to this verifier.
-export function verifyPrincipal(request, { peer, paths, businesses, launches = [], readProcess = defaultRead, readTesterNonce = testerNonce }) {
-  const kinds = ['human', 'tester', 'user'].filter(k => request?.[k]);
+export function verifyPrincipal(request, { peer, paths, businesses, launches = [], readProcess = defaultRead, readTesterNonce = testerNonce, consoleOwners = [] }) {
+  const kinds = ['human', 'tester', 'user', 'console'].filter(k => request?.[k]);
   if (kinds.length !== 1 || request.cap) throw new BusError('invalid-envelope');
   const kind = kinds[0], proof = request[kind];
   const error = kind === 'tester' ? 'tester-required' : 'human-required';
@@ -16,6 +16,7 @@ export function verifyPrincipal(request, { peer, paths, businesses, launches = [
     const { business } = verifyTester(proof, { cliPath: paths.tester, launches, readProcess, readNonce: readTesterNonce });
     return { kind: 'tester', business, id: 'tester' };
   }
+  if (kind === 'console') return verifyConsole(proof, { peer, paths, businesses, launches, readProcess, consoleOwners });
   let checked = proof, parent;
   if (kind === 'user') {
     if (!proof || typeof proof.user !== 'string' || !proof.user ||
@@ -42,3 +43,38 @@ export function verifyPrincipal(request, { peer, paths, businesses, launches = [
   if (!id) throw new BusError('unknown-business');
   return { kind: 'owner', business, id };
 }
+
+// Row 252 (#1753, design section 2): the Console owner. The same-tree console-cli.mjs wrapper, its own
+// nonce namespace and the human walk, with the exact same-tree webui `cli.mjs serve` as its direct
+// parent, read again after the walk as the user kind does. Business and (provider, iss, sub) must be
+// the wrapper's initial spawn environment and one of the checked console.sso subjects the runtime
+// was started with (Webby N1: every configured subject is an owner). The Console's mapping is trusted
+// as row 196 permits; the bus does not exchange an ID token itself.
+const SUBJECT_KEYS = ['provider', 'iss', 'sub'];
+const SUBJECT_ENV = { business: 'MOSAIC_BUS_CONSOLE_BUSINESS', provider: 'MOSAIC_BUS_CONSOLE_PROVIDER', iss: 'MOSAIC_BUS_CONSOLE_ISS', sub: 'MOSAIC_BUS_CONSOLE_SUB' };
+function verifyConsole(proof, { peer, paths, businesses, launches, readProcess, consoleOwners }) {
+  const refuse = () => { throw new BusError('human-required'); };
+  if (!proof || typeof proof !== 'object' ||
+    Object.keys(proof).some(k => !['pid', 'startTime', 'nonce', 'business', ...SUBJECT_KEYS].includes(k)) ||
+    SUBJECT_KEYS.some(k => typeof proof[k] !== 'string' || !proof[k] || proof[k].length > 512)) refuse();
+  if (typeof paths.consoleCli !== 'string' || typeof paths.console !== 'string') refuse();
+  const { provider, iss, sub, ...checked } = proof;
+  let child, parent;
+  try {
+    child = readProcess(proof.pid);
+    parent = readProcess(child.ppid);
+    if (parent.uid !== peer.uid || parent.argv[1] !== resolve(paths.console) || parent.argv[2] !== 'serve') refuse();
+    for (const [key, name] of Object.entries(SUBJECT_ENV)) if (child.env?.[name] !== proof[key]) refuse();
+  } catch { refuse(); }
+  const { business } = verifyHuman(checked, { cliPath: paths.consoleCli, launches, readProcess, nonceKey: 'MOSAIC_BUS_CONSOLE_NONCE' });
+  try {
+    const again = readProcess(proof.pid), up = readProcess(parent.pid);
+    if (again.ppid !== parent.pid || again.startTime !== child.startTime || up.startTime !== parent.startTime ||
+      up.ppid !== parent.ppid || up.uid !== parent.uid || up.argv[1] !== parent.argv[1] || up.argv[2] !== 'serve') refuse();
+    for (const [key, name] of Object.entries(SUBJECT_ENV)) if (again.env?.[name] !== proof[key]) refuse();
+  } catch { refuse(); }
+  if (!Array.isArray(consoleOwners) || !consoleOwners.some(o => o && o.provider === provider && o.iss === iss && o.sub === sub)) refuse();
+  const id = businesses[business]?.human;
+  if (!id) throw new BusError('unknown-business');
+  return { kind: 'console', business, id, via: 'console', subject: { provider, iss, sub } };
+}

packages/bus/src/runtime.mjs

@@ -102,7 +102,15 @@ export async function startBroker({
   // FED R3 (#414): the access file and its loader context, { file, context } (R1's loadAccess).
   // Without it no user binds. R6 and R8 pass it; the live boot config doesn't yet.
   access = null,
+  // Row 252 (#1753, design section 2): the checked console.sso subjects, [{provider, iss, sub}], each an
+  // owner of the business (Webby N1). The boot config carries them; no socket verb sets them. Empty, no
+  // Console owner binds and the terminal owner is unchanged.
+  consoleOwners = [],
 }) {
+  if (!Array.isArray(consoleOwners) || consoleOwners.length > 512 || consoleOwners.some((o) => o === null || typeof o !== 'object' || Array.isArray(o) ||
+      Object.keys(o).length !== 3 || ['provider', 'iss', 'sub'].some((k) => typeof o[k] !== 'string' || !o[k] || o[k].length > 512)))
+    throw new BusError('invalid-host-request');
+  const owners = Object.freeze(consoleOwners.map((o) => Object.freeze({ provider: o.provider, iss: o.iss, sub: o.sub })));
   if (access !== null && (typeof access?.file !== 'string' || access.context === null || typeof access.context !== 'object'))
     throw new BusError('invalid-host-request');
   if (librarySync !== null && (typeof librarySync?.command !== 'function'
@@ -388,6 +396,7 @@ export async function startBroker({
       tester: fileURLToPath(new URL('./tester-cli.mjs', import.meta.url)),
       user: fileURLToPath(new URL('./user-cli.mjs', import.meta.url)),
       console: fileURLToPath(new URL('../../webui/src/cli.mjs', import.meta.url)),
+      consoleCli: fileURLToPath(new URL('./console-cli.mjs', import.meta.url)),
     };
     const path = join(store.directory, 'broker.sock');
     // The existing host executor owns SSH and its key lifecycle. Combine its revocation
@@ -419,6 +428,11 @@ export async function startBroker({
         const p = verifyPrincipal({ user: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords });
         return broker.bindUser({ business: p.business, user: p.id });
       },
+      // Row 252 (#1753): a fresh proof per connection, a cap for the Console verbs only.
+      authenticateConsole: (proof, peer) => {
+        const p = verifyPrincipal({ console: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords, consoleOwners: owners });
+        return broker.bindConsole({ business: p.business, human: p.id, subject: p.subject });
+      },
     });
     // Row 235 (r6 X3): the remote undo of interrupted host grants, once the bus is up, so a start doesn't
     // wait on the network.

packages/bus/src/server.mjs

@@ -1,6 +1,6 @@
 import { createServer } from 'node:net';
 import { lstatSync, chmodSync, unlinkSync } from 'node:fs';
-import { BusError, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, GRANTS_VERBS, PROJECT_FILE_VERBS, LIBRARY_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
+import { BusError, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, GRANTS_VERBS, PROJECT_FILE_VERBS, LIBRARY_VERBS, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX, CONSOLE_VERBS } from './broker.mjs';
 import { inspectInterpreter } from './interpreter.mjs';
 import { createPeerReader } from './peercred.mjs';
 const LIMIT = 65536;
@@ -13,8 +13,9 @@ const SAVE_VERB_AT_START = new RegExp(`"verb":"${PROJECT_SAVE_VERB.replaceAll('.
 // the web verbs reach it, and without one they refuse web-not-configured (or web-not-granted).
 // `host` (row 210) is the trusted host.run executor (host-run.mjs), or null: host.run then refuses
 // host-not-configured.
-// A request carries exactly one of cap, human (row S4) and tester (row 110) proof.
-export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, authenticateUser = null, peerReader = null, timeout = 5000, tasks = null, web = null, host = null }) {
+// A request carries exactly one of cap, human (row S4), tester (row 110), user (FED R3) and console
+// (row 252) proof.
+export async function serve({ broker, path, authenticateHuman = null, authenticateTester = null, authenticateUser = null, authenticateConsole = null, peerReader = null, timeout = 5000, tasks = null, web = null, host = null }) {
   try {
     lstatSync(path);
     throw new BusError('socket-exists');
@@ -64,15 +65,17 @@ export async function serve({ broker, path, authenticateHuman = null, authentica
           !r ||
           Array.isArray(r) ||
           typeof r !== 'object' ||
-          Object.keys(r).some((k) => !['cap', 'human', 'tester', 'user', 'verb', 'args'].includes(k)) ||
+          Object.keys(r).some((k) => !['cap', 'human', 'tester', 'user', 'console', 'verb', 'args'].includes(k)) ||
           typeof r.verb !== 'string' ||
-          [r.cap, r.human, r.tester, r.user].filter(Boolean).length !== 1
+          [r.cap, r.human, r.tester, r.user, r.console].filter(Boolean).length !== 1
         )
           throw new BusError('invalid-envelope');
         let cap = r.cap;
-        const kind = r.human ? 'human' : r.tester ? 'tester' : r.user ? 'user' : null;
+        const kind = r.human ? 'human' : r.tester ? 'tester' : r.user ? 'user' : r.console ? 'console' : null;
+        // Row 252 (#1753): a Console owner proof reaches its two verbs only, refused before any proof check.
+        if (kind === 'console' && !CONSOLE_VERBS.includes(r.verb)) throw new BusError('human-required');
         if (kind) {
-          const authenticate = kind === 'human' ? authenticateHuman : kind === 'tester' ? authenticateTester : authenticateUser;
+          const authenticate = kind === 'human' ? authenticateHuman : kind === 'tester' ? authenticateTester : kind === 'user' ? authenticateUser : authenticateConsole;
           if (!authenticate) throw new BusError(kind === 'tester' ? 'tester-required' : 'human-required');
           socket.pause();
           let peer;

packages/bus/src/store.mjs

@@ -13,8 +13,8 @@ import { join, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
 
 const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
-export const SCHEMA_SHA256 = 'aba9240825a35fdcc741439d0708efa33afcf519d11cac9952c7207ad99250f0';
-export const SCHEMA_VERSION = '3k';
+export const SCHEMA_SHA256 = 'cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a';
+export const SCHEMA_VERSION = '3l';
 // Ordered, named offline steps. New schema changes append a step and keep prior DDL pinned.
 const legacyDDL = readFileSync(new URL('./migrations/3b.sql', import.meta.url), 'utf8');
 const LEGACY_SHA256 = '179ffe356d4ff19a49b5ebad39b6c6bfd7771deb8e1b7c55b5e746f039d69e65';
@@ -66,6 +66,12 @@ const migrations = [{
   from: '3j',
   to: '3k',
   sql: readFileSync(new URL('./migrations/3j-3k.sql', import.meta.url), 'utf8'),
+}, {
+  // Row 264a (#1769): sessions below a thread. Each thread gets a default session whose id is the
+  // thread id, and thread_claims, message_threads and thread_opens are rebuilt to name it.
+  from: '3k',
+  to: '3l',
+  sql: readFileSync(new URL('./migrations/3k-3l.sql', import.meta.url), 'utf8'),
 }];
 const timedTables = [
   'events',
@@ -77,6 +83,8 @@ const timedTables = [
   'task_snapshots',
   'projects',
   'threads',
+  'sessions',
+  'session_defaults',
   'thread_claims',
   'thread_opens',
   'instance_names',

packages/bus/tests/account-migration.test.mjs

@@ -15,6 +15,9 @@ const AT = '2026-10-18T00:00:00.000Z';
 const SEQUENCE = 50;
 const ddl3h = readFileSync(new URL('./fixtures/schema-3h.sql', import.meta.url), 'utf8');
 const here = (p) => new URL(p, import.meta.url);
+// Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
+const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
+const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3h(t) {
   const root = mkdtempSync(join(tmpdir(), 'account-migrate-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -48,6 +51,15 @@ function snapshot(path, columns) {
     return { columns, rows };
   } finally { db.close(); }
 }
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row even when it copies none (3k-3l.sql:50-52). An after-migration compare
+// leaves out the rows SESSIONS_3L names and checks they are exactly those two at seq 0, so any other
+// new row still fails.
+function migrated3l(rows) {
+  const left = rows.sqlite_sequence.filter(r => SESSIONS_3L.includes(r.name));
+  assert.deepEqual(left.map(r => ({ ...r })), [{ name: 'session_defaults', seq: 0 }, { name: 'sessions', seq: 0 }]);
+  return { ...rows, sqlite_sequence: rows.sqlite_sequence.filter(r => !SESSIONS_3L.includes(r.name)) };
+}
 function master(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
@@ -71,6 +83,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
   writeFileSync(join(moduleRoot, 'src/migrations/3h-3i.sql'), step(readFileSync(here('../src/migrations/3h-3i.sql'), 'utf8')));
   copyFileSync(here('../src/migrations/3i-3j.sql'), join(moduleRoot, 'src/migrations/3i-3j.sql'));
   copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
+  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 
@@ -78,9 +91,9 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
   const { root, path } = source3h(t), before = snapshot(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
   // Every table's rows as they were, usage_records with its seq values and sqlite_sequence with 50.
-  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
+  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
   assert.deepEqual(before.rows.usage_records.map(r => r.seq), [1, 2, 3]);
   assert.deepEqual({ ...before.rows.sqlite_sequence.find(r => r.name === 'usage_records') }, { name: 'usage_records', seq: SEQUENCE });
   // sqlite_master as at 3h, the account line aside: same tables, indexes and triggers, same text.
@@ -90,7 +103,7 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
   // Row 236 (#1742) adds 3j→3k's; its test is gitea-migration.test.mjs.
   const later = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hosts_1', 'sqlite_autoindex_host_grants_1',
     'gitea_users', 'gitea_grants', 'sqlite_autoindex_gitea_users_1', 'sqlite_autoindex_gitea_grants_1'];
-  assert.deepEqual(master(path).filter(r => !later.includes(r.name)), was.map(r => r.name === 'usage_records' ? { ...r, sql: r.sql.replace(old, '  account TEXT,\n') } : r));
+  assert.deepEqual(master(path).filter(r => !later.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)).map(r => r.name === 'usage_records' ? { ...r, sql: r.sql.replace(old, '  account TEXT,\n') } : r));
   assert.equal(was.filter(r => r.type === 'trigger' && r.tbl_name === 'usage_records').length, 3);
   const store = new Store(root);
   try {
@@ -128,8 +141,8 @@ test('REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with
   assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
   // Still a whole 3h store: the real step migrates it.
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
-  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
+  assert.equal(version(path), '3l');
+  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
 });
 
 test('REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
@@ -140,14 +153,14 @@ test('REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and
     schema: ddl3h,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3h).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3h';")
+      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3h';")
       .replace(/\}, \{\n {2}\/\/ Row 126 \(#1620\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3h/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3h';") && !pinned.includes('3h-3i'), 'the 3h engine has no 3h→3i step');
   assert.throws(() => new Store3h(root), /schema-mismatch/);
   assert.throws(() => new Store3h(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
   assert.deepEqual(master(path), was);
   assert.deepEqual(snapshot(path, after.columns).rows, after.rows);
 });

packages/bus/tests/channel-proof.test.mjs

@@ -6,6 +6,9 @@
 // bus.mjs for six library-* STATUS entries; no proof or transport change.
 // Row 236 (#1742) re-pins human-cli.mjs for the same 130 s wait on the grants verbs; no proof or
 // transport change.
+// Row 252 (#1753, Webby N5) re-pins human.mjs, whose readProcess also keeps the five
+// MOSAIC_BUS_CONSOLE_* keys for the Console wrapper's proof, and webui bus.mjs for consoleCall,
+// which shares humanCall's spawn as transport(). The human proof and its spawn are unchanged.
 import test from "node:test";
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
@@ -15,7 +18,7 @@ import { provedRuntime } from "../../cli/tests/channel-fixture.mjs";
 import { Client } from "../src/client.mjs";
 
 const baselines = {
- "packages/bus/src/human.mjs": "0c6d96abe4607cba0b02b0638a2fc217ff8135bac9a47761a0ef015fbe9d3079",
+ "packages/bus/src/human.mjs": "bb13c146717cdc46d75d157177e400edac4d3e10f14fe511027a25fd44cec885",
  "packages/bus/src/human-cli.mjs": "271b9781d73cf31cc562a56180e3ebcd725b5fde148a83347a201fdef2fc28af",
  "packages/cli/src/transport.mjs": "5129c44b4d9f642e825344df65c9bfb4bac4fc8d6b25343b42d39853dbd40774",
  // Row 165 (#1662): seven STATUS entries for the role instance routes (organization-instance-exists,
@@ -25,7 +28,7 @@ const baselines = {
  // Row 171 (#1668): project-name-is-repo maps to 409; no proof or transport change.
  // Row 194 (#1692, brief item 7, sage-1610 a): organization-tracker-required 400 and
  // organization-tracker-bot-taken 409; no proof or transport change.
- "packages/webui/src/bus.mjs": "15e8123ffdbb6d067e8a516f5823efdb5de3c869963764f27cd14bb9e4ce3313",
+ "packages/webui/src/bus.mjs": "701f009e488a261558a22d19f581b052ffd26ce99266f2022dc5d178c12f5272",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);
 

packages/bus/tests/chief-of-staff.test.mjs

@@ -614,7 +614,7 @@ async function database3c(t) {
   let source = readFileSync(here('../src/store.mjs'), 'utf8');
   const pinned = source
     .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3c).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3c';")
+    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3c';")
     .replace(/\}, \{\n {2}from: '3c',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
   assert.notEqual(pinned, source);
   assert.ok(!pinned.includes('3c-3d'), 'the 3c engine has no 3c→3d step');
@@ -638,7 +638,7 @@ test('REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
   assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
   assert.equal(store.get("SELECT holder_run FROM role_claims WHERE role='coder'").holder_run, 'coder-run');
   const b = new Broker({ store, businesses: demo(), organization: null });

packages/bus/tests/comment-migration.test.mjs

@@ -33,7 +33,7 @@ test('explicit 3b copy migration preserves evidence and opens as 3g; normal star
   const original = readFileSync(source);
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
   assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
   assert.equal(store.get('SELECT count(*) n FROM task_comment_cursors').n, 0);
   const epoch = store.get("SELECT value FROM meta WHERE key='comment_cursor_epoch'").value;
@@ -75,15 +75,15 @@ test('named migration registry chains 3b through 3g to a fixture-only future ver
   const sha = createHash('sha256').update(futureDDL).digest('hex');
   let source = readFileSync(new URL('../src/store.mjs', import.meta.url), 'utf8');
   source = source.replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${sha}';`)
-    .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3l';")
-    .replace('}];\nconst timedTables', `}, { from: '3k', to: '3l', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
+    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3m';")
+    .replace('}];\nconst timedTables', `}, { from: '3l', to: '3m', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
   writeFileSync(join(moduleRoot, 'src/store.mjs'), source);
   writeFileSync(join(moduleRoot, 'schema.sql'), futureDDL);
-  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql'])
+  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql'])
     copyFileSync(new URL('../src/migrations/' + name, import.meta.url), join(moduleRoot, 'src/migrations', name));
   const { Store: FutureStore } = await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')));
   const future = new FutureStore(root, { migrateSchema: true });
-  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
   assert.equal(future.get("SELECT name FROM sqlite_master WHERE name='future_fixture'").name, 'future_fixture');
   assert.equal(future.get("SELECT count(*) n FROM task_comment_cursors").n, 0);
   assert.equal(future.get("SELECT id FROM events").id, 'preserved');
@@ -109,7 +109,7 @@ test('offline command migrates only the supplied fixture root and reports usage
   const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
   const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
   assert.equal(migrated.status, 0, migrated.stderr);
-  assert.match(migrated.stdout, /bus schema 3k ready/);
+  assert.match(migrated.stdout, /bus schema 3l ready/);
   new Store(root).close();
   const usage = spawnSync(process.execPath, [command], { encoding: 'utf8' });
   assert.equal(usage.status, 2);

packages/bus/tests/console-decide.test.mjs

@@ -0,0 +1,291 @@
+// Row 252 (#1753, Gander's design approved by Webby at 5d8f0f4b5, N1-N5): the broker side of the
+// Console's Approve and Deny for a grant request. A console cap, made by bindConsole after the
+// transport checked the wrapper and the signed-in owner, reaches only decision.preview.console and
+// decision.resolve.console, and no other cap reaches those. The answer records via 'console' and a
+// human.input that names the owner, written before the grant check (N2), and only that record lets
+// an approve start the executor (J13, J14). Q188: no agent caller answers. The grant uses row 234's
+// host-enroll raise with a fake keyscan and fake enroll and check steps, so nothing connects anywhere.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, CONSOLE_VERBS } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { hostGrant, fingerprint } from '../src/host-grant.mjs';
+import { grantDecision } from './host-fixtures.mjs';
+
+const options = [{ key: 'yes', text: 'Yes, enroll it' }, { key: 'no', text: 'No' }];
+const SUBJECT = { provider: 'fake-oidc', iss: 'https://idp.test', sub: 'owner-1' };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const keyLine = (dir, name) => {
+  execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', 'x', '-f', join(dir, name)]);
+  return readFileSync(join(dir, name + '.pub'), 'utf8').trim().split(' ').slice(0, 2).join(' ');
+};
+const refusesSync = (fn, code) => assert.throws(fn, (e) => (assert.equal(e.code, code), true));
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'c252-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const hostKeys = [keyLine(root, 'hk1'), keyLine(root, 'hk2')];
+  const configDir = join(root, 'config');
+  const real = hostGrant({ configDir, runRoot: join(configDir, 'secrets', 'run'), scan: async () => hostKeys });
+  const enrolls = [];
+  const hg = {
+    ...real,
+    enroll: async (...args) => (enrolls.push(args), real.enroll(...args)),
+    check: async (...args) => ({ installerFingerprint: args[2].installer_fingerprint, exit: 0 }),
+  };
+  const business = {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'pm' },
+    roles: {
+      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+    },
+    vars: { 'bus.tester': true },
+  };
+  const make = () => new Broker({ store, businesses: { demo: business }, hostGrant: hg });
+  const broker = make();
+  const caps = {};
+  for (const role of ['chief', 'pm']) {
+    caps[role] = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
+    broker.request(caps[role], { verb: 'role.claim' });
+  }
+  caps.human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  caps.tester = broker.bindTester({ business: 'demo' });
+  caps.reader = broker.bindReader({ business: 'demo' });
+  caps.console = broker.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const grant = { method: 'host-enroll', host: 'web1', address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, fingerprints: hostKeys.map(fingerprint) };
+  const call = (who, verb, args = {}) => broker.request(caps[who], { verb, args });
+  const raise = (extra = {}) =>
+    call('chief', 'decision.raise', { action: 'credential.mint', question: 'Enroll web1?', options, recommendation: 'yes', blocking: false, grant, ...extra });
+  const events = () =>
+    store
+      .all("SELECT seq, kind, actor_role, actor_run, subject, body FROM events WHERE business='demo' ORDER BY seq")
+      // The row's subject is `about`, since a console answer's body has its own `subject`.
+      .map((e) => ({ seq: e.seq, kind: e.kind, actor_role: e.actor_role, actor_run: e.actor_run, about: e.subject, ...JSON.parse(e.body) }));
+  const grantEvents = (decision) => events().filter((e) => e.actor_run === 'grant' && (e.decision === decision || e.grantDecision === decision));
+  const settle = async (decision) => {
+    for (let i = 0; i < 250; i++) {
+      if (grantEvents(decision).some((e) => ['grant.host.enrolled', 'grant.failed'].includes(e.action))) return;
+      await sleep(20);
+    }
+    throw new Error('enrollment did not end');
+  };
+  const closes = (decision) => store.all('SELECT seq, op, by, choice, via FROM decision_events WHERE decision=? ORDER BY seq', decision);
+  return { store, broker, make, caps, call, raise, events, grantEvents, settle, closes, enrolls, grant };
+}
+
+test('N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one', () => {
+  assert.deepEqual([...CONSOLE_VERBS], ['decision.preview.console', 'decision.resolve.console']);
+  assert.equal(CONSOLE_VERBS.includes('decision.resolve'), false);
+  assert.ok(Object.isFrozen(CONSOLE_VERBS));
+});
+
+test('bindConsole takes only the business human and a three-string owner subject', (t) => {
+  const f = setup(t);
+  const bind = (record) => () => f.broker.bindConsole(record);
+  refusesSync(bind({ business: 'demo', human: 'someone', subject: SUBJECT }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, name: 'Jason' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { provider: 'p', iss: 'i' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: '' } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: 'x'.repeat(513) } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: { ...SUBJECT, sub: 7 } }), 'human-required');
+  refusesSync(bind({ business: 'demo', human: 'jason', subject: 'owner-1' }), 'human-required');
+  assert.throws(bind({ business: 'demo', human: 'jason', subject: SUBJECT, via: 'cli' }));
+  assert.throws(bind({ business: 'demo', human: 'jason' }));
+  assert.throws(bind({ business: 'other', human: 'jason', subject: SUBJECT }));
+  assert.deepEqual(f.broker.identity(f.caps.console), { business: 'demo', role: null, run: null, human: 'jason' });
+});
+
+test('J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const preview = f.call('console', 'decision.preview.console', { id: d.id });
+  const args = { id: d.id, choice: 'yes', digest: preview.digest };
+  // Agents, the cli human, the tester and the reader are refused before the verb runs.
+  for (const who of ['chief', 'pm', 'human', 'tester', 'reader']) {
+    refusesSync(() => f.call(who, 'decision.preview.console', { id: d.id }), 'human-required');
+    refusesSync(() => f.call(who, 'decision.resolve.console', args), 'human-required');
+  }
+  // N4: the console cap answers nothing through decision.resolve, and reaches no other verb.
+  for (const [verb, a] of [
+    ['decision.resolve', { id: d.id, choice: 'yes' }],
+    ['decision.seen', { id: d.id }],
+    ['decision.withdraw', { id: d.id }],
+    ['decision.raise', { action: 'credential.mint', question: 'q', options, recommendation: 'yes', blocking: false, grant: f.grant }],
+    ['inbox', {}],
+    ['message.send', { to: 'chief', body: 'hi' }],
+    ['role.claim', {}],
+  ])
+    refusesSync(() => f.call('console', verb, a), 'human-required');
+  assert.deepEqual(f.closes(d.id), []);
+  assert.equal(f.enrolls.length, 0);
+});
+
+test('preview: the two real answers, a grant summary and the digest, for an open grant request only', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const p = f.call('console', 'decision.preview.console', { id: d.id });
+  assert.equal(p.id, d.id);
+  assert.equal(p.business, 'demo');
+  assert.match(p.question, /^Enroll web1\?/);
+  assert.deepEqual(p.approve, { key: 'yes', text: 'Yes, enroll it' });
+  assert.deepEqual(p.deny, { key: 'no', text: 'No' });
+  assert.deepEqual(p.grant, { method: 'host-enroll', host: 'web1' });
+  assert.match(p.digest, /^[a-f0-9]{64}$/);
+  // Read twice, the digest is the same; a preview writes nothing.
+  assert.equal(f.call('console', 'decision.preview.console', { id: d.id }).digest, p.digest);
+  assert.deepEqual(f.closes(d.id), []);
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: d.id, choice: 'yes' }), 'invalid-request');
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: 'no-such-decision' }), 'decision-not-found');
+  // The inbox row says the same, for the human and the reader. The agent-facing views do not.
+  for (const who of ['human', 'reader']) {
+    const row = f.call(who, 'inbox').find((r) => r.id === d.id);
+    assert.deepEqual(row.console, { approve: p.approve, deny: p.deny, grant: p.grant, digest: p.digest });
+  }
+});
+
+test('J1, J2: a decision that is not an eligible grant request refuses both console verbs', async (t) => {
+  const f = setup(t);
+  const grant = { method: 'host', agent: 'pm', host: 'web1', commands: ['uptime'], rotateBy: '2099-01-01' };
+  const ineligible = [
+    grantDecision(f.store, { action: 'deploy', grant, close: null }),
+    grantDecision(f.store, { route: 'pm', grant, close: null }),
+    grantDecision(f.store, { grant: undefined, close: null }),
+  ];
+  for (const id of ineligible) {
+    refusesSync(() => f.call('console', 'decision.preview.console', { id }), 'decision-not-eligible');
+    refusesSync(() => f.call('console', 'decision.resolve.console', { id, choice: 'yes', digest: '0'.repeat(64) }), 'decision-not-eligible');
+    assert.equal(f.call('human', 'inbox').find((r) => r.id === id)?.console, undefined);
+  }
+});
+
+test('N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  const r = f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest });
+  assert.deepEqual(r, { id: d.id, op: 'resolved', choice: 'yes', grant: 'started' });
+  const [close] = f.closes(d.id);
+  assert.deepEqual({ ...close, seq: undefined }, { seq: undefined, op: 'resolved', by: 'jason', choice: 'yes', via: 'console' });
+  const input = f.events().filter((e) => e.kind === 'human.input' && e.about === d.id);
+  assert.equal(input.length, 1);
+  assert.deepEqual(
+    { ...input[0], seq: undefined },
+    { seq: undefined, kind: 'answer', actor_role: null, actor_run: null, about: d.id, decision: d.id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: close.seq },
+  );
+  await f.settle(d.id);
+  assert.equal(f.enrolls.length, 1);
+  const spend = f.grantEvents(d.id).find((e) => e.operation === 'grant.host-enroll');
+  assert.ok(spend && input[0].seq < spend.seq, 'the human.input precedes the executor spend');
+  assert.ok(f.grantEvents(d.id).some((e) => e.action === 'grant.host.enrolled'));
+  // N3: the close notice to the raiser comes from the human through the Console.
+  const notices = f.store.all("SELECT from_run, body FROM messages WHERE business='demo' AND decision=? AND class='DECISION' AND from_role='human'", d.id);
+  assert.equal(notices.length, 1);
+  const [notice] = notices;
+  assert.equal(notice.from_run, 'human-console');
+  assert.match(notice.body, /resolved by jason: yes \(Yes, enroll it\)/);
+  // A second answer of either kind finds it closed, and nothing starts again.
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest }), 'decision-closed');
+  refusesSync(() => f.call('console', 'decision.preview.console', { id: d.id }), 'decision-closed');
+  refusesSync(() => f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }), 'decision-closed');
+  await sleep(50);
+  assert.equal(f.enrolls.length, 1);
+  assert.equal(f.closes(d.id).length, 1);
+});
+
+test('J15: a Console deny closes with the other key and starts nothing', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  const r = f.call('console', 'decision.resolve.console', { id: d.id, choice: 'no', digest });
+  assert.deepEqual(r, { id: d.id, op: 'resolved', choice: 'no' });
+  assert.deepEqual(f.closes(d.id).map((c) => [c.op, c.choice, c.via]), [['resolved', 'no', 'console']]);
+  await sleep(100);
+  assert.equal(f.enrolls.length, 0);
+  assert.deepEqual(f.grantEvents(d.id), []);
+  assert.deepEqual(f.make().reconcileGrants(), []);
+});
+
+test('J2: approve and deny come from approvalChoice and the options, not a fixed yes and no', async (t) => {
+  const f = setup(t);
+  // Deny listed first, so a build that takes options[0] as approve fails too.
+  const keyed = { options: [{ key: 'stop', text: 'Stop' }, { key: 'go', text: 'Go ahead' }], approvalChoice: 'go', recommendation: 'go' };
+  const denied = await f.raise({ ...keyed, question: 'Enroll web1? (deny)' });
+  const p = f.call('console', 'decision.preview.console', { id: denied.id });
+  assert.deepEqual([p.approve, p.deny], [{ key: 'go', text: 'Go ahead' }, { key: 'stop', text: 'Stop' }]);
+  for (const choice of ['yes', 'no']) refusesSync(() => f.call('console', 'decision.resolve.console', { id: denied.id, choice, digest: p.digest }), 'decision-stale');
+  assert.deepEqual(f.call('console', 'decision.resolve.console', { id: denied.id, choice: 'stop', digest: p.digest }), { id: denied.id, op: 'resolved', choice: 'stop' });
+  await sleep(100);
+  assert.equal(f.enrolls.length, 0);
+  const approved = await f.raise({ ...keyed, question: 'Enroll web1? (approve)' });
+  const { digest } = f.call('console', 'decision.preview.console', { id: approved.id });
+  assert.deepEqual(f.call('console', 'decision.resolve.console', { id: approved.id, choice: 'go', digest }), { id: approved.id, op: 'resolved', choice: 'go', grant: 'started' });
+  await f.settle(approved.id);
+  assert.equal(f.enrolls.length, 1);
+});
+
+test('J11: a stale digest or a key outside the two refuses decision-stale and writes nothing', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const { digest } = f.call('console', 'decision.preview.console', { id: d.id });
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest: 'f'.repeat(64) }), 'decision-stale');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'maybe', digest }), 'decision-stale');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes' }), 'invalid-request');
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest, note: 'x' }), 'invalid-request');
+  // Another decision's digest does not answer this one.
+  const other = await f.raise({ question: 'Enroll web1 again?' });
+  const od = f.call('console', 'decision.preview.console', { id: other.id }).digest;
+  assert.notEqual(od, digest);
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest: od }), 'decision-stale');
+  assert.deepEqual(f.closes(d.id), []);
+  assert.equal(f.events().filter((e) => e.kind === 'human.input').length, 0);
+  // A refusal is recorded, as for every verb.
+  assert.ok(f.events().some((e) => e.kind === 'action.refused' && e.code === 'decision-stale'));
+  // The decision closed by the cli meanwhile: the console answer finds it closed.
+  f.call('human', 'decision.resolve', { id: d.id, choice: 'no' });
+  refusesSync(() => f.call('console', 'decision.resolve.console', { id: d.id, choice: 'yes', digest }), 'decision-closed');
+});
+
+test('J14: a via console close with no matching human.input approves nothing', (t) => {
+  const f = setup(t);
+  const grant = { method: 'host-enroll', host: 'web2', address: '192.0.2.11', port: 22, user: 'jarvis', sudo: true, fingerprints: [] };
+  const cli = grantDecision(f.store, { grant });
+  const bare = grantDecision(f.store, { grant: { ...grant, host: 'web3' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const wrong = grantDecision(f.store, { grant: { ...grant, host: 'web4' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const good = grantDecision(f.store, { grant: { ...grant, host: 'web5' }, close: { op: 'resolved', by: 'jason', choice: 'yes', via: 'console' } });
+  const seqOf = (id) => f.store.get('SELECT seq FROM decision_events WHERE decision=?', id).seq;
+  const input = (id, body, role = null) =>
+    f.store.run(
+      "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'human.input',?,?,?,?)",
+      'e-' + id + '-' + Math.random(), '2026-10-22T00:00:00.000Z', 'demo', role, role && role + '-run', id, JSON.stringify(body),
+    );
+  const answer = (id) => ({ kind: 'answer', decision: id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: seqOf(id) });
+  // `bare` has no human.input at all. `wrong` has records that each break one part: another seq, choice, empty subject, an agent actor.
+  input(wrong, { ...answer(wrong), decisionSeq: seqOf(wrong) + 1000 });
+  input(wrong, { ...answer(wrong), choice: 'no' });
+  input(wrong, { ...answer(wrong), subject: { ...SUBJECT, sub: '' } });
+  input(wrong, answer(wrong), 'chief');
+  input(good, answer(good));
+  // reconcileGrants ends every approved, unspent host-enroll: exactly the cli one and the good console one.
+  assert.deepEqual(f.make().reconcileGrants().sort(), [cli, good].sort());
+  assert.equal(f.enrolls.length, 0);
+  assert.equal(f.store.get("SELECT count(*) AS n FROM events WHERE business='demo' AND actor_run='grant' AND json_extract(body,'$.decision') IN (?,?)", bare, wrong).n, 0);
+});
+
+test('recordEvent keeps human.input reserved, so no agent forges a console answer', async (t) => {
+  const f = setup(t);
+  const d = await f.raise();
+  const forged = { kind: 'human.input', subject: d.id, body: { kind: 'answer', decision: d.id, op: 'resolved', choice: 'yes', via: 'console', subject: SUBJECT, decisionSeq: 1 } };
+  for (const who of ['chief', 'pm']) refusesSync(() => f.broker.recordEvent(f.caps[who], forged), 'reserved-event');
+  refusesSync(() => f.broker.recordEvent(f.caps.console, forged), 'agent-required');
+  assert.equal(f.events().filter((e) => e.kind === 'human.input').length, 0);
+});

packages/bus/tests/end-launch.test.mjs

@@ -8,6 +8,12 @@ import { join } from 'node:path';
 import { Store } from '../src/store.mjs';
 import { Broker } from '../src/broker.mjs';
 import { Client } from '../src/client.mjs';
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  'INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,\'default\',\'legacy-3l\' FROM threads WHERE id=?',
+  'INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,\'migration-3l\' FROM threads WHERE id=?',
+];
 
 const businesses = {
   demo: {
@@ -149,7 +155,8 @@ test('broker process: launch ops authorize role.launch, record refusals and end
   const side = new Store(data);
   side.run('INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)', 'p-1', '2026-10-15T00:00:00.000Z', 'demo', 'work', null, 'jason');
   side.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', 'th-1', '2026-10-15T00:00:00.000Z', 'demo', 'p-1', 'coder', 'jason', 'one');
-  side.run('INSERT INTO thread_opens(at,thread,by) VALUES(?,?,?)', '2026-10-15T00:00:01.000Z', 'th-1', 'jason');
+  for (const sql of DEFAULT_SESSION) side.run(sql, 'th-1');
+  side.run('INSERT INTO thread_opens(at,thread,session,by) VALUES(?,?,?,?)', '2026-10-15T00:00:01.000Z', 'th-1', 'th-1', 'jason');
   side.close();
   const ready = await ask(child, {
     op: 'boot',

packages/bus/tests/fixtures/schema-3k.sql

@@ -0,0 +1,417 @@
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN (
+    'session.launched',
+    'session.ended',
+    'action.allowed',
+    'action.refused',
+    'task.created',
+    'task.assigned',
+    'task.state',
+    'task.closed',
+    'task.changed.external',
+    'task.conflict',
+    'task.missing',
+    'review.requested',
+    'review.verdict',
+    'human.input',
+    'config.refused',
+    'credential.expiring',
+    'credential.expired',
+    'credential.changed',
+    'launch.revoked',
+    'launch.restored',
+    'digest.sent')),
+  actor_role TEXT, actor_run TEXT,
+  subject TEXT,
+  corrects TEXT REFERENCES events(id),
+  body TEXT NOT NULL CHECK (json_valid(body))
+) STRICT;
+CREATE TABLE role_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, role TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE decisions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, project TEXT,
+  raised_by_role TEXT NOT NULL, raised_by_run TEXT NOT NULL,
+  class TEXT NOT NULL CHECK (class IN ('routine','within-role','cross-role','gated')),
+  action TEXT NOT NULL,
+  route_to TEXT NOT NULL,
+  question TEXT NOT NULL,
+  options TEXT NOT NULL CHECK (json_valid(options) AND json_array_length(options) BETWEEN 2 AND 9),
+  recommendation TEXT NOT NULL,
+  task_ref TEXT CHECK (task_ref IS NULL OR (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*')), requirement_ref TEXT,
+  blocking INTEGER NOT NULL CHECK (blocking IN (0,1)),
+  supersedes TEXT REFERENCES decisions(id)
+, spec_path TEXT, spec_commit TEXT) STRICT;
+CREATE TABLE decision_events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('seen','resolved','withdrawn','expired')),
+  by TEXT NOT NULL,
+  choice TEXT, note TEXT, via TEXT
+) STRICT;
+CREATE TABLE messages (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  from_role TEXT NOT NULL, from_run TEXT NOT NULL,
+  to_role TEXT NOT NULL,
+  class TEXT NOT NULL,
+  in_reply_to TEXT REFERENCES messages(id),
+  decision TEXT REFERENCES decisions(id),
+  corrects TEXT REFERENCES messages(id),
+  body TEXT NOT NULL
+, to_name TEXT) STRICT;
+CREATE TABLE deliveries (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  message TEXT NOT NULL REFERENCES messages(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('routed','delivered','failed','read')),
+  holder_run TEXT, transport TEXT, address TEXT, detail TEXT
+) STRICT;
+CREATE TABLE task_snapshots (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  task_ref TEXT NOT NULL CHECK (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*'),
+  updated TEXT NOT NULL,
+  etag TEXT,
+  digest TEXT NOT NULL CHECK (length(digest) = 64 AND NOT digest GLOB '*[^0-9a-f]*'),
+  fields TEXT NOT NULL CHECK (json_valid(fields)),
+  source TEXT NOT NULL CHECK (source IN ('self','poll')),
+  via TEXT CHECK (via IN ('board','cursor','task','reconcile')),
+  read_at TEXT,
+  role TEXT, run TEXT,
+  CHECK ((source = 'self') = (role IS NOT NULL AND run IS NOT NULL)),
+  CHECK ((source = 'poll') = (via IS NOT NULL AND read_at IS NOT NULL)),
+  CHECK (json_type(fields, '$.bucket') IS 'integer'
+         OR (source IS 'poll' AND via IS 'task' AND json_type(fields, '$.gone') IS 'text'))
+) STRICT;
+CREATE INDEX task_snapshots_ref ON task_snapshots (business, task_ref, seq);
+CREATE TRIGGER decisions_resolve_once BEFORE INSERT ON decision_events
+  WHEN NEW.op IN ('resolved','withdrawn','expired') AND EXISTS (
+    SELECT 1 FROM decision_events WHERE decision = NEW.decision AND op IN ('resolved','withdrawn','expired'))
+  BEGIN SELECT RAISE(ABORT, 'decision already closed'); END;
+CREATE TRIGGER decisions_resolved_choice BEFORE INSERT ON decision_events
+  WHEN NEW.op = 'resolved' AND (NEW.choice IS NULL OR NOT EXISTS (
+    SELECT 1 FROM decisions d, json_each(d.options) o WHERE d.id = NEW.decision AND json_extract(o.value,'$.key') = NEW.choice))
+  BEGIN SELECT RAISE(ABORT, 'resolution must name one of the options'); END;
+CREATE TRIGGER role_one_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role already held'); END;
+CREATE TRIGGER role_release_by_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role is not held'); END;
+CREATE TRIGGER role_release_same_run BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER role_revoke_needs_decision BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER meta_no_update BEFORE UPDATE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER meta_no_delete BEFORE DELETE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_update BEFORE UPDATE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER events_no_delete BEFORE DELETE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_update BEFORE UPDATE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER role_claims_no_delete BEFORE DELETE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_update BEFORE UPDATE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decisions_no_delete BEFORE DELETE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_update BEFORE UPDATE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER decision_events_no_delete BEFORE DELETE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_update BEFORE UPDATE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER messages_no_delete BEFORE DELETE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_update BEFORE UPDATE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER deliveries_no_delete BEFORE DELETE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER meta_no_replace BEFORE INSERT ON meta WHEN EXISTS (SELECT 1 FROM meta WHERE key = NEW.key) BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_replace BEFORE INSERT ON events WHEN EXISTS (SELECT 1 FROM events WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_replace BEFORE INSERT ON role_claims WHEN EXISTS (SELECT 1 FROM role_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_replace BEFORE INSERT ON decisions WHEN EXISTS (SELECT 1 FROM decisions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_replace BEFORE INSERT ON decision_events WHEN EXISTS (SELECT 1 FROM decision_events WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_replace BEFORE INSERT ON messages WHEN EXISTS (SELECT 1 FROM messages WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_replace BEFORE INSERT ON deliveries WHEN EXISTS (SELECT 1 FROM deliveries WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER task_snapshots_no_update BEFORE UPDATE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_delete BEFORE DELETE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_replace BEFORE INSERT ON task_snapshots WHEN EXISTS (SELECT 1 FROM task_snapshots WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER decisions_blocking_needs_task BEFORE INSERT ON decisions
+  WHEN NEW.blocking = 1 AND NEW.task_ref IS NULL
+  BEGIN SELECT RAISE(ABORT, 'a blocking decision cites the task it blocks'); END;
+CREATE TRIGGER events_launch_by_human BEFORE INSERT ON events
+  WHEN NEW.kind IN ('launch.revoked','launch.restored') AND (NEW.actor_role IS NOT NULL OR NEW.actor_run IS NOT NULL)
+  BEGIN SELECT RAISE(ABORT, 'only the human revokes or restores launching'); END;
+CREATE TRIGGER events_credential_body BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'credential.*' AND (
+    json_extract(NEW.body, '$.service') IS NULL OR json_extract(NEW.body, '$.service') NOT IN ('gitea','vikunja')
+    OR json_extract(NEW.body, '$.instance') IS NULL)
+  BEGIN SELECT RAISE(ABORT, 'credential events name a service and a role instance'); END;
+CREATE TRIGGER events_task_missing_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.missing' AND (
+    json_extract(NEW.body, '$.reason') IS NULL OR json_extract(NEW.body, '$.reason') NOT IN ('moved','not-found','no-access')
+    OR (json_extract(NEW.body, '$.reason') = 'moved' AND json_type(NEW.body, '$.project') IS NOT 'integer'))
+  BEGIN SELECT RAISE(ABORT, 'task.missing carries a reason, and the new project when moved'); END;
+CREATE TRIGGER events_task_subject BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'task.*' AND (NEW.subject IS NULL OR NOT (NEW.subject GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(NEW.subject, 9) GLOB '*[^0-9/]*' AND NOT substr(NEW.subject, 9) GLOB '*/*/*'))
+  BEGIN SELECT RAISE(ABORT, 'a task event names its task in subject'); END;
+CREATE TRIGGER events_task_created_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.created' AND (
+    json_type(NEW.body, '$.request') IS NOT 'text'
+    OR NOT EXISTS (SELECT 1 FROM events WHERE id = json_extract(NEW.body, '$.request')
+                   AND kind = 'human.input' AND business = NEW.business)
+    OR json_type(NEW.body, '$.requirement') IS NOT 'text'
+    OR NOT json_extract(NEW.body, '$.requirement') GLOB 'REQ-[A-Z]*-[1-9]*'
+    OR json_extract(NEW.body, '$.requirement') GLOB 'REQ-*[^A-Z0-9-]*')
+  BEGIN SELECT RAISE(ABORT, 'task.created cites the human.input that asked for it and a requirement id'); END;
+CREATE VIEW launch_state AS
+  SELECT business, CASE kind WHEN 'launch.revoked' THEN 'revoked' ELSE 'allowed' END AS state, at
+  FROM events e WHERE kind IN ('launch.revoked','launch.restored')
+    AND seq = (SELECT max(seq) FROM events WHERE business = e.business AND kind IN ('launch.revoked','launch.restored'));
+CREATE VIEW task_external_changes AS
+  SELECT p.business, p.task_ref, p.seq, p.via, p.updated, p.digest, ls.digest AS self_digest
+  FROM task_snapshots p
+  LEFT JOIN task_snapshots ls ON ls.seq = (SELECT max(seq) FROM task_snapshots
+                                           WHERE business = p.business AND task_ref = p.task_ref AND source = 'self')
+  WHERE p.source = 'poll'
+    AND p.seq = (SELECT max(seq) FROM task_snapshots WHERE business = p.business AND task_ref = p.task_ref)
+    AND (ls.seq IS NULL OR (p.updated >= ls.updated AND p.read_at > ls.at AND p.digest <> ls.digest));
+CREATE VIEW task_current AS
+  SELECT s.seq, s.at, s.business, s.task_ref, s.updated, s.etag, s.digest, s.fields, s.source, s.via, s.read_at, s.role, s.run
+  FROM task_snapshots s
+  WHERE s.seq = (SELECT max(c.seq) FROM task_snapshots c
+                 WHERE c.business = s.business AND c.task_ref = s.task_ref
+                   AND (c.source = 'self'
+                        OR c.read_at > coalesce((SELECT ls.at FROM task_snapshots ls
+                                                 WHERE ls.business = c.business AND ls.task_ref = c.task_ref AND ls.source = 'self'
+                                                 ORDER BY ls.seq DESC LIMIT 1), '')));
+CREATE VIEW tasks_open AS
+  SELECT s.business, s.task_ref, json_extract(s.fields, '$.bucket') AS bucket, s.seq
+  FROM task_current s
+  WHERE json_type(s.fields, '$.gone') IS NULL
+    AND json_extract(s.fields, '$.done') = 0;
+CREATE VIEW urgent_inbox AS
+  SELECT d.id, d.business, d.task_ref, d.question, d.at
+  FROM decisions d
+  WHERE d.class = 'gated' AND d.blocking = 1
+    AND NOT EXISTS (SELECT 1 FROM decision_events x WHERE x.decision = d.id AND x.op IN ('resolved','withdrawn','expired'));
+CREATE TABLE task_comment_cursors (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  business TEXT NOT NULL,
+  task_id INTEGER NOT NULL CHECK (task_id > 0),
+  last_comment INTEGER NOT NULL CHECK (last_comment > 0)
+) STRICT;
+CREATE INDEX task_comment_cursors_latest ON task_comment_cursors (business, task_id, seq);
+CREATE TRIGGER task_comment_cursors_no_update BEFORE UPDATE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_delete BEFORE DELETE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_replace BEFORE INSERT ON task_comment_cursors
+  WHEN EXISTS (SELECT 1 FROM task_comment_cursors WHERE seq = NEW.seq)
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_forward BEFORE INSERT ON task_comment_cursors
+  WHEN NEW.last_comment <= COALESCE((SELECT last_comment FROM task_comment_cursors
+    WHERE business = NEW.business AND task_id = NEW.task_id ORDER BY seq DESC LIMIT 1), 0)
+  BEGIN SELECT RAISE(ABORT, 'comment cursor must advance'); END;
+CREATE TABLE projects (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  name TEXT NOT NULL,
+  repo TEXT,
+  created_by TEXT NOT NULL,
+  UNIQUE (business, name)
+) STRICT;
+CREATE TABLE threads (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  project TEXT NOT NULL REFERENCES projects(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  UNIQUE (project, name)
+) STRICT;
+CREATE TABLE thread_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE message_threads (
+  message TEXT PRIMARY KEY REFERENCES messages(id),
+  thread TEXT NOT NULL REFERENCES threads(id)
+) STRICT;
+CREATE TABLE thread_opens (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE TRIGGER threads_project_business BEFORE INSERT ON threads
+  WHEN (SELECT business FROM projects WHERE id = NEW.project) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread belongs to its project''s business'); END;
+CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'thread already held'); END;
+CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = c.thread) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a thread'); END;
+CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'thread is not held'); END;
+CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE thread = NEW.thread ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
+  WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
+  WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
+    WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
+CREATE TRIGGER delivery_same_thread BEFORE INSERT ON deliveries
+  WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
+    AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
+      WHERE mt.message = NEW.message AND m.to_role = t.instance
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE thread = t.id)
+          AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its thread''s holder'); END;
+CREATE TRIGGER projects_no_update BEFORE UPDATE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_delete BEFORE DELETE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_replace BEFORE INSERT ON projects WHEN EXISTS (SELECT 1 FROM projects WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER threads_no_update BEFORE UPDATE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_delete BEFORE DELETE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_replace BEFORE INSERT ON threads WHEN EXISTS (SELECT 1 FROM threads WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER message_threads_no_update BEFORE UPDATE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_delete BEFORE DELETE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_replace BEFORE INSERT ON message_threads WHEN EXISTS (SELECT 1 FROM message_threads WHERE message = NEW.message) BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER thread_opens_no_update BEFORE UPDATE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_delete BEFORE DELETE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_replace BEFORE INSERT ON thread_opens WHEN EXISTS (SELECT 1 FROM thread_opens WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TABLE instance_names (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  name TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE TRIGGER instance_names_unique BEFORE INSERT ON instance_names
+  WHEN EXISTS (SELECT 1 FROM instance_names n WHERE n.business = NEW.business AND n.name = NEW.name
+    AND n.instance <> NEW.instance
+    AND n.seq = (SELECT max(seq) FROM instance_names WHERE business = n.business AND instance = n.instance))
+  BEGIN SELECT RAISE(ABORT, 'an instance name is unique in its business'); END;
+CREATE TRIGGER instance_names_no_update BEFORE UPDATE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_delete BEFORE DELETE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_replace BEFORE INSERT ON instance_names WHEN EXISTS (SELECT 1 FROM instance_names WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+-- Row 124 (#1618): immutable source snapshots and turn outcomes, never transcript text.
+CREATE TABLE usage_records (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  run TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  provider TEXT,
+  model TEXT,
+  account TEXT,
+  turn TEXT NOT NULL,
+  source TEXT NOT NULL,
+  phase TEXT NOT NULL CHECK (phase IN ('begin','end')),
+  status TEXT NOT NULL CHECK (status IN ('known','unknown')),
+  code TEXT,
+  cursor TEXT CHECK (cursor IS NULL OR json_valid(cursor)),
+  input INTEGER,
+  output INTEGER,
+  cache_write INTEGER,
+  cache_read INTEGER,
+  UNIQUE (business,run,turn,source,phase),
+  CHECK ((status='unknown' AND input IS NULL AND output IS NULL AND cache_write IS NULL AND cache_read IS NULL)
+    OR (status='known' AND input >= 0 AND output >= 0 AND cache_write >= 0 AND cache_read >= 0
+      AND input IS NOT NULL AND output IS NOT NULL AND cache_write IS NOT NULL AND cache_read IS NOT NULL))
+) STRICT;
+CREATE TRIGGER usage_records_no_update BEFORE UPDATE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_delete BEFORE DELETE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_replace BEFORE INSERT ON usage_records WHEN EXISTS (SELECT 1 FROM usage_records WHERE seq=NEW.seq OR (business=NEW.business AND run=NEW.run AND turn=NEW.turn AND source=NEW.source AND phase=NEW.phase)) BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TABLE hosts (
+  business TEXT NOT NULL,
+  host TEXT NOT NULL,
+  address TEXT NOT NULL,
+  port INTEGER NOT NULL CHECK (port BETWEEN 1 AND 65535),
+  user TEXT NOT NULL,
+  sudo INTEGER NOT NULL CHECK (sudo IN (0,1)),
+  host_keys TEXT NOT NULL CHECK (json_valid(host_keys) AND json_type(host_keys) = 'array' AND json_array_length(host_keys) > 0),
+  installer_fingerprint TEXT,
+  state TEXT NOT NULL CHECK (state IN ('pending-install','ready')),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  checked_at TEXT,
+  PRIMARY KEY (business, host),
+  CHECK (state = 'pending-install' OR (installer_fingerprint IS NOT NULL AND checked_at IS NOT NULL))
+) STRICT;
+CREATE TABLE host_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  host TEXT NOT NULL,
+  commands TEXT NOT NULL CHECK (json_valid(commands) AND json_type(commands) = 'array' AND json_array_length(commands) > 0),
+  rotate_by TEXT NOT NULL,
+  tag TEXT NOT NULL CHECK (length(tag) = 39 AND tag GLOB 'mosaic-*' AND NOT substr(tag, 8) GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent, host),
+  FOREIGN KEY (business, host) REFERENCES hosts(business, host)
+) STRICT;
+CREATE TRIGGER events_grant_actor BEFORE INSERT ON events
+  WHEN NEW.kind = 'action.allowed'
+    AND (json_extract(NEW.body, '$.action') GLOB 'grant.*' OR json_extract(NEW.body, '$.operation') GLOB 'grant.*')
+    AND NOT (NEW.actor_role IS NULL AND NEW.actor_run IS 'grant')
+  BEGIN SELECT RAISE(ABORT, 'only the grant writer records grant events'); END;
+CREATE TABLE gitea_users (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  id INTEGER NOT NULL CHECK (id > 0),
+  nonce TEXT NOT NULL CHECK (length(nonce) = 16 AND NOT nonce GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent)
+) STRICT;
+CREATE TABLE gitea_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  token_id INTEGER NOT NULL CHECK (token_id > 0),
+  token_name TEXT NOT NULL,
+  projects TEXT NOT NULL CHECK (json_valid(projects) AND json_type(projects) = 'array' AND json_array_length(projects) > 0),
+  rotate_by TEXT NOT NULL,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent),
+  FOREIGN KEY (business, agent) REFERENCES gitea_users(business, agent)
+) STRICT;

packages/bus/tests/gitea-migration.test.mjs

@@ -32,14 +32,26 @@ function source3j(t) {
   db.close(); chmodSync(path, 0o600);
   return { root, path };
 }
+// Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
+const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
+const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function rows(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants','sessions','session_defaults')").all()
       .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
         .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
   } finally { db.close(); }
 }
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row even when it copies none (3k-3l.sql:50-52). The compare after the step
+// leaves out the rows SESSIONS_3L names and checks they are exactly those two at seq 0, so any other
+// new row still fails.
+function migrated3l(now) {
+  const left = now.sqlite_sequence.filter(r => SESSIONS_3L.includes(r.name));
+  assert.deepEqual(left, [{ name: 'sessions', seq: 0 }, { name: 'session_defaults', seq: 0 }]);
+  return { ...now, sqlite_sequence: now.sqlite_sequence.filter(r => !SESSIONS_3L.includes(r.name)) };
+}
 function master(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
@@ -61,6 +73,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
   for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql'])
     copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
   writeFileSync(join(moduleRoot, 'src/migrations/3j-3k.sql'), step(readFileSync(here('../src/migrations/3j-3k.sql'), 'utf8')));
+  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -82,10 +95,10 @@ test('3j copy migrates to 3k: every row kept, and sqlite_master gains only the t
   const { root, path } = source3j(t), before = rows(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
-  assert.deepEqual(rows(path), before);
+  assert.equal(version(path), '3l');
+  assert.deepEqual(migrated3l(rows(path)), before);
   const now = master(path);
-  assert.deepEqual(now.filter(r => !NEW.includes(r.name)), was);
+  assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
   assert.deepEqual(now.filter(r => NEW.includes(r.name)).map(r => r.name).sort(), [...NEW].sort());
   const store = new Store(root);
   try {
@@ -108,10 +121,10 @@ test('a 3j→3k step that fails partway leaves the store at 3j with every row an
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), before);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
 });
 
-test('the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k', async t => {
+test('the 3j engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
   const { root, path } = source3j(t);
   new Store(root, { migrateSchema: true }).close();
   const after = rows(path), was = master(path);
@@ -119,14 +132,14 @@ test('the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k',
     schema: ddl3j,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3j).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3j';")
+      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3j';")
       .replace(/\}, \{\n {2}\/\/ Row 236 \(#1742[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3j/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3j';") && !pinned.includes('3j-3k'), 'the 3j engine has no 3j→3k step');
   assert.throws(() => new Store3j(root), /schema-mismatch/);
   assert.throws(() => new Store3j(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), after);
 });

packages/bus/tests/grant-migration.test.mjs

@@ -18,6 +18,9 @@ const here = (p) => new URL(p, import.meta.url);
 const NEW = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hosts_1', 'sqlite_autoindex_host_grants_1'];
 // Row 236 (#1742): 3j→3k's objects, after this step. Their test is gitea-migration.test.mjs.
 const LATER = ['gitea_users', 'gitea_grants', 'sqlite_autoindex_gitea_users_1', 'sqlite_autoindex_gitea_grants_1'];
+// Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
+const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
+const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3i(t) {
   const root = mkdtempSync(join(tmpdir(), 'grant-migrate-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -37,11 +40,20 @@ function source3i(t) {
 function rows(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults')").all()
       .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
         .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
   } finally { db.close(); }
 }
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row even when it copies none (3k-3l.sql:50-52). The compare after the step
+// leaves out the rows SESSIONS_3L names and checks they are exactly those two at seq 0, so any other
+// new row still fails.
+function migrated3l(now) {
+  const left = now.sqlite_sequence.filter(r => SESSIONS_3L.includes(r.name));
+  assert.deepEqual(left, [{ name: 'sessions', seq: 0 }, { name: 'session_defaults', seq: 0 }]);
+  return { ...now, sqlite_sequence: now.sqlite_sequence.filter(r => !SESSIONS_3L.includes(r.name)) };
+}
 function master(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
@@ -64,6 +76,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
     copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
   writeFileSync(join(moduleRoot, 'src/migrations/3i-3j.sql'), step(readFileSync(here('../src/migrations/3i-3j.sql'), 'utf8')));
   copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
+  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -87,10 +100,10 @@ test('3i copy migrates to 3j: every row kept, and sqlite_master gains only the t
   const { root, path } = source3i(t), before = rows(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
-  assert.deepEqual(rows(path), before);
+  assert.equal(version(path), '3l');
+  assert.deepEqual(migrated3l(rows(path)), before);
   const now = master(path).filter(r => !LATER.includes(r.name));
-  assert.deepEqual(now.filter(r => !NEW.includes(r.name)), was);
+  assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
   assert.deepEqual(now.filter(r => NEW.includes(r.name)).map(r => r.name).sort(), [...NEW].sort());
   const store = new Store(root);
   try {
@@ -112,10 +125,10 @@ test('a 3i→3j step that fails partway leaves the store at 3i with every row an
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), before);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
 });
 
-test('the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j', async t => {
+test('the 3i engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
   const { root, path } = source3i(t);
   new Store(root, { migrateSchema: true }).close();
   const after = rows(path), was = master(path);
@@ -123,14 +136,14 @@ test('the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j',
     schema: ddl3i,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3i).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3i';")
+      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3i';")
       .replace(/\}, \{\n {2}\/\/ Row 234 \(#1740\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3i/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3i';") && !pinned.includes('3i-3j'), 'the 3i engine has no 3i→3j step');
   assert.throws(() => new Store3i(root), /schema-mismatch/);
   assert.throws(() => new Store3i(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3k');
+  assert.equal(version(path), '3l');
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), after);
 });

packages/bus/tests/message-filter.test.mjs

@@ -15,6 +15,12 @@ import { fixture } from './spec-fixtures.mjs';
 const AT = '2026-10-21T00:00:00.000Z';
 const within = (grants) => ({ authority: { withinRole: grants, crossRole: [] } });
 const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  'INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,\'default\',\'legacy-3l\' FROM threads WHERE id=?',
+  'INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,\'migration-3l\' FROM threads WHERE id=?',
+];
 
 // A thread owned by `owner`, on the business's assistant instance.
 function threadOf(store, project, owner, name) {
@@ -23,6 +29,7 @@ function threadOf(store, project, owner, name) {
     'INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)',
     id, AT, 'demo', project, 'assistant', owner, name,
   );
+  for (const sql of DEFAULT_SESSION) store.run(sql, id);
   return id;
 }
 // A message with its thread row, its routed delivery and one event about it. The event names the
@@ -33,7 +40,7 @@ function put(store, { thread = null, from_role, from_run, to_role, in_reply_to =
     'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
     id, AT, 'demo', from_role, from_run, to_role, 'INFO', in_reply_to, decision, null, body,
   );
-  if (thread) store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', id, thread);
+  if (thread) store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', id, thread, thread);
   store.run('INSERT INTO deliveries(message,at,op,holder_run,transport,address) VALUES(?,?,?,?,?,?)', id, AT, 'routed', null, null, null);
   store.run(
     'INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,?,?,?,?,?)',

packages/bus/tests/name-migration.test.mjs

@@ -50,19 +50,29 @@ function snapshot(path, columns) {
     return { columns, rows };
   } finally { db.close(); }
 }
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row (3k-3l.sql:50-52), at seq 1 for the one thread here. The compare after
+// the step leaves those two rows out and checks them exactly, so any other new row still fails.
+// thread_claims and thread_opens stay in the compare: the step carries their seq.
+const SEQ_3L = ['sessions', 'session_defaults'];
+function migrated3l(rows) {
+  const left = rows.sqlite_sequence.filter(r => SEQ_3L.includes(r.name));
+  assert.deepEqual(left.map(r => ({ ...r })), [{ name: 'sessions', seq: 1 }, { name: 'session_defaults', seq: 1 }]);
+  return { ...rows, sqlite_sequence: rows.sqlite_sequence.filter(r => !SEQ_3L.includes(r.name)) };
+}
 test('3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name', t => {
   const { root, path, copy } = source3f(t), before = snapshot(path), untouched = readFileSync(copy);
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
     assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
     assert.equal(store.get('SELECT count(*) AS n FROM instance_names').n, 0);
     assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: 'docs/spec.md', spec_commit: 'c'.repeat(40) });
     assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
     assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
   } finally { store.close(); }
-  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
+  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
   assert.deepEqual(readFileSync(copy), untouched);
   assert.deepEqual(snapshot(copy).rows, before.rows);
   new Store(root).close();

packages/bus/tests/principal.test.mjs

@@ -46,3 +46,52 @@ test('human leaf identity is reread after walking the parents',()=>{
  c.readProcess=pid=>{const p=read(pid);if(pid===50&&n++>0)p.startTime='101';return p;};
  assert.throws(()=>verifyPrincipal({human:proof},c),/human-required/);
 });
+
+// Row 252 (#1753, design section 2, J3-J5): the Console owner. The same-tree console-cli wrapper with
+// its own nonce, a direct same-tree `serve` parent, the subject from the wrapper's spawn environment,
+// and that subject one of the configured owners (N1).
+const owner={provider:'fake-oidc',iss:'https://idp.test',sub:'owner-1'};
+function consoleContext() {
+ const c=context('user');c.paths={...paths,consoleCli:'/tree/console-cli.mjs'};c.consoleOwners=[{provider:'other',iss:'https://idp.test',sub:'owner-2'},owner];
+ Object.assign(c.table.get(50),{argv:['node','/tree/console-cli.mjs'],env:{MOSAIC_BUS_CONSOLE_NONCE:nonce,MOSAIC_BUS_CONSOLE_BUSINESS:'demo',MOSAIC_BUS_CONSOLE_PROVIDER:owner.provider,MOSAIC_BUS_CONSOLE_ISS:owner.iss,MOSAIC_BUS_CONSOLE_SUB:owner.sub}});
+ return c;
+}
+const consoleProof={...proof,...owner};
+test('console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env',()=>{
+ assert.deepEqual(verifyPrincipal({console:consoleProof},consoleContext()),{kind:'console',business:'demo',id:'owner',via:'console',subject:owner});
+ // J3: the subject is the spawn's, never the body's alone, and must be a configured owner.
+ for(const change of [{sub:'owner-2'},{iss:'https://evil.test'},{provider:'other'}])
+  assert.throws(()=>verifyPrincipal({console:{...consoleProof,...change}},consoleContext()),/human-required/);
+ const unlisted=consoleContext();unlisted.consoleOwners=[];
+ assert.throws(()=>verifyPrincipal({console:consoleProof},unlisted),/human-required/);
+ for(const extra of [{name:'Jason'},{human:'owner'},{user:'owner'},{sub:''},{sub:'x'.repeat(513)}])
+  assert.throws(()=>verifyPrincipal({console:{...consoleProof,...extra}},consoleContext()),/human-required/);
+ // J4: the parent is the same-tree serve, direct, and not an agent.
+ for(const change of [{argv:['bash']},{argv:['node','/other/console.mjs','serve']},{argv:['node',paths.console,'other']},{env:{CODEX_THREAD_ID:'agent'}},{uid:uid+1}]) {
+  const c=consoleContext();Object.assign(c.table.get(40),change);
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ const launched=consoleContext();launched.launches=[{pid:40,startTime:'90'}];
+ assert.throws(()=>verifyPrincipal({console:consoleProof},launched),/human-required/);
+ // J5: another nonce namespace, or the wrapper path of another kind, refuses.
+ for(const env of [{MOSAIC_BUS_CLI_NONCE:nonce},{MOSAIC_BUS_USER_NONCE:nonce}]) {
+  const c=consoleContext();const t=c.table.get(50);t.env={...t.env,...env};delete t.env.MOSAIC_BUS_CONSOLE_NONCE;
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ for(const argv of [['node',paths.human],['node',paths.user],['node','/other/console-cli.mjs']]) {
+  const c=consoleContext();c.table.get(50).argv=argv;
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ // The Console's own nonce does not answer as the cli human or the user.
+ assert.throws(()=>verifyPrincipal({human:proof},consoleContext()),/human-required/);
+ assert.throws(()=>verifyPrincipal({user:{...proof,user:'owner'}},consoleContext()),/human-required/);
+ // Each piece is read again after the walk: a parent or a spawn subject that changed refuses.
+ for(const [pid,mutate] of [[40,p=>{p.startTime='91';}],[50,p=>{p.env={...p.env,MOSAIC_BUS_CONSOLE_SUB:'owner-2'};}],[50,p=>{p.ppid=41;}]]) {
+  const c=consoleContext(),read=c.readProcess;let n=0;
+  // The last read of each pid is verifyConsole's own reread: 40 is read 3 times, 50 is read 4 times.
+  c.readProcess=x=>{const p=read(x);if(x===pid&&n++===(pid===40?2:3))mutate(p);return p;};
+  assert.throws(()=>verifyPrincipal({console:consoleProof},c),/human-required/);
+ }
+ for(const peer of [{pid:51,uid,gid:uid},{pid:50,uid:uid+1,gid:uid}])assert.throws(()=>verifyPrincipal({console:consoleProof},{...consoleContext(),peer}),/human-required/);
+ assert.throws(()=>verifyPrincipal({console:consoleProof,human:proof},consoleContext()),/invalid-envelope/);
+});

packages/bus/tests/schema.test.mjs

@@ -521,7 +521,8 @@ test('v3b prototype refusals, views and append-only mutations', (t) => {
   // Row 124 adds usage_records and its three append-only triggers.
   // Row 234 (#1740) adds hosts, host_grants and the events_grant_actor guard; grant-migration.test.mjs tests them.
   // Row 236 (#1742) adds gitea_users and gitea_grants; gitea-migration.test.mjs tests them.
-  assert.equal(count('table') - 1, 20);
-  assert.equal(count('trigger'), 71);
+  // Row 264a (#1769) adds sessions, session_defaults and 15 triggers; sessions.test.mjs tests them.
+  assert.equal(count('table') - 1, 22);
+  assert.equal(count('trigger'), 86);
   assert.equal(count('view'), 5);
 });

packages/bus/tests/sessions.test.mjs

@@ -0,0 +1,456 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { Store, schemaDigest } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+
+// Row 264a (#1769, T1 item 7): sessions below a thread, in the bus. T1's bus half, T2 and T7 of
+// docs/plans/2026-10-21_t1-sessions.md. The launcher, seat and Console halves are 264b-264e's.
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const roles = {
+  chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+  assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+  pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+};
+const businesses = {
+  demo: {
+    id: 'demo',
+    human: 'jason',
+    arbiters: { technical: 'pm', delivery: 'chief' },
+    roles,
+    definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging }, pm: {} },
+    projects: { stack: { root: '/nonexistent' } },
+  },
+};
+const AT = '2026-10-21T00:00:00.000Z';
+const now = () => new Date().toISOString();
+const here = (p) => new URL(p, import.meta.url);
+const ddl3k = readFileSync(here('./fixtures/schema-3k.sql'), 'utf8');
+
+function broker(t, store) {
+  const b = new Broker({ store, businesses });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const caps = { human };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const launch = (name, role, extra = {}) => {
+    caps[name] = b.bindLaunch({ business: 'demo', role, run: `${name}-run`, harness: 'pi', ...extra });
+    return caps[name];
+  };
+  const claim = (name) => call(name, 'role.claim');
+  const sessionOf = (message) => store.get('SELECT session FROM message_threads WHERE message=?', message)?.session ?? null;
+  const claims = (session) => store.all('SELECT op, holder_run, generation FROM thread_claims WHERE session=? ORDER BY seq', session).map((r) => ({ ...r }));
+  return { b, store, caps, call, launch, claim, sessionOf, claims };
+}
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-sessions-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const ctx = broker(t, store);
+  const project = ctx.call('human', 'project.create', { name: 'stack work', repo: 'stack' }).id;
+  const A = ctx.call('human', 'thread.create', { project, name: 'alpha' }).id;
+  for (const r of ['chief', 'pm']) {
+    ctx.launch(r, r);
+    ctx.claim(r);
+  }
+  const [first] = ctx.call('human', 'session.list', { thread: A });
+  return { ...ctx, root, project, A, D: first.id };
+}
+
+test('T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies', (t) => {
+  const { call, launch, claim, sessionOf, store, project, A, D } = setup(t);
+  // thread.create made one default session, with a random id that isn't the thread's.
+  assert.deepEqual(call('human', 'session.list', { thread: A }).map((r) => [r.name, r.predecessor, r.default]), [['default', null, true]]);
+  assert.notEqual(D, A);
+  assert.match(D, /^[a-f0-9-]{36}$/);
+  const S = call('human', 'session.create', { thread: A, name: 'second', op: 'op-second' }).id;
+  assert.deepEqual(call('human', 'session.list', { thread: A }).map((r) => [r.id, r.name, r.default]), [
+    [D, 'default', true],
+    [S, 'second', false],
+  ]);
+  // A run with no session named works the default (D3). Each session has its own holder.
+  launch('a1', 'assistant', { thread: A });
+  launch('a2', 'assistant', { thread: A, session: S });
+  assert.deepEqual(claim('a1'), { role: 'assistant', run: 'a1-run', thread: A });
+  assert.deepEqual(claim('a2'), { role: 'assistant', run: 'a2-run', thread: A });
+  const toDefault = call('human', 'thread.send', { thread: A, body: 'to the default' });
+  const toSecond = call('human', 'thread.send', { thread: A, session: S, body: 'to the second' });
+  assert.equal(sessionOf(toDefault.id), D);
+  assert.equal(sessionOf(toSecond.id), S);
+  assert.deepEqual(call('a1', 'message.receive').map((m) => m.body), ['to the default']);
+  assert.deepEqual(call('a2', 'message.receive').map((m) => m.body), ['to the second']);
+  assert.deepEqual(call('a1', 'message.receive'), []);
+  // A reply stays in its run's session, and each history reads only its own.
+  const reply = call('a2', 'message.send', { to: 'human', body: 'second answers', in_reply_to: toSecond.id });
+  assert.equal(sessionOf(reply.id), S);
+  assert.deepEqual(call('human', 'thread.messages', { thread: A }).map((m) => m.body), ['to the default']);
+  assert.deepEqual(call('human', 'thread.messages', { thread: A, session: S }).map((m) => m.body), ['to the second', 'second answers']);
+  // The chief's reply to the second session's work comes back to that session.
+  const ask = call('a2', 'message.send', { to: 'chief', body: 'need help', class: 'REQUEST' });
+  const back = call('chief', 'message.send', { to: 'assistant', body: 'here', in_reply_to: ask.id });
+  assert.equal(sessionOf(back.id), S);
+  assert.deepEqual(call('a2', 'message.receive').map((m) => m.body), ['here']);
+  assert.deepEqual(call('a1', 'message.receive'), []);
+  // An open names its session too.
+  call('human', 'thread.open', { thread: A, session: S });
+  assert.equal(store.get('SELECT session FROM thread_opens ORDER BY seq DESC LIMIT 1').session, S);
+  // A non-thread role names no session, and a session of another thread is refused.
+  assert.throws(() => launch('p2', 'pm', { session: S }), { code: 'thread-not-allowed' });
+  const B = call('human', 'thread.create', { project, name: 'beta' }).id;
+  assert.throws(() => launch('a3', 'assistant', { thread: B, session: S }), { code: 'session-not-found' });
+  assert.throws(() => call('human', 'thread.send', { thread: B, session: S, body: 'x' }), { code: 'session-not-found' });
+  assert.throws(() => call('human', 'thread.messages', { thread: B, session: 'no-such-session' }), { code: 'session-not-found' });
+});
+
+test('T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session\'s message never reaches the other holder', (t) => {
+  const { b, call, launch, claim, claims, store, project, A, D } = setup(t);
+  const S = call('human', 'session.create', { thread: A, name: 'second', op: 'op-second' }).id;
+  launch('a1', 'assistant', { thread: A });
+  claim('a1');
+  launch('a1b', 'assistant', { thread: A });
+  assert.throws(() => claim('a1b'), { code: 'thread-already-held' });
+  // A sibling session is free to claim while the default is held.
+  launch('a2', 'assistant', { thread: A, session: S });
+  claim('a2');
+  // Release and claim again: the second claim is generation 2, and its release carries it.
+  call('a2', 'role.release');
+  launch('a3', 'assistant', { thread: A, session: S });
+  claim('a3');
+  b.endLaunch({ business: 'demo', run: 'a3-run', reason: 'idle' });
+  assert.deepEqual(claims(S), [
+    { op: 'claim', holder_run: 'a2-run', generation: 1 },
+    { op: 'release', holder_run: 'a2-run', generation: 1 },
+    { op: 'claim', holder_run: 'a3-run', generation: 2 },
+    { op: 'release', holder_run: 'a3-run', generation: 2 },
+  ]);
+  // The human's stop revokes each held session, with that claim's generation.
+  launch('a4', 'assistant', { thread: A, session: S });
+  claim('a4');
+  assert.deepEqual(call('human', 'assistant.stop', { instance: 'assistant' }), {
+    stopped: [
+      { thread: A, run: 'a1-run' },
+      { thread: A, run: 'a4-run' },
+    ],
+  });
+  assert.deepEqual(claims(D).at(-1), { op: 'revoke', holder_run: 'a1-run', generation: 1 });
+  assert.deepEqual(claims(S).at(-1), { op: 'revoke', holder_run: 'a4-run', generation: 3 });
+  // The triggers hold these for a write that skips the broker.
+  const raw = (thread, session, generation, run) =>
+    store.run(
+      "INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,by) VALUES(?,'demo',?,?,?,'claim',?,'pi',?)",
+      now(),
+      thread,
+      session,
+      generation,
+      run,
+      run,
+    );
+  assert.throws(() => raw(A, S, 5, 'x-run'), /a claim row names its session's generation/);
+  assert.throws(() => raw(A, S, 3, 'x-run'), /a claim row names its session's generation/);
+  const B = call('human', 'thread.create', { project, name: 'beta' }).id;
+  const [{ id: BD }] = call('human', 'session.list', { thread: B });
+  assert.throws(() => raw(A, BD, 1, 'x-run'), /a claim's session is in its thread/);
+  raw(A, S, 4, 'x-run');
+  assert.throws(() => raw(B, BD, 1, 'x-run'), /run already holds a session/);
+  // A threaded message goes only to its own session's holder.
+  launch('a5', 'assistant', { thread: A });
+  claim('a5');
+  const m = call('human', 'thread.send', { thread: A, session: S, body: 'for x' });
+  assert.throws(
+    () => store.run("INSERT INTO deliveries(message,at,op,holder_run) VALUES(?,?,'delivered',?)", m.id, now(), 'a5-run'),
+    /a threaded message goes only to its session's holder/,
+  );
+  store.run("INSERT INTO deliveries(message,at,op,holder_run) VALUES(?,?,'delivered',?)", m.id, now(), 'x-run');
+});
+
+test('T2 sage-2257: a released or revoked run\'s retired generation refuses its approval, delivery and read, and writes nothing', (t) => {
+  const { call, launch, claim, claims, store, A, D } = setup(t);
+  const tables = store.all("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").map((r) => r.name);
+  const counts = () => Object.fromEntries(tables.map((n) => [n, store.get(`SELECT count(*) AS n FROM "${n}"`).n]));
+  // The run raises a decision, takes one message and leaves a second waiting.
+  const prepare = (name) => {
+    launch(name, 'assistant', { thread: A });
+    claim(name);
+    const d = call(name, 'decision.raise', {
+      action: 'spend',
+      target: 'demo',
+      question: 'spend?',
+      options: [
+        { key: 'yes', text: 'Yes' },
+        { key: 'no', text: 'No' },
+      ],
+      recommendation: 'no',
+      blocking: false,
+    });
+    call('human', 'thread.send', { thread: A, body: `for ${name}` });
+    const [taken] = call(name, 'message.receive');
+    call('human', 'thread.send', { thread: A, body: `waiting after ${name}` });
+    return { d, taken };
+  };
+  // Each refusal leaves its one action.refused event (request()'s catch, #refused); nothing else is
+  // written: no approval, delivery, read or claim state (mos-1277).
+  const lastSeq = () => store.get('SELECT max(seq) AS s FROM events').s;
+  const refusedOnce = (fn, label) => {
+    const from = lastSeq();
+    assert.throws(fn, { code: 'not-holder' }, label);
+    const added = store.all('SELECT kind, body FROM events WHERE seq > ? ORDER BY seq', from);
+    assert.deepEqual(
+      added.map((e) => [e.kind, JSON.parse(e.body)]),
+      [['action.refused', { code: 'not-holder' }]],
+      label,
+    );
+  };
+  const refused = (name, { d, taken }) => {
+    const { events, ...before } = counts();
+    refusedOnce(() => call(name, 'decision.withdraw', { id: d.id }), 'approval');
+    refusedOnce(() => call(name, 'message.receive'), 'delivery');
+    refusedOnce(() => call(name, 'message.read', { id: taken.id }), 'read');
+    const { events: after, ...rest } = counts();
+    assert.deepEqual(rest, before);
+    assert.equal(after, events + 3);
+  };
+  // Released: generation 1 is retired once a2 claims generation 2.
+  const one = prepare('a1');
+  call('a1', 'role.release');
+  const two = prepare('a2');
+  refused('a1', one);
+  // Revoked by the human's stop: generation 2 is retired once a3 claims generation 3.
+  call('human', 'assistant.stop', { instance: 'assistant' });
+  prepare('a3');
+  refused('a2', two);
+  assert.deepEqual(claims(D).map((r) => [r.op, r.holder_run, r.generation]), [
+    ['claim', 'a1-run', 1],
+    ['release', 'a1-run', 1],
+    ['claim', 'a2-run', 2],
+    ['revoke', 'a2-run', 2],
+    ['claim', 'a3-run', 3],
+  ]);
+});
+
+test('session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner\'s threads', (t) => {
+  const { call, store, project, A, D } = setup(t);
+  const first = call('human', 'session.create', { thread: A, name: 'second', op: 'op-1' });
+  assert.deepEqual(call('human', 'session.create', { thread: A, name: 'second', op: 'op-1' }), first);
+  assert.throws(() => call('human', 'session.create', { thread: A, name: 'third', op: 'op-1' }), { code: 'session-op-conflict' });
+  assert.throws(() => call('human', 'session.create', { thread: A, name: 'second', op: 'op-2' }), { code: 'session-exists' });
+  assert.throws(() => call('human', 'session.create', { thread: A, name: 'default', op: 'op-3' }), { code: 'session-exists' });
+  // thread.create's op answers a retry that names the default.
+  assert.deepEqual(call('human', 'session.create', { thread: A, name: 'default', op: 'default' }), { id: D, thread: A, name: 'default' });
+  for (const args of [{ thread: A, name: 'x\ny', op: 'op-4' }, { thread: A, name: 'x' }, { thread: A, name: 'x', op: 'op-5', extra: 1 }])
+    assert.throws(() => call('human', 'session.create', args), { code: 'invalid-request' });
+  assert.equal(store.get('SELECT count(*) n FROM sessions WHERE thread=?', A).n, 2);
+  // Another owner's thread, made by hand with the session the broker would write.
+  const other = 'thread-of-someone-else';
+  store.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', other, now(), 'demo', project, 'assistant', 'someone-else', 'theirs');
+  store.run("INSERT INTO sessions(id,at,business,thread,instance,owner,name,op) VALUES('s-theirs',?,'demo',?,'assistant','someone-else','default','default')", now(), other);
+  store.run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,?,'s-theirs','someone-else')", now(), other);
+  for (const [verb, args] of [
+    ['session.list', { thread: other }],
+    ['session.create', { thread: other, name: 'mine', op: 'op-6' }],
+    ['thread.send', { thread: other, session: 's-theirs', body: 'hi' }],
+  ])
+    assert.throws(() => call('human', verb, args), { code: 'thread-not-owned' }, verb);
+  assert.throws(() => call('human', 'session.list', { thread: 'nope' }), { code: 'thread-not-found' });
+  // Agents don't call the session verbs.
+  assert.throws(() => call('pm', 'session.list', { thread: A }), { code: 'human-required' });
+});
+
+test('the 3l triggers keep sessions in their thread and session ids apart from thread ids', (t) => {
+  // A bare database from schema.sql, so only the triggers stand between a write and the tables.
+  const root = mkdtempSync(join(tmpdir(), 'bus-sessions-sql-'));
+  const db = new DatabaseSync(join(root, 'bus.sqlite'));
+  t.after(() => {
+    db.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  db.exec(readFileSync(here('../schema.sql'), 'utf8'));
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  const session = (id, thread, extra = {}) =>
+    run(
+      'INSERT INTO sessions(id,at,business,thread,instance,owner,name,op,predecessor) VALUES(?,?,?,?,?,?,?,?,?)',
+      id,
+      now(),
+      extra.business ?? 'demo',
+      thread,
+      extra.instance ?? 'assistant',
+      extra.owner ?? 'jason',
+      extra.name ?? id,
+      extra.op ?? id,
+      extra.predecessor ?? null,
+    );
+  run("INSERT INTO projects(id,at,business,name,repo,created_by) VALUES('p-1',?,'demo','work',NULL,'jason')", now());
+  for (const id of ['th-1', 'th-2'])
+    run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,'demo','p-1','assistant','jason',?)", id, now(), id);
+  session('s-1', 'th-1');
+  // The legacy shape: a session whose id is its own thread's.
+  session('th-1', 'th-1', { name: 'default', op: 'legacy-3l' });
+  // A session id that names another thread, and a thread id that names a session, are refused.
+  assert.throws(() => session('th-2', 'th-1'), /a session id names another thread/);
+  assert.throws(
+    () => run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES('s-1',?,'demo','p-1','assistant','jason','x')", now()),
+    /a thread id names a session/,
+  );
+  // A session has its thread's business, instance and owner, and its predecessor is in its thread.
+  for (const extra of [{ business: 'other' }, { instance: 'pm' }, { owner: 'someone-else' }])
+    assert.throws(() => session('s-x', 'th-1', extra), /a session has its thread's business, instance and owner/, JSON.stringify(extra));
+  assert.throws(() => session('s-x', 'th-2', { predecessor: 's-1' }), /a session's predecessor is in its thread/);
+  session('s-2', 'th-1', { predecessor: 's-1' });
+  // The names and op keys are unique in a thread.
+  assert.throws(() => session('s-3', 'th-1', { name: 's-1' }), /UNIQUE/);
+  assert.throws(() => session('s-3', 'th-1', { op: 's-1' }), /UNIQUE/);
+  // A default is a session of its thread.
+  assert.throws(() => run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,'th-2','s-1','jason')", now()), /a default session is in its thread/);
+  run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,'th-1','s-1','jason')", now());
+  // A message's and an open's session is in their thread.
+  run("INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES('m-1',?,'demo','human','human-cli','assistant','INFO','hi')", now());
+  assert.throws(() => run("INSERT INTO message_threads(message,thread,session) VALUES('m-1','th-2','s-1')"), /a threaded message's session is in its thread/);
+  assert.throws(() => run("INSERT INTO thread_opens(at,thread,session,by) VALUES(?,'th-2','s-1','jason')", now()), /an open's session is in its thread/);
+});
+
+// T7: a 3k store from the pinned 3k schema (8f51900b5's, the parent of this change's schema.sql)
+// and fixture rows. No live store is read or copied.
+function source3k(t) {
+  const root = mkdtempSync(join(tmpdir(), 'sessions-migrate-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  mkdirSync(join(root, 'bus'), { mode: 0o700 });
+  const path = join(root, 'bus/bus.sqlite'), db = new DatabaseSync(path);
+  assert.equal(createHash('sha256').update(ddl3k).digest('hex'), 'aba9240825a35fdcc741439d0708efa33afcf519d11cac9952c7207ad99250f0');
+  db.exec(ddl3k);
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  run('INSERT INTO meta VALUES (?,?)', 'schema_version', '3k');
+  run('INSERT INTO meta VALUES (?,?)', 'schema_digest', schemaDigest(db));
+  run('INSERT INTO meta VALUES (?,?)', 'comment_cursor_epoch', AT);
+  run('INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)', 'p-1', AT, 'demo', 'stack work', 'stack', 'jason');
+  for (const id of ['t1', 't2'])
+    run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', id, AT, 'demo', 'p-1', 'assistant', 'jason', id);
+  // Duckworth's fixture: claim, release, claim, revoke on t1, with t2's claim between, at seqs
+  // with gaps so a renumbered copy would show.
+  const claimRow = (seq, thread, op, holder, extra = {}) =>
+    run(
+      'INSERT INTO thread_claims(seq,at,business,thread,op,holder_run,harness,by,reason) VALUES(?,?,?,?,?,?,?,?,?)',
+      seq, AT, 'demo', thread, op, holder, 'pi', extra.by ?? holder, extra.reason ?? null,
+    );
+  claimRow(10, 't1', 'claim', 'a-run');
+  claimRow(11, 't2', 'claim', 'b-run');
+  claimRow(12, 't1', 'release', 'a-run');
+  claimRow(20, 't1', 'claim', 'c-run');
+  claimRow(40, 't1', 'revoke', 'c-run', { by: 'jason', reason: 'stuck' });
+  for (const [id, thread] of [['m-1', 't1'], ['m-2', 't2'], ['m-3', 't1']]) {
+    run('INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES(?,?,?,?,?,?,?,?)', id, AT, 'demo', 'human', 'human-cli', 'assistant', 'INFO', id);
+    run('INSERT INTO message_threads VALUES(?,?)', id, thread);
+  }
+  run('INSERT INTO thread_opens(seq,at,thread,by) VALUES(?,?,?,?)', 7, AT, 't1', 'jason');
+  db.close(); chmodSync(path, 0o600);
+  return { root, path };
+}
+const master = (path) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try {
+    return db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_master ORDER BY type,name').all().map((r) => ({ ...r }));
+  } finally { db.close(); }
+};
+const rows = (path) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try {
+    return Object.fromEntries(['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens', 'meta']
+      .map((name) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all().map((r) => ({ ...r }))]));
+  } finally { db.close(); }
+};
+const version = (path) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try { return db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value; } finally { db.close(); }
+};
+
+test('T7: a 3k store migrates to 3l, each thread\'s default session has the thread\'s id, and old rows keep their seqs', (t) => {
+  const { root, path } = source3k(t);
+  assert.throws(() => new Store(root), /schema-mismatch/);
+  new Store(root, { migrateSchema: true }).close();
+  assert.equal(version(path), '3l');
+  // The migrated schema is the fresh one, object for object.
+  const freshRoot = mkdtempSync(join(tmpdir(), 'sessions-fresh-'));
+  t.after(() => rmSync(freshRoot, { recursive: true, force: true }));
+  new Store(freshRoot).close();
+  assert.deepEqual(master(path), master(join(freshRoot, 'bus/bus.sqlite')));
+  const store = new Store(root);
+  t.after(() => store.close());
+  assert.deepEqual(store.all('SELECT id,at,business,thread,instance,owner,name,op,predecessor FROM sessions ORDER BY seq').map((r) => ({ ...r })), ['t1', 't2'].map((id) => (
+    { id, at: AT, business: 'demo', thread: id, instance: 'assistant', owner: 'jason', name: 'default', op: 'legacy-3l', predecessor: null })));
+  assert.deepEqual(store.all('SELECT at,thread,session,by FROM session_defaults ORDER BY seq').map((r) => ({ ...r })), ['t1', 't2'].map((id) => (
+    { at: AT, thread: id, session: id, by: 'migration-3l' })));
+  // Generation counts claim rows only: claim, release, claim, revoke on t1 is 1, 1, 2, 2.
+  assert.deepEqual(store.all('SELECT seq,thread,session,op,generation FROM thread_claims ORDER BY seq').map((r) => ({ ...r })), [
+    { seq: 10, thread: 't1', session: 't1', op: 'claim', generation: 1 },
+    { seq: 11, thread: 't2', session: 't2', op: 'claim', generation: 1 },
+    { seq: 12, thread: 't1', session: 't1', op: 'release', generation: 1 },
+    { seq: 20, thread: 't1', session: 't1', op: 'claim', generation: 2 },
+    { seq: 40, thread: 't1', session: 't1', op: 'revoke', generation: 2 },
+  ]);
+  assert.deepEqual(store.all('SELECT message,thread,session FROM message_threads ORDER BY rowid').map((r) => ({ ...r })), [
+    { message: 'm-1', thread: 't1', session: 't1' },
+    { message: 'm-2', thread: 't2', session: 't2' },
+    { message: 'm-3', thread: 't1', session: 't1' },
+  ]);
+  assert.deepEqual({ ...store.get('SELECT seq,thread,session,by FROM thread_opens') }, { seq: 7, thread: 't1', session: 't1', by: 'jason' });
+  for (const [name, seq] of [['thread_claims', 40], ['thread_opens', 7]])
+    assert.equal(store.get('SELECT seq FROM sqlite_sequence WHERE name=?', name).seq, seq, name);
+  assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
+  assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
+  // A legacy client names no session and gets the default: t2's holder releases at generation 1,
+  // and t1's next claim is its third.
+  const { call, launch, claim, claims, sessionOf } = broker(t, store);
+  for (const r of ['chief', 'pm']) {
+    launch(r, r);
+    claim(r);
+  }
+  assert.throws(() => call('human', 'session.create', { thread: 't1', name: 'default', op: 'op-new' }), { code: 'session-exists' });
+  store.run("INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,by) VALUES(?,'demo','t2','t2',1,'release','b-run','pi','b-run')", now());
+  assert.equal(store.get("SELECT seq FROM thread_claims WHERE thread='t2' ORDER BY seq DESC LIMIT 1").seq, 41);
+  launch('d', 'assistant', { thread: 't1' });
+  claim('d');
+  assert.deepEqual(claims('t1').at(-1), { op: 'claim', holder_run: 'd-run', generation: 3 });
+  const sent = call('human', 'thread.send', { thread: 't1', body: 'after the step' });
+  assert.equal(sessionOf(sent.id), 't1');
+  assert.deepEqual(call('d', 'message.receive').map((m) => m.body), ['m-1', 'm-3', 'after the step']);
+  assert.deepEqual(call('human', 'thread.messages', { thread: 't1' }).map((m) => m.body), ['m-1', 'm-3', 'after the step']);
+});
+
+// The 3k engine is store.mjs at this change with the 3k schema and version and no 3k→3l step.
+async function engine3k(root) {
+  const moduleRoot = join(root, 'engine-3k');
+  mkdirSync(join(moduleRoot, 'src/migrations'), { recursive: true });
+  const source = readFileSync(here('../src/store.mjs'), 'utf8');
+  const edited = source
+    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3k).digest('hex')}';`)
+    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3k';")
+    .replace(/\}, \{\n {2}\/\/ Row 264a \(#1769\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
+  assert.ok(edited.includes("export const SCHEMA_VERSION = '3k';") && edited.includes('3j-3k') && !edited.includes('3k-3l'), 'the 3k engine has no 3k→3l step');
+  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
+  writeFileSync(join(moduleRoot, 'schema.sql'), ddl3k);
+  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql'])
+    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
+  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
+}
+
+test('T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was', async (t) => {
+  const { root, path } = source3k(t);
+  new Store(root, { migrateSchema: true }).close();
+  const was = master(path), before = rows(path);
+  const Store3k = await engine3k(root);
+  assert.throws(() => new Store3k(root), /schema-mismatch/);
+  assert.throws(() => new Store3k(root, { migrateSchema: true }), /schema-mismatch/);
+  assert.equal(version(path), '3l');
+  assert.deepEqual(master(path), was);
+  assert.deepEqual(rows(path), before);
+  // The same engine opens a fresh 3k store, so the refusal is the version's and not a broken copy.
+  const { root: old } = source3k(t);
+  new Store3k(old).close();
+});

packages/bus/tests/spec-migration.test.mjs

@@ -48,17 +48,27 @@ function snapshot(path, columns) {
     return { columns, rows };
   } finally { db.close(); }
 }
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row (3k-3l.sql:50-52), at seq 1 for the one thread here. The compare after
+// the step leaves those two rows out and checks them exactly, so any other new row still fails.
+// thread_claims and thread_opens stay in the compare: the step carries their seq.
+const SEQ_3L = ['sessions', 'session_defaults'];
+function migrated3l(rows) {
+  const left = rows.sqlite_sequence.filter(r => SEQ_3L.includes(r.name));
+  assert.deepEqual(left.map(r => ({ ...r })), [{ name: 'sessions', seq: 1 }, { name: 'session_defaults', seq: 1 }]);
+  return { ...rows, sqlite_sequence: rows.sqlite_sequence.filter(r => !SEQ_3L.includes(r.name)) };
+}
 test('3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations', t => {
   const { root, path, copy } = source3e(t), before = snapshot(path), untouched = readFileSync(copy);
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
     assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: null, spec_commit: null });
     assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
     assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
   } finally { store.close(); }
-  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
+  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
   assert.deepEqual(readFileSync(copy), untouched);
   assert.deepEqual(snapshot(copy).rows, before.rows);
   new Store(root).close();

packages/bus/tests/tester-writes.test.mjs

@@ -23,6 +23,8 @@ test('row 175: TESTER_VERBS and the organization branch tester set are pinned',
     'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop',
     // Row 194 (#1692, D4.1): launch and terminate, and the read of its own requests.
     'instance.launch', 'instance.end', 'instance.request',
+    // Row 264a (#1769): the sessions of the tester's own threads.
+    'session.list', 'session.create',
   ]);
   assert.deepEqual([...TESTER_ORGANIZATION_VERBS], ['limits', 'plugins', 'instances', 'plugins.set', 'instances.set', 'routes.set', 'routes']);
   assert.ok(Object.isFrozen(TESTER_VERBS) && Object.isFrozen(TESTER_ORGANIZATION_VERBS));

packages/bus/tests/thread-claims.test.mjs

@@ -13,6 +13,11 @@ import { Broker } from '../src/broker.mjs';
 const AT = '2026-10-22T00:00:00.000Z';
 const within = (grants) => ({ authority: { withinRole: grants, crossRole: [] } });
 const ROW = ['thread', 'instance', 'holder_run', 'harness', 'at'];
+// Row 264a (#1769): a hand-made thread gets the default session the 3k-3l migration gives an old one.
+const DEFAULT_SESSION = [
+  'INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,\'default\',\'legacy-3l\' FROM threads WHERE id=?',
+  'INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,\'migration-3l\' FROM threads WHERE id=?',
+];
 
 function setup(t) {
   const root = mkdtempSync(join(tmpdir(), 'bus-thread-claims-'));
@@ -45,10 +50,12 @@ function setup(t) {
   const thread = (name) => {
     const id = randomUUID();
     store.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', id, AT, 'demo', project, 'assistant', 'jason', name);
+    for (const sql of DEFAULT_SESSION) store.run(sql, id);
     return id;
   };
-  const claim = (H, run) => {
-    const cap = b.bindLaunch({ business: 'demo', role: 'assistant', run, harness: 'pi', thread: H });
+  // A run on the thread's default session, or on `session` when one is named.
+  const claim = (H, run, session) => {
+    const cap = b.bindLaunch({ business: 'demo', role: 'assistant', run, harness: 'pi', thread: H, ...(session ? { session } : {}) });
     call(cap, 'role.claim');
     return cap;
   };
@@ -108,8 +115,22 @@ test('T5: the result carries neither the thread name a user wrote nor a message
     'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
     m, AT, 'demo', 'assistant', 'assistant-run', 'human', 'INFO', null, null, null, 'alice secret message body',
   );
-  store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', m, H);
+  store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', m, H, H);
   const text = JSON.stringify(call('human', 'thread.claims'));
   assert.ok(text.includes(H), 'the thread row is there');
   assert.doesNotMatch(text, /secret/);
 });
+
+// Row 264a (#1769, sage-2591, duckworth-0124 C4): a claim is held per session, so one thread with two
+// held sessions lists both runs, and releasing one leaves the other. A per-thread latest row would show
+// only the last claim.
+test('T6: two held sessions of one thread list as two rows, each its session\'s latest claim', (t) => {
+  const { call, thread, claim } = setup(t);
+  const H = thread('plan');
+  const S = call('human', 'session.create', { thread: H, name: 'second', op: 'op-second' }).id;
+  const first = claim(H, 'run-default');
+  claim(H, 'run-second', S);
+  assert.deepEqual(call('human', 'thread.claims').map((r) => [r.thread, r.holder_run]), [[H, 'run-default'], [H, 'run-second']]);
+  call(first, 'role.release');
+  assert.deepEqual(call('human', 'thread.claims').map((r) => r.holder_run), ['run-second'], 'the default released, the second held');
+});

packages/bus/tests/thread-migration.test.mjs

@@ -49,7 +49,7 @@ async function database3d(t) {
   const source = readFileSync(here('../src/store.mjs'), 'utf8');
   const pinned = source
     .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3d).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3k';", "export const SCHEMA_VERSION = '3d';")
+    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3d';")
     .replace(/\}, \{\n {2}from: '3d',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
   assert.ok(!pinned.includes('3d-3e'), 'the 3d engine has no 3d→3e step');
   writeFileSync(join(moduleRoot, 'src/store.mjs'), pinned);
@@ -101,7 +101,7 @@ test('REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and l
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
   for (const table of ['projects', 'threads', 'thread_claims', 'message_threads', 'thread_opens'])
     assert.equal(store.get(`SELECT count(*) n FROM ${table}`).n, 0, table);
   // Parked: the undelivered ones are counted per business and role, and none is changed or given a thread.
@@ -161,5 +161,5 @@ test('REQ-THREAD-1: the offline command prints the kept-message counts before th
   const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
   const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
   assert.equal(migrated.status, 0, migrated.stderr);
-  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3k ready', ''].join('\n'));
+  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3l ready', ''].join('\n'));
 });

packages/bus/tests/threads.test.mjs

@@ -7,6 +7,12 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Store } from '../src/store.mjs';
 import { Broker, THREAD_PAGE } from '../src/broker.mjs';
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  'INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,\'default\',\'legacy-3l\' FROM threads WHERE id=?',
+  'INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,\'migration-3l\' FROM threads WHERE id=?',
+];
 
 // Row 121 (#1615): projects and threads in the bus. The assistant's messaging lists are the
 // shipped roles/assistant.json's, so the chain below runs under the lists the stack runs.
@@ -81,32 +87,36 @@ test('REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the
   const { b, store, call, launch, claim, A, B } = twoThreads(t);
   launch('a2', 'assistant', { thread: A });
   assert.throws(() => claim('a2'), { code: 'thread-already-held' });
-  // The trigger refuses a second claim that skips the broker.
+  // The trigger refuses a second claim that skips the broker. Row 264a: the claim is of the
+  // thread's default session, with the generation the trigger expects.
+  const sessionOf = (thread) => store.get('SELECT session FROM session_defaults WHERE thread=?', thread).session;
   const second = () =>
     store.run(
-      "INSERT INTO thread_claims(at,business,thread,op,holder_run,harness,by) VALUES(?,?,?,'claim',?,?,?)",
+      "INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,by) VALUES(?,?,?,?,2,'claim',?,?,?)",
       now(),
       'demo',
       A,
+      sessionOf(A),
       'a2-run',
       'pi',
       'a2-run',
     );
-  assert.throws(second, /thread already held/);
-  // Second case: one run holds one thread. a-run already holds A.
+  assert.throws(second, /session already held/);
+  // Second case: one run holds one session. a-run already holds A's.
   call('b', 'role.release');
   assert.throws(
     () =>
       store.run(
-        "INSERT INTO thread_claims(at,business,thread,op,holder_run,harness,by) VALUES(?,?,?,'claim',?,?,?)",
+        "INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,by) VALUES(?,?,?,?,2,'claim',?,?,?)",
         now(),
         'demo',
         B,
+        sessionOf(B),
         'a-run',
         'pi',
         'a-run',
       ),
-    /run already holds a thread/,
+    /run already holds a session/,
   );
   // A released thread can be claimed again by a new run; the claim is the thread's, not the role's.
   launch('b2', 'assistant', { thread: B });
@@ -128,12 +138,20 @@ test('REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broke
   });
   db.exec(readFileSync(new URL('../schema.sql', import.meta.url), 'utf8'));
   const run = (sql, ...args) => db.prepare(sql).run(...args);
+  // Row 264a (#1769): a claim row names its session and the generation thread_claim_generation
+  // expects, so each refusal below comes from the trigger it names.
+  const generation = (op) =>
+    op === 'claim'
+      ? 1 + db.prepare("SELECT count(*) n FROM thread_claims WHERE session='s-1' AND op='claim'").get().n
+      : (db.prepare("SELECT generation FROM thread_claims WHERE session='s-1' ORDER BY seq DESC LIMIT 1").get()?.generation ?? null);
   const claim = (op, run_, extra = {}) =>
     run(
-      'INSERT INTO thread_claims(at,business,thread,op,holder_run,harness,by,reason,decision) VALUES(?,?,?,?,?,?,?,?,?)',
+      'INSERT INTO thread_claims(at,business,thread,session,generation,op,holder_run,harness,by,reason,decision) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
       now(),
       extra.business ?? 'demo',
       extra.thread ?? 'th-1',
+      's-1',
+      generation(op),
       op,
       run_,
       'pi',
@@ -143,9 +161,11 @@ test('REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broke
     );
   run("INSERT INTO projects(id,at,business,name,repo,created_by) VALUES('p-1',?,'demo','work',NULL,'jason')", now());
   run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES('th-1',?,'demo','p-1','assistant','jason','one')", now());
-  run("INSERT INTO thread_opens(at,thread,by) VALUES(?,'th-1','jason')", now());
+  run("INSERT INTO sessions(id,at,business,thread,instance,owner,name,op) VALUES('s-1',?,'demo','th-1','assistant','jason','default','default')", now());
+  run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,'th-1','s-1','jason')", now());
+  run("INSERT INTO thread_opens(at,thread,session,by) VALUES(?,'th-1','s-1','jason')", now());
   run("INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES('m-1',?,'demo','human','human-cli','assistant','INFO','hi')", now());
-  run("INSERT INTO message_threads(message,thread) VALUES('m-1','th-1')");
+  run("INSERT INTO message_threads(message,thread,session) VALUES('m-1','th-1','s-1')");
   // A thread is in its project's business.
   assert.throws(
     () => run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES('th-x',?,'other','p-1','assistant','jason','x')", now()),
@@ -154,20 +174,22 @@ test('REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broke
   // A claim names the thread's business.
   assert.throws(() => claim('claim', 'a-run', { business: 'other' }), /a thread claim names the thread's business/);
   // Nothing releases or revokes a thread nobody holds.
-  assert.throws(() => claim('release', 'a-run'), /thread is not held/);
-  assert.throws(() => claim('revoke', 'a-run', { reason: 'stuck' }), /thread is not held/);
+  assert.throws(() => claim('release', 'a-run'), /session is not held/);
+  assert.throws(() => claim('revoke', 'a-run', { reason: 'stuck' }), /session is not held/);
   claim('claim', 'a-run');
   // Only the holder releases; a revoke needs a decision or a reason.
   assert.throws(() => claim('release', 'b-run'), /only the holder releases; others revoke/);
   assert.throws(() => claim('revoke', 'a-run'), /revoke needs a resolved decision or a reason/);
   claim('revoke', 'a-run', { reason: 'stuck' });
-  // Every 3e table is append-only: no UPDATE, no DELETE, no INSERT OR REPLACE.
+  // Every 3e table, and row 264a's two, is append-only: no UPDATE, no DELETE, no INSERT OR REPLACE.
   const rows = {
     projects: ["id='p-1'", 'name', "INSERT OR REPLACE INTO projects(seq,id,at,business,name,created_by) SELECT seq,id,at,business,name,created_by FROM projects WHERE id='p-1'"],
     threads: ["id='th-1'", 'name', "INSERT OR REPLACE INTO threads(seq,id,at,business,project,instance,owner,name) SELECT seq,id,at,business,project,instance,owner,name FROM threads WHERE id='th-1'"],
-    thread_claims: ['seq=1', 'reason', 'INSERT OR REPLACE INTO thread_claims(seq,at,business,thread,op,holder_run,harness,by) SELECT seq,at,business,thread,op,holder_run,harness,by FROM thread_claims WHERE seq=1'],
-    message_threads: ["message='m-1'", 'thread', "INSERT OR REPLACE INTO message_threads(message,thread) VALUES('m-1','th-1')"],
-    thread_opens: ['seq=1', 'by', 'INSERT OR REPLACE INTO thread_opens(seq,at,thread,by) SELECT seq,at,thread,by FROM thread_opens WHERE seq=1'],
+    sessions: ["id='s-1'", 'name', "INSERT OR REPLACE INTO sessions(seq,id,at,business,thread,instance,owner,name,op) SELECT seq,id,at,business,thread,instance,owner,name,op FROM sessions WHERE id='s-1'"],
+    session_defaults: ['seq=1', 'by', 'INSERT OR REPLACE INTO session_defaults(seq,at,thread,session,by) SELECT seq,at,thread,session,by FROM session_defaults WHERE seq=1'],
+    thread_claims: ['seq=1', 'reason', 'INSERT OR REPLACE INTO thread_claims(seq,at,business,thread,session,generation,op,holder_run,harness,by) SELECT seq,at,business,thread,session,generation,op,holder_run,harness,by FROM thread_claims WHERE seq=1'],
+    message_threads: ["message='m-1'", 'thread', "INSERT OR REPLACE INTO message_threads(message,thread,session) VALUES('m-1','th-1','s-1')"],
+    thread_opens: ['seq=1', 'by', 'INSERT OR REPLACE INTO thread_opens(seq,at,thread,session,by) SELECT seq,at,thread,session,by FROM thread_opens WHERE seq=1'],
   };
   for (const [table, [where, col, replace]] of Object.entries(rows)) {
     const only = new RegExp(`${table} is append-only`);
@@ -225,7 +247,7 @@ test('REQ-MSG-1: a message to or from the assistant names its thread, or is refu
   // The store refuses a thread on a message the instance is not party to.
   const pmOnly = call('pm', 'message.send', { to: 'coder', body: 'unrelated' });
   assert.throws(
-    () => store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', pmOnly.id, A),
+    () => store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,(SELECT session FROM session_defaults WHERE thread=?))', pmOnly.id, A, A),
     /to or from the thread's instance/,
   );
   void b;
@@ -277,8 +299,10 @@ test('REQ-MSG-1: a reply can\'t carry one thread instance\'s thread to another t
   const helper = { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } };
   const { store, call, launch, claim, count } = setup(t, demo({ roles: { ...roles, helper } }));
   const project = call('human', 'project.create', { name: 'two instances' }).id;
-  for (const [id, instance] of [['th-a', 'assistant'], ['th-h', 'helper']])
+  for (const [id, instance] of [['th-a', 'assistant'], ['th-h', 'helper']]) {
     store.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', id, now(), 'demo', project, instance, 'jason', id);
+    for (const sql of DEFAULT_SESSION) store.run(sql, id);
+  }
   launch('chief', 'chief');
   claim('chief');
   launch('a', 'assistant', { thread: 'th-a' });
@@ -314,7 +338,7 @@ test('REQ-THREAD-1 REQ-USER-2: one thread\'s messages never reach another thread
           'pi',
           null,
         ),
-      /only to its thread's holder/,
+      /only to its session's holder/,
       op,
     );
   // B's holder can't read A's message either.
@@ -437,6 +461,7 @@ test('Q169 REQ-USER-2: assistant.stop ends the human\'s own assistant thread run
     'someone-else',
     'theirs',
   );
+  for (const sql of DEFAULT_SESSION) store.run(sql, other);
   launch('o', 'assistant', { thread: other });
   claim('o');
   const last = (thread) => ({
@@ -486,6 +511,7 @@ test('REQ-USER-2: the human verbs refuse another owner\'s thread', (t) => {
     'someone-else',
     'theirs',
   );
+  for (const sql of DEFAULT_SESSION) store.run(sql, other);
   for (const [verb, args] of [
     ['thread.open', { thread: other }],
     ['thread.send', { thread: other, body: 'hi' }],

packages/bus/tests/usage-migration.test.mjs

@@ -46,17 +46,29 @@ function snapshot(path, columns) {
     columns ??= Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all()
       .map(({ name }) => [name, db.prepare(`PRAGMA table_info(${name})`).all().map(c => c.name)]));
     const rows = Object.fromEntries(Object.entries(columns).map(([table, keys]) => [table,
-      db.prepare(`SELECT ${keys.join(',')} FROM ${table} ORDER BY rowid`).all()
+      db.prepare(`SELECT ${keys.join(',')} FROM ${table} ORDER BY ${table === 'sqlite_sequence' ? 'name' : 'rowid'}`).all()
         .filter(r => table !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key))]));
     return { columns, rows };
   } finally { db.close(); }
 }
-test('REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty', t => {
+// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
+// each a sqlite_sequence row (3k-3l.sql:50-52), at seq 1 for the one thread here. The compare after
+// the step leaves those two rows out and checks them exactly, so any other new row still fails.
+// thread_claims and thread_opens stay in the compare: the step carries their seq.
+// The step writes the thread_claims and thread_opens rows again, after instance_names', so the
+// snapshot reads sqlite_sequence by name, as account-migration.test.mjs does (row 126).
+const SEQ_3L = ['sessions', 'session_defaults'];
+function migrated3l(rows) {
+  const left = rows.sqlite_sequence.filter(r => SEQ_3L.includes(r.name));
+  assert.deepEqual(left.map(r => ({ ...r })), [{ name: 'session_defaults', seq: 1 }, { name: 'sessions', seq: 1 }]);
+  return { ...rows, sqlite_sequence: rows.sqlite_sequence.filter(r => !SEQ_3L.includes(r.name)) };
+}
+test('REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving every old column, row and sequence; new usage table is empty', t => {
   const { root, path, copy } = source3g(t), before = snapshot(path), untouched = readFileSync(copy);
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3k');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
     assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
     assert.equal(store.get('SELECT count(*) AS n FROM usage_records').n, 0);
     assert.equal(store.get('SELECT name FROM instance_names').name, 'Builder');
@@ -64,7 +76,7 @@ test('REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old
     assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
     assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
   } finally { store.close(); }
-  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
+  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
   assert.deepEqual(readFileSync(copy), untouched);
   assert.deepEqual(snapshot(copy).rows, before.rows);
   new Store(root).close();

packages/cli/src/config.mjs

@@ -83,6 +83,9 @@ function trackerFor(system, b, warn) {
   };
 }
 
+export const consoleOwners = (sso) =>
+  sso.providers.flatMap((p) => p.subjects.map((s) => ({ provider: p.id, iss: p.issuer, sub: s.sub })));
+
 // The `{op: 'boot'}` config for packages/bus/src/process.mjs, for one
 // business. The host holds a reader capability for the notifier and binds
 // launches later through bindLaunch, so `launches` starts empty.
@@ -101,6 +104,9 @@ export function bootConfig({ system, businessId, env = process.env, warn = () =>
     };
     const tracker = trackerFor(vars, b, warn);
     if (tracker) config.trackers = { [b.id]: tracker };
+    // Row 252 (#1753, Webby N1): every console.sso subject is an owner, by provider id, issuer and sub.
+    // The loader checked console.sso; no new config field names owners.
+    if (system.console?.sso) config.consoleOwners = consoleOwners(system.console.sso);
     return config;
   });
 }

packages/cli/tests/config.test.mjs

@@ -69,3 +69,19 @@ test("an unknown business and a broken system config refuse with exit 3", (t) =>
   assert.throws(() => bootConfig({ system: loadSystem({ env: f.env }), businessId: "nope", env: f.env }), (e) => e.exitCode === 3);
   assert.throws(() => loadSystem({ env: { ...f.env, MOSAIC_CONFIG: join(f.dataRoot, "missing.json") } }), (e) => e.exitCode === 3);
 });
+
+test("Row 252 (Webby N1): every console.sso subject reaches the boot as a console owner, and no sso means no consoleOwners key", (t) => {
+  const f = fixture(tmp(t));
+  const system = loadSystem({ env: f.env });
+  assert.equal("consoleOwners" in bootConfig({ system, businessId: "acme", env: f.env }), false);
+  const sso = { providers: [
+    { id: "authentik", issuer: "https://auth.example/app/", subjects: [{ sub: "jason-sub" }, { sub: "second-sub" }] },
+    { id: "other", issuer: "https://idp.example", subjects: [{ sub: "jason-sub" }] },
+  ] };
+  const boot = bootConfig({ system: { ...system, console: { sso } }, businessId: "acme", env: f.env });
+  assert.deepEqual(boot.consoleOwners, [
+    { provider: "authentik", iss: "https://auth.example/app/", sub: "jason-sub" },
+    { provider: "authentik", iss: "https://auth.example/app/", sub: "second-sub" },
+    { provider: "other", iss: "https://idp.example", sub: "jason-sub" },
+  ]);
+});

packages/cli/tests/stack-release.test.mjs

@@ -858,7 +858,7 @@ const COUNTED=/^COUNTED="([^"]*)"$/m.exec(srText)[1].split(' ');
 const STORE_JS=/^STORE_JS='([\s\S]*?)'$/m.exec(srText)[1];
 // sage-1163's list 2, written out so that a table dropped from the script's COUNTED fails T45 as
 // well as T46.
-const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','thread_opens','instance_names','usage_records'];
+const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','sessions','session_defaults','thread_opens','instance_names','usage_records'];
 const LATE='2999-01-01T00:00:00.000Z';
 const addRow=(file,table,at=LATE)=>{const db=new DatabaseSync(file);db.exec(`CREATE TABLE IF NOT EXISTS ${table} (seq INTEGER PRIMARY KEY, at TEXT NOT NULL)`);db.prepare(`INSERT INTO ${table} (at) VALUES (?)`).run(at);db.close()};
 

packages/cli/tests/thread-cli.test.mjs

@@ -17,6 +17,12 @@ import { run } from "../src/cli.mjs";
 import { CliError } from "../src/errors.mjs";
 import { busExit } from "../src/transport.mjs";
 import { humanEnv, io } from "./helpers.mjs";
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  "INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,'default','legacy-3l' FROM threads WHERE id=?",
+  "INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,'migration-3l' FROM threads WHERE id=?",
+];
 
 const shipped = (name) => JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), "utf8"));
 const roles = {
@@ -185,6 +191,7 @@ test("REQ-CLI-1 a thread is its id, an id prefix of 8 characters or more, or <pr
   const at = new Date().toISOString();
   for (const n of ["1", "2"]) {
     s.store.run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)", `abcdef01-0000-4000-8000-00000000000${n}`, at, "demo", s.project, "assistant", "jason", `twin${n}`);
+    for (const sql of DEFAULT_SESSION) s.store.run(sql, `abcdef01-0000-4000-8000-00000000000${n}`);
   }
   const resolve = async (ref) => (await s.cli(["thread", "open", ref]));
   const opened = (r) => r.out.trim();
@@ -322,6 +329,7 @@ test("REQ-USER-2 a thread of another user is refused for talk, open, read and fo
   const theirs = randomUUID();
   s.store.run("INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)", "p-theirs", at, "demo", "theirs", "stack", "someone-else");
   s.store.run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)", theirs, at, "demo", "p-theirs", "assistant", "someone-else", "private");
+  for (const sql of DEFAULT_SESSION) s.store.run(sql, theirs);
   // A message waiting for the user: message.receive would write a delivery row for it.
   s.call("chief", "message.send", { to: "human", body: "waiting", class: "INFO" });
   const before = s.writes();

packages/cli/tests/thread-launch.test.mjs

@@ -27,6 +27,12 @@ import { bootConfig, loadSystem } from "../src/config.mjs";
 import { startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { fakeHarnesses, fixture, tmp } from "./helpers.mjs";
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  "INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,'default','legacy-3l' FROM threads WHERE id=?",
+  "INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,'migration-3l' FROM threads WHERE id=?",
+];
 
 const ADAPTER = fileURLToPath(new URL("./fixtures/thread-adapter.mjs", import.meta.url));
 const skip = sandboxProblem() ?? false;
@@ -356,7 +362,8 @@ test("REQ-THREAD-2 REQ-LAUNCH-1 a thread id that isn't a safe segment, or a thre
   store.run("INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)", "p-hand", at(), "acme", "hand made", "stack", "jason");
   for (const [id, instance] of [["../evil", "assistant"], ["coder-thread", "coder"]]) {
     store.run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)", id, at(), "acme", "p-hand", instance, "jason", id);
-    store.run("INSERT INTO thread_opens(at,thread,by) VALUES(?,?,?)", at(), id, "jason");
+    for (const sql of DEFAULT_SESSION) store.run(sql, id);
+    store.run("INSERT INTO thread_opens(at,thread,session,by) VALUES(?,?,?,?)", at(), id, id, "jason");
   }
   store.close();
 

packages/webui/README.md

@@ -335,13 +335,28 @@ note is `agents/dewey/work/wui/SLICE1-VIEWS.md`.
   same functions, so both show the same broker data.
 - Nothing writes but the "Message a role" box, the Settings update, the Assistant
   section's three buttons and the spec and docs editor's Save, all under `--send` (above,
-  "Assistant settings" and "Spec and docs editor"). A decision shows `mosaic decide <id> <key>` for each choice,
+  "Assistant settings" and "Spec and docs editor"), and the decision Approve and Deny below.
+  A decision shows `mosaic decide <id> <key>` for each choice,
   with Copy, which only puts the command on the clipboard. It is answered in a
   terminal (REQ-DEC-3, Q4). Seen is not set from the browser either. The
   command has no `--business`, so `mosaic decide` uses the running bus host's
   business, as the Console does by default. From a Console started with
   `--business` for another business the copied command refuses (no bus host,
   or no such decision) rather than answering elsewhere.
+- Row 252 (#1753, PRD 1.9 REQ-WEB-2): a grant request (`credential.mint` routed
+  to the human, raised with a grant and two options) can also be approved or
+  denied on its decision page, only when the Console runs with both `--sso` and
+  `--send` and the page is signed in as a `console.sso` subject. The first click
+  POSTs `/api/decisions/<id>/confirmation` and shows what the answer does; only
+  Confirm POSTs `/resolve` with that one-use confirmation (two minutes, bound to
+  the session, decision and choice). Each step spawns
+  `packages/bus/src/console-cli.mjs`, which the bus verifies as the Console's
+  child holding the signed-in subject, and the bus records the answer `via
+  console` with a `human.input` naming that subject. Nothing retries; an unknown
+  outcome says to refresh. Without `--sso` the page has no buttons and says why;
+  under `--sso` without `--send` it says the Console is read-only for decisions.
+  The tester listener has no decision routes. Every other decision stays
+  terminal-only.
 - What no Q1 verb returns is labelled where it would show, for example
   "Bot names: not in the Q1 module" (lead decision 63). Nothing is guessed.
 - A task's list row can only say its current state came from a Vikunja read,

packages/webui/src/bus.mjs

@@ -10,9 +10,11 @@
 
 import { spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 import { HUMAN_CLI } from '../../cli/src/transport.mjs';
 import { readHostState } from '../../cli/src/host.mjs';
 import { views } from '../../bus/src/views.mjs';
+import { CONSOLE_VERBS } from '../../bus/src/broker.mjs';
 
 export class BusReadError extends Error {
   constructor(code, message = code) { super(message); this.code = code; }
@@ -26,10 +28,13 @@ export const subjectOk = s => typeof s === 'string' && s.length > 0 && s.length
 // request on stdin, JSON on stdout, or a bus error code as the last
 // `^[a-z-]{1,64}$` line of stderr.
 export function humanCall({ socket, business, env = process.env, cli = HUMAN_CLI, timeoutMs = 30000, maxBytes = 8 * 1024 * 1024 }) {
-  return (verb, args = {}) => new Promise((resolve, reject) => {
+  return (verb, args = {}) => transport({ cli, socket, env: cli === HUMAN_CLI ? { ...env, MOSAIC_BUS_CLI_NONCE: randomBytes(32).toString('hex') } : env, input: { business, verb, args }, timeoutMs, maxBytes });
+}
+function transport({ cli, socket, env, input, timeoutMs, maxBytes }) {
+  return new Promise((resolve, reject) => {
     let child;
     try {
-      child = spawn(process.execPath, [cli, socket], { env: cli === HUMAN_CLI ? { ...env, MOSAIC_BUS_CLI_NONCE: randomBytes(32).toString('hex') } : env, stdio: ['pipe', 'pipe', 'pipe'] });
+      child = spawn(process.execPath, [cli, socket], { env, stdio: ['pipe', 'pipe', 'pipe'] });
     } catch { return reject(new BusReadError('outcome-unknown', 'the bus transport did not start')); }
     const out = [], err = [];
     let size = 0, settled = false;
@@ -52,24 +57,42 @@ export function humanCall({ socket, business, env = process.env, cli = HUMAN_CLI
       catch { done(reject, new BusReadError('invalid-response')); }
     });
     child.stdin.on('error', () => {}); // A child that exits early reports through 'close'.
-    child.stdin.end(`${JSON.stringify({ business, verb, args })}\n`);
+    child.stdin.end(`${JSON.stringify(input)}\n`);
   });
 }
 
+// Row 252 (#1753, design section 2): the Console owner's answer to a grant request. Each call spawns
+// a fresh console-cli with a fresh nonce, and the business and the signed-in (provider, iss, sub) go
+// in its spawn environment, where the bus reads them back. Inherited console keys are dropped first,
+// so only this call's values reach the wrapper. Only the two console verbs pass (N4). A resolve pins
+// the business its confirmation was issued for.
+export const CONSOLE_CLI = fileURLToPath(new URL('../../bus/src/console-cli.mjs', import.meta.url));
+export function consoleCall({ dataRoot, socket, business = null, env = process.env, cli = CONSOLE_CLI, timeoutMs = 30000 }) {
+  return async (verb, args, { subject, business: pinned = null }) => {
+    if (!CONSOLE_VERBS.includes(verb)) throw new Error(`the Console does not call ${verb}`);
+    const id = pinned ?? (business || hostBusiness(dataRoot));
+    const own = Object.fromEntries(Object.entries(env).filter(([k]) => !k.startsWith('MOSAIC_BUS_CONSOLE_')));
+    return transport({
+      cli, socket, timeoutMs, maxBytes: 1024 * 1024, input: { verb, args },
+      env: { ...own, MOSAIC_BUS_CONSOLE_NONCE: randomBytes(32).toString('hex'), MOSAIC_BUS_CONSOLE_BUSINESS: id,
+        MOSAIC_BUS_CONSOLE_PROVIDER: subject.provider, MOSAIC_BUS_CONSOLE_ISS: subject.iss, MOSAIC_BUS_CONSOLE_SUB: subject.sub },
+    });
+  };
+}
+
 // The business is the --business flag, or else the live bus host's, read
 // on every request so a host started after the Console is picked up.
 export function busCaller({ dataRoot, socket, business = null, env = process.env, cli = HUMAN_CLI, timeoutMs = 30000 }) {
   return async (verb, args) => {
-    let id = business;
-    if (!id) {
-      let state;
-      try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
-      if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
-      id = state.business;
-    }
-    return humanCall({ socket, business: id, env, cli, timeoutMs })(verb, args);
+    return humanCall({ socket, business: business || hostBusiness(dataRoot), env, cli, timeoutMs })(verb, args);
   };
 }
+function hostBusiness(dataRoot) {
+  let state;
+  try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
+  if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
+  return state.business;
+}
 export const busReader = options => views({ call: busCaller(options) });
 
 // A send's error, sorted. The broker writes in one transaction, so any code it

packages/webui/src/cli.mjs

@@ -2,7 +2,7 @@
 // MOSAIC_TESTER_SOCKET_V1: private tester ingress, no tester TCP.
 import { createChat } from './chat.mjs';
 import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
-import { busCaller } from './bus.mjs';
+import { busCaller, consoleCall } from './bus.mjs';
 import { startTesterSocket } from './tester-socket.mjs';
 import { TESTER_CLI } from '../../cli/src/transport.mjs';
 import { views } from '../../bus/src/views.mjs';
@@ -72,7 +72,7 @@ try {
   // the system config, Business can't resolve authority and Settings has
   // no notifier. A refusal printed here names no path (redactor).
   // --send without a bus refuses to start rather than serve a composer that can't send.
-  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, busLine, system = null;
+  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, decisionWrite = null, busLine, system = null;
   let processing = null;
   try {
     system = loadSystem();
@@ -91,6 +91,9 @@ try {
     projectFile = args => call('project.file', args);
     libraryFile = args => call('library.file', args); libraryStatus = args => call('library.status', args);
     if (sendOn) {send = args => call('message.send', args);librarySync=args=>call('library.sync',args);settingsWrite=args=>call('limits.set',args);projectSave=args=>call('project.file.save',args);nameWrite=args=>call('name.set',args);assistantStop=args=>call('assistant.stop',args);instancesWrite=args=>call('instances.set',args);routesWrite=args=>call('routes.set',args);agentWrite=agentCaller(call,AGENT_VERBS);}
+    // Row 252 (#1753): Approve and Deny on grant requests, through the console wrapper, only with
+    // --sso and --send.
+    if (ssoOn && sendOn) decisionWrite = consoleCall({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
     busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
   } catch (err) {
     const why = redactor({ configDir: configDir() })(err.message);
@@ -110,7 +113,7 @@ try {
   }
   let server;
   try {
-    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing });
+    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, decisionWrite });
   } catch (err) { sso?.close(); throw err; }
   let testerServer = null;
   if (testerSocket) {
@@ -134,7 +137,7 @@ try {
   const proofLine = `\nProxy: proxy proof ${proof ? 'on' : 'off'}`;
   // One line per provider: id, issuer, subject count and state. No client id, secret or sub.
   const health = sso?.health() ?? {};
-  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send)' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
+  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send), grant Approve and Deny' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
   const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
   console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: unix:${testerServer.address()} (binds the tester)` : ''}\nCtrl-C stops this server.`);
   for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });

packages/webui/src/decision-http.mjs

@@ -0,0 +1,148 @@
+// Row 252 (#1753, Gander's design approved by Webby at 5d8f0f4b5): Approve and Deny for a grant
+// request, from the signed-in Console only. Two POSTs. /confirmation asks the bus for the decision's
+// two answers and digest and returns a one-use confirmation bound to this session, business,
+// decision, choice and digest. /resolve takes only that choice and confirmation, consumes the
+// confirmation before it awaits the bus, and asks the bus to resolve with the digest. The bus
+// rechecks everything in the resolve transaction. Nothing here retries.
+import { createHash, randomBytes } from 'node:crypto';
+import { BusReadError, subjectOk } from './bus.mjs';
+
+export const DECISION_ROUTE = /^\/api\/decisions\/([^/]*)\/(confirmation|resolve)$/;
+// The endpoint contract, design section 4. Each refusal is one of these, never a 200.
+export const DECISION_REFUSALS = Object.freeze({
+  'sign-in-required': [401, 'Sign in again before answering.'],
+  'read-only': [403, 'Console decision answers are not enabled. Use mosaic decide.'],
+  'cross-origin': [403, 'Answer from the signed-in Console page.'],
+  'not-found': [404, 'Not found.'],
+  'human-required': [403, 'The bus refused this human identity.'],
+  'peercred-required': [403, 'The bus could not verify this connection.'],
+  'method-not-allowed': [405, 'Use POST.'],
+  'invalid-request': [400, 'Invalid decision answer.'],
+  'request-too-large': [413, 'Decision answer is too large.'],
+  'decision-not-found': [404, 'This decision is unavailable.'],
+  'decision-not-eligible': [403, 'Answer this decision with mosaic decide.'],
+  'decision-closed': [409, 'This decision is no longer open. Refresh the inbox.'],
+  'decision-stale': [409, 'The choices changed. Review the decision again.'],
+  'confirmation-required': [409, 'Review and confirm this answer again.'],
+  'confirmation-unavailable': [503, 'Confirmation is unavailable. Try again later.'],
+  'outcome-unknown': [503, 'The answer may have reached the bus. Refresh before trying again.'],
+});
+// Bus codes by name. A bus that refuses this caller is human-required, whatever its code. Any
+// other code, or no answer, is confirmation-unavailable at the preview and outcome-unknown at the
+// resolve, which the page reads as "refresh first".
+const BUS_CODES = {
+  'human-required': 'human-required', unauthenticated: 'human-required', 'unknown-business': 'human-required',
+  'access-refused': 'human-required', 'access-revoked': 'human-required', 'agent-required': 'human-required',
+  'peercred-required': 'peercred-required',
+  'decision-not-found': 'decision-not-found', 'decision-not-eligible': 'decision-not-eligible',
+  'decision-closed': 'decision-closed', 'decision-stale': 'decision-stale', 'invalid-choice': 'decision-stale',
+  'invalid-request': 'invalid-request',
+};
+const BODY_MAX = 4096;
+const TOKEN = /^[a-f0-9]{64}$/;
+const DIGEST = /^[a-f0-9]{64}$/;
+const one = (req, name) => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
+const hash = (token) => createHash('sha256').update(token).digest('hex');
+export function decisionRefuse(res, code) {
+  const [status, message] = DECISION_REFUSALS[code];
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify({ error: code, message }));
+}
+
+// The confirmations, in this process's memory only and stored by hash. 120 seconds, at most 1024
+// live. A full store refuses a new one rather than drop a live one. An expired one is swept.
+export function createConfirmations({ ttlMs = 120000, max = 1024, now = Date.now } = {}) {
+  const live = new Map();
+  const sweep = () => { const t = now(); for (const [k, v] of live) if (v.expires <= t) live.delete(k); };
+  return {
+    issue(binding) {
+      sweep();
+      if (live.size >= max) return null;
+      const token = randomBytes(32).toString('hex');
+      live.set(hash(token), { ...binding, expires: now() + ttlMs });
+      return token;
+    },
+    // One use: a token found is gone, whether or not it matches.
+    consume(token, { session, decision, choice }) {
+      sweep();
+      if (typeof token !== 'string' || !TOKEN.test(token)) return null;
+      const k = hash(token), v = live.get(k);
+      if (!v) return null;
+      live.delete(k);
+      return v.session === session && v.decision === decision && v.choice === choice ? v : null;
+    },
+    get size() { sweep(); return live.size; },
+  };
+}
+
+async function readBody(req) {
+  if (one(req, 'content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json') return { code: 'invalid-request' };
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > BODY_MAX) return { code: 'request-too-large' };
+    chunks.push(chunk);
+  }
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? { value } : { code: 'invalid-request' };
+  } catch { return { code: 'invalid-request' }; }
+}
+const preview = (v, id) =>
+  v && typeof v === 'object' && v.id === id && typeof v.business === 'string' && DIGEST.test(v.digest ?? '') &&
+  ['approve', 'deny'].every((k) => typeof v[k]?.key === 'string' && typeof v[k]?.text === 'string') &&
+  v.approve.key !== v.deny.key && v.grant && typeof v.grant.method === 'string';
+
+// `session` is the live sign-in session object this request passed, and `live()` reads it again
+// right before each spawn. `call(verb, args, { subject, business })` is the console transport.
+export async function decisionHTTP(req, res, { path, decide, session, live, confirmations, log }) {
+  const [, raw, step] = DECISION_ROUTE.exec(path);
+  let id = null;
+  try { id = decodeURIComponent(raw); } catch { /* refused below */ }
+  if (req.method !== 'POST') return decisionRefuse(res, 'method-not-allowed');
+  if (!decide) return decisionRefuse(res, 'read-only');
+  if (!session) return decisionRefuse(res, 'sign-in-required');
+  if (one(req, 'origin') !== decide.origin || one(req, 'sec-fetch-site') !== 'same-origin') return decisionRefuse(res, 'cross-origin');
+  const line = (outcome) => log(`${new Date().toISOString()} decide user=${JSON.stringify(String(session.name ?? '').slice(0, 64))} decision=${JSON.stringify(String(id ?? '').slice(0, 64))} step=${step} ${outcome}`);
+  const refuse = (code) => { line(`error=${code}`); return decisionRefuse(res, code); };
+  const { value, code } = await readBody(req);
+  if (code) return refuse(code);
+  if (!subjectOk(id)) return refuse('decision-not-found');
+  const subject = { provider: session.provider, iss: session.iss, sub: session.sub };
+  const busCode = (err, open) => {
+    const c = err instanceof BusReadError ? BUS_CODES[err.code] : undefined;
+    return c ?? open;
+  };
+  if (step === 'confirmation') {
+    if (Object.keys(value).length !== 1 || typeof value.choice !== 'string') return refuse('invalid-request');
+    if (live() !== session) return refuse('sign-in-required');
+    let v;
+    try { v = await decide.call('decision.preview.console', { id }, { subject }); } catch (err) { return refuse(busCode(err, 'confirmation-unavailable')); }
+    if (!preview(v, id)) return refuse('confirmation-unavailable');
+    const action = value.choice === v.approve.key ? 'approve' : value.choice === v.deny.key ? 'deny' : null;
+    if (!action) return refuse('decision-stale');
+    if (live() !== session) return refuse('sign-in-required');
+    const confirmation = confirmations.issue({ session, business: v.business, decision: id, choice: value.choice, digest: v.digest });
+    if (!confirmation) return refuse('confirmation-unavailable');
+    line(`action=${action}`);
+    return json(res, 200, { id, question: typeof v.question === 'string' ? v.question : '', action, choice: value.choice, text: v[action].text, grant: v.grant, confirmation });
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 2 || !keys.includes('choice') || !keys.includes('confirmation') || typeof value.choice !== 'string') return refuse('invalid-request');
+  // Consumed before any await on the bus, so a second click finds nothing (J12).
+  const held = confirmations.consume(value.confirmation, { session, decision: id, choice: value.choice });
+  if (!held) return refuse('confirmation-required');
+  if (live() !== session) return refuse('sign-in-required');
+  let r;
+  try {
+    r = await decide.call('decision.resolve.console', { id, choice: held.choice, digest: held.digest }, { subject, business: held.business });
+  } catch (err) { return refuse(busCode(err, 'outcome-unknown')); }
+  if (r?.id !== id || r.op !== 'resolved' || r.choice !== held.choice) return refuse('outcome-unknown');
+  line(`choice=${JSON.stringify(held.choice.slice(0, 64))}${r.grant ? ` grant=${r.grant}` : ''}`);
+  return json(res, 200, { id, op: 'resolved', choice: r.choice, ...(r.grant === 'started' ? { grant: 'started' } : {}) });
+}
+function json(res, status, body) {
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify(body));
+}

packages/webui/src/public/bus.js

@@ -190,8 +190,9 @@
       out.kind = 'decision.raised'; out.decision = r.id; out.actor = { role: r.raised_by_role, run: r.raised_by_run };
       out.text = `Raised a ${r.class} decision for ${r.route_to}: ${String(r.question).split('\n')[0]}`;
     } else if (r.table === 'decision_events') {
-      // The human answers from the CLI (via cli); every other row is the broker's.
-      out.kind = `decision.${r.op}`; out.decision = r.decision; out.by = r.via === 'cli' ? 'human' : 'broker';
+      // The human answers from the CLI (via cli) or, since row 252 (#1753), a grant request from the
+      // signed-in Console (via console); every other row is the broker's.
+      out.kind = `decision.${r.op}`; out.decision = r.decision; out.by = r.via === 'cli' ? 'human' : r.via === 'console' ? 'human-console' : 'broker';
       out.text = r.op === 'resolved' ? `${r.by} chose “${r.choice}” via ${r.via}` : r.op === 'seen' ? `${r.by} saw it${r.via ? ` via ${r.via}` : ''}` : `${r.op[0].toUpperCase()}${r.op.slice(1)} by ${r.by}${r.note ? `: ${r.note}` : ''}`;
     } else if (r.table === 'task_snapshots') {
       out.kind = `snapshot.${r.source}`;
@@ -227,8 +228,9 @@
   // An empty state says what would appear and where it comes from.
   const empty = (what, from) => `<div class="empty"><b>${what}</b>${from ? `<p>${from}</p>` : ''}</div>`;
   const taskLink = ref => ref ? `<a href="#/tasks/${enc(ref)}">#${esc(String(ref).split('/')[1])}</a>` : '';
-  // Rows without an actor role come from the human (CLI, outside any run) or from the broker itself.
-  const actor = (a, by) => `<span class="source">${a ? `${txt(a.role)} · ${txt(a.run)}` : by === 'human' ? 'human, CLI outside any run' : 'broker'}</span>`;
+  // Rows without an actor role come from the human (CLI outside any run, or the signed-in Console)
+  // or from the broker itself.
+  const actor = (a, by) => `<span class="source">${a ? `${txt(a.role)} · ${txt(a.run)}` : by === 'human' ? 'human, CLI outside any run' : by === 'human-console' ? 'human, signed-in Console' : 'broker'}</span>`;
   const PRIORITY = ['unset', 'low', 'medium', 'high', 'urgent', 'do now'];
   const head = (title, sub) => `<div class="page-head"><div><h1 tabindex="-1">${title}</h1>${sub ? `<p class="small muted" id="bus-status">${sub}</p>` : ''}</div></div>`;
   let readAt = null;
@@ -256,7 +258,7 @@
   // Inbox
   function decisionCard(d) {
     return `<li class="wait-item s1-dec${d.blocking ? ' is-attn' : ''}"><div class="wait-head"><a href="#/inbox/${enc(d.id)}" class="s1-dec-open">${txt(first(d.question))}</a></div>
-      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}</p>
+      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}${canDecide && d.console ? ` ${badge('Approve or Deny here', 'ok')}` : ''}</p>
       <p class="small s1-auth">${approves(d.authorization)}</p>
       <p class="small muted">Raised by ${txt(d.raised_by_role)} ${when(d.at)}${d.task_ref ? ` · task ${taskLink(d.task_ref)}` : ''}${d.requirement_ref ? ` · ${txt(d.requirement_ref)}` : ''}</p></li>`;
   }
@@ -314,12 +316,101 @@
     el.outerHTML = composerHtml();
     restore(k);
   }
+  // Row 252 (#1753, design section 5): Approve and Deny for an open grant request, drawn only when
+  // the server says this Console answers decisions (`decide` in /api/config: signed in through SSO
+  // and started with --send) and the bus marked the inbox row eligible (its `console` field). The
+  // first click asks the Console for a one-use confirmation that names what the answer does. Only
+  // the second click answers. Nothing here retries: a refusal drops the confirmation, and an
+  // unknown outcome says to refresh first. The state lives in `answer`, not the DOM, so the 10 s
+  // refresh redraws it. The server and the bus check everything again; this is presentation only.
+  let canDecide = false, ssoOn = false, answer = null;
+  const ACTIONS = { approve: 'Approve', deny: 'Deny' };
+  const grantText = g => [`method ${g.method}`, g.agent && `agent ${g.agent}`, g.host && `host ${g.host}`, Array.isArray(g.projects) && g.projects.length && `projects ${g.projects.join(', ')}`].filter(Boolean).map(s => txt(String(s))).join(' · ');
+  function decideHtml() {
+    const a = answer;
+    if (!a) return '';
+    const off = a.pending ? ' disabled' : '';
+    let body;
+    if (a.result) {
+      const r = a.result;
+      body = `<p class="receipt" id="decide-status" tabindex="-1">${r.action === 'approve' ? 'Approved' : 'Denied'}: you chose “${txt(r.choice)}”, ${txt(r.text)}. ${r.grant === 'started' ? 'The grant executor started.' : r.action === 'approve' ? 'The bus started no grant for it.' : 'Nothing starts for a denial.'} History below shows it once the bus is read again.</p>`;
+    } else if (a.confirm) {
+      const c = a.confirm, label = `Confirm ${c.action}`;
+      body = `<div class="s1-confirm" role="group" aria-labelledby="b-confirm"><h3 id="b-confirm" class="small">${label}</h3>
+        <dl class="kv"><dt>Id</dt><dd><code>${txt(c.id)}</code></dd><dt>Question</dt><dd class="s1-q">${txt(c.question)}</dd><dt>Answer</dt><dd><b class="s1-key">${txt(c.choice)}</b> ${txt(c.text)}</dd><dt>Grant</dt><dd>${grantText(c.grant)}</dd></dl>
+        <p class="small muted">${c.action === 'approve' ? 'Approving starts this grant.' : 'Denying starts nothing.'} This confirmation works once and lasts two minutes.</p>
+        <div class="s1-cmd"><button type="button" class="btn primary" data-decide="confirm"${off}>${a.pending ? 'Answering…' : label}</button><button type="button" class="btn" data-decide="cancel"${off}>Cancel</button></div></div>`;
+    } else {
+      body = `<ul class="s1-plain">${Object.entries(ACTIONS).map(([k, l]) => `<li><b>${l}</b> chooses <b class="s1-key">${txt(a.console[k].key)}</b> ${txt(a.console[k].text)}</li>`).join('')}</ul>
+        <p class="small muted">Grant: ${grantText(a.console.grant)}. Either button opens a confirmation first. Nothing is answered until you confirm.</p>
+        <div class="s1-cmd">${Object.entries(ACTIONS).map(([k, l]) => `<button type="button" class="btn${k === 'approve' ? ' primary' : ''}" data-decide="${k}"${off}>${a.pending === k ? 'Checking…' : l}</button>`).join('')}</div>`;
+    }
+    const e = a.error;
+    const said = e ? `<p class="receipt failed" id="decide-status" tabindex="-1">Not answered here: ${txt(e.message)} (<code>${txt(e.code)}</code>).${e.code === 'outcome-unknown' ? ' Nothing was sent again.' : ''}</p>` : '';
+    return `<section class="panel s1-decide" id="decide-section" aria-labelledby="b-decide"><h2 id="b-decide">Answer in Console</h2>${body}${said}</section>`;
+  }
+  // Redraw only the answer panel. `focus` names what takes focus after it.
+  function paintDecide(focus) {
+    const el = $('decide-section');
+    if (!el) return;
+    el.outerHTML = decideHtml();
+    (focus ? $('decide-section')?.querySelector(focus) : null)?.focus();
+  }
+  async function decidePost(url, body) {
+    let res = null, json = null;
+    try {
+      res = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), cache: 'no-store', redirect: 'manual' });
+      try { json = await res.json(); } catch { json = null; }
+    } catch { res = null; }
+    return { res, json };
+  }
+  // A refusal the Console wrote carries its code and message (design section 4). Anything else, a
+  // 408 or no answer included, gets the fallback: at the resolve step that is outcome-unknown.
+  const DECIDE_FALLBACK = {
+    'confirmation-unavailable': 'Confirmation is unavailable. Try again later.',
+    'outcome-unknown': 'The answer may have reached the bus. Refresh before trying again.',
+  };
+  const decideRefusal = (res, json, fallback) => res && !res.ok && res.status !== 408 && typeof json?.error === 'string' && typeof json?.message === 'string'
+    ? { code: json.error, message: json.message } : { code: fallback, message: DECIDE_FALLBACK[fallback] };
+  async function decide(step) {
+    const a = answer;
+    if (!a || a.pending || a.result) return;
+    if (step === 'cancel') { a.confirm = null; a.error = null; paintDecide('[data-decide="approve"]'); announce('Cancelled. Nothing was answered.'); return; }
+    if (out()) { a.confirm = null; a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); return; }
+    if (step === 'approve' || step === 'deny') {
+      const choice = a.console[step].key;
+      a.pending = step; a.error = null; a.confirm = null; paintDecide();
+      const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/confirmation`, { choice });
+      a.pending = null;
+      // The page moved to another decision meanwhile: its confirmation is dropped, never shown.
+      if (answer !== a) { if (res?.type === 'opaqueredirect') signOut(); return; }
+      if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); signOut(); return; }
+      if (res?.ok && json?.id === a.id && json.action === step && json.choice === choice && typeof json.confirmation === 'string' && json.grant && typeof json.grant.method === 'string') {
+        a.confirm = json; paintDecide('[data-decide="confirm"]'); announce(`Confirm ${step}: ${json.text}`);
+      } else { a.error = decideRefusal(res, json, 'confirmation-unavailable'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
+      return;
+    }
+    if (step !== 'confirm' || !a.confirm) return;
+    const c = a.confirm;
+    a.pending = 'confirm'; a.error = null; paintDecide();
+    const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/resolve`, { choice: c.choice, confirmation: c.confirmation });
+    // One use, whatever came back.
+    a.pending = null; a.confirm = null;
+    if (answer !== a) { if (res?.type === 'opaqueredirect') signOut(); else render(false); return; }
+    if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering. The sign-in proxy redirected the answer, so it never reached the Console.' }; paintDecide('#decide-status'); signOut(); return; }
+    if (res?.ok && json?.id === a.id && json.op === 'resolved' && json.choice === c.choice) {
+      a.result = { action: c.action, choice: c.choice, text: c.text, grant: json.grant ?? null };
+      paintDecide('#decide-status'); announce(c.action === 'approve' ? 'Approved' : 'Denied'); render(false);
+    } else { a.error = decideRefusal(res, json, 'outcome-unknown'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
+  }
   async function inboxView(get) {
     // The broker orders gated first, then oldest; lift blocking ones to the top.
     const rows = (await get('inbox')).slice().sort((a, b) => (b.blocking - a.blocking) || String(a.at).localeCompare(String(b.at)));
     countInbox(rows);
     const body = rows.length ? `<ul class="waiting s1-decs">${rows.map(decisionCard).join('')}</ul>` : empty('Nothing is waiting on you.', 'A decision shows here when an agent raises one routed to you through the bus.');
-    return `${head('Inbox', `${readNote()} Decisions are answered in a terminal with <code>mosaic decide</code>; Console only shows them.`)}
+    const answered = canDecide ? 'A grant request can be approved or denied here, after a confirmation. Every other decision is answered in a terminal with <code>mosaic decide</code>.'
+      : 'Decisions are answered in a terminal with <code>mosaic decide</code>; Console only shows them.';
+    return `${head('Inbox', `${readNote()} ${answered}`)}
       ${await composer(get)}
       <h2 id="b-for-you">For you <span class="count">${rows.length}</span></h2>${body}
       <p class="small muted">Not shown here yet: ${gap('Decisions routed to roles')} ${gap('Closed decisions')} ${gap('Seen and DM state per row')} Open a decision for its seen, DM and closing history.</p>`;
@@ -343,6 +434,13 @@
     // A command is offered only for an open decision routed to the human, and only when
     // the id and key pass the broker's identifier rule, so the copied text is safe to paste.
     const answerable = !c && d.routeTo === 'human';
+    // Row 252: the answer panel follows this decision. A refresh keeps a confirmation open; a
+    // decision no longer eligible (closed elsewhere, say) drops it, unless an answer is in flight
+    // or this page just answered it.
+    const eligible = canDecide && answerable && open?.console ? open.console : null;
+    if (answer?.id !== d.id) answer = eligible ? { id: d.id, console: eligible, pending: null, confirm: null, error: null, result: null } : null;
+    else if (eligible && !answer.pending && !answer.confirm) answer.console = eligible;
+    else if (!eligible && !answer.pending && !answer.result) answer = null;
     const options = `<ol class="s1-opts">${d.options.map(o => {
       const cmd = `mosaic decide ${d.id} ${o.key}`, chosen = c?.choice === o.key, approving = d.authorization?.approvalChoice === o.key;
       const copy = !answerable ? '' : SAFE.test(String(d.id)) && SAFE.test(String(o.key))
@@ -352,11 +450,18 @@
     }).join('')}</ol>`;
     const earlier = await chain(get, d);
     const history = [...d.seen.map(s => `<li>Seen by ${txt(s.by)}${s.via ? ` via ${txt(s.via)}` : ''} ${when(s.at)}</li>`), ...(c ? [`<li>${esc(c.op)} by ${txt(c.by)}${c.via ? ` via ${txt(c.via)}` : ''} ${when(c.at)}</li>`] : [])];
-    const help = answerable ? '<p class="small muted">To answer, run one of these in a terminal. Copy only puts the command on your clipboard. Console sends nothing.</p>'
+    // Without SSO, or under SSO without --send, the Console says why it has no buttons and never
+    // draws a disabled one (design section 5).
+    const why = !answerable || isTester || canDecide ? ''
+      : ssoOn ? ' This Console is read-only for decisions: it was started without writes enabled (--send), so answers go through a terminal.'
+        : ' Answering a grant request from the Console needs sign-in (--sso) and writes enabled (--send).';
+    const help = eligible ? '<p class="small muted">Approve or Deny in the panel above, or run one of these in a terminal. Copy only puts the command on your clipboard.</p>'
+      : answerable ? `<p class="small muted">To answer, run one of these in a terminal. Copy only puts the command on your clipboard. Console sends nothing.${why}</p>`
       : !c ? `<p class="small muted">This decision is routed to ${txt(d.routeTo)}, not to you, so Console offers no command for it.</p>` : '';
     return `${head(`Decision ${txt(short(d.id))}`, status)}
       <section aria-labelledby="b-q" class="panel"><h2 id="b-q">Question</h2><p class="s1-q">${txt(d.question)}</p>
       <dl class="kv"><dt>Class</dt><dd>${chip(d.class, d.action)}${d.blocking ? ` ${blockChip('blocking')}` : ''}</dd><dt>Approval</dt><dd class="s1-auth">${approves(d.authorization)}</dd><dt>Routed to</dt><dd>${txt(d.routeTo)}</dd><dt>Raised by</dt><dd>${txt(d.raisedBy.role)} <span class="source">${txt(d.raisedBy.run)}</span></dd><dt>Raised</dt><dd>${when(d.at)}</dd>${d.taskRef ? `<dt>Task</dt><dd>${taskLink(d.taskRef)} <span class="source">${txt(d.taskRef)}</span></dd>` : ''}${d.requirementRef ? `<dt>Requirement</dt><dd>${txt(d.requirementRef)}</dd>` : ''}<dt>DM</dt><dd>${d.dm ? `sent ${when(d.dm.at)}` : d.blocking ? 'not sent' : 'not needed (not blocking)'}</dd><dt>Id</dt><dd><code>${txt(d.id)}</code></dd></dl></section>
+      ${answer?.id === d.id ? decideHtml() : ''}
       <section aria-labelledby="b-o"><h2 id="b-o">Options</h2>${help}${options}<p class="small muted" id="copy-status"></p></section>
       <section aria-labelledby="b-c"><h2 id="b-c">Earlier versions</h2>${earlier.length ? `<ul class="s1-plain">${earlier.map(x => `<li><a href="#/inbox/${enc(x.id)}">${txt(short(x.id))}</a> ${badge(x.closed ? x.closed.op : 'open')} ${txt(first(x.question))}${x.closed?.note ? `<span class="source">${txt(x.closed.note)}</span>` : ''}</li>`).join('')}</ul>` : '<p class="muted">None.</p>'}<p class="small muted">${gap('A later version that replaces this one')}</p></section>
       <section aria-labelledby="b-h"><h2 id="b-h">History</h2>${history.length ? `<ul class="s1-plain">${history.join('')}</ul>` : '<p class="muted">Not seen yet.</p>'}<p><a href="#/trail/decision/${enc(d.id)}">Full trail for this decision</a></p></section>`;
@@ -1098,6 +1203,7 @@
     return {
       href: view.contains(a) ? a.getAttribute('href') : null, copy: view.contains(a) ? a.dataset?.copy : null, retry: view.contains(a) && a.hasAttribute?.('data-retry'), mirror: view.contains(a) ? a.dataset?.mirror : null, h1: view.contains(a) && a.tagName === 'H1',
       field: view.contains(a) ? a.dataset?.field : null, caret: view.contains(a) && a.tagName === 'TEXTAREA' ? [a.selectionStart, a.selectionEnd, a.scrollTop] : null, send: view.contains(a) && a.hasAttribute?.('data-send'),
+      decide: view.contains(a) ? a.dataset?.decide ?? (a.id === 'decide-status' ? 'status' : null) : null,
       open: [...view.querySelectorAll('details[id]')].filter(d => d.open).map(d => d.id), status: $('copy-status')?.textContent || '',
     };
   }
@@ -1105,7 +1211,10 @@
     for (const id of k.open) { const d = $(id); if (d) d.open = true; }
     if ($('copy-status')) $('copy-status').textContent = k.status;
     const el = [...$('bus-view').querySelectorAll('a[href],[data-copy],[data-retry],[data-mirror],[data-field],[data-send]')].find(e => k.href ? e.getAttribute('href') === k.href : k.copy ? e.dataset.copy === k.copy : k.mirror ? e.dataset.mirror === k.mirror : k.field ? e.dataset.field === k.field : k.send ? e.hasAttribute('data-send') : k.retry && e.hasAttribute('data-retry'));
-    if (el && (k.href || k.copy || k.retry || k.mirror || k.field || k.send)) {
+    // Row 252: the answer panel's buttons and its status line.
+    const dec = k.decide ? $('bus-view').querySelector(k.decide === 'status' ? '#decide-status' : `[data-decide="${k.decide}"]`) : null;
+    if (dec) dec.focus({ preventScroll: true });
+    else if (el && (k.href || k.copy || k.retry || k.mirror || k.field || k.send)) {
       el.focus({ preventScroll: true });
       if (k.caret && el.tagName === 'TEXTAREA') { el.setSelectionRange(k.caret[0], k.caret[1]); el.scrollTop = k.caret[2]; }
     }
@@ -1197,6 +1306,9 @@
       }
       return;
     }
+    // Row 252: Approve, Deny, Confirm and Cancel. One click is one step; none repeats itself.
+    const dec = e.target.closest('#decide-section [data-decide]');
+    if (dec) { if (!dec.disabled) decide(dec.dataset.decide); return; }
     if (e.target.closest('#toast [data-dismiss]')) { toast(null); return; }
     const item = e.target.closest('#cmdk-list [data-href]');
     if (item) { pkGo(item.dataset.href); return; }
@@ -1318,12 +1430,14 @@
     isTester = c?.tester === true;
     canEdit = !isTester && c?.edit === true;
     canSend = !isTester && c?.send === true;
+    ssoOn = c?.sso === true;
+    canDecide = !isTester && c?.decide === true;
     if (isTester) {
       const banner = document.createElement('div'); banner.id = 'tester-banner'; banner.className = 'banner ref';
       banner.setAttribute('role', 'status'); banner.textContent = 'Tester Console. Changes are recorded as tester, never as the human.';
       $('main').prepend(banner);
     }
-    if (!canSend && !isTester) return;
+    if (!canSend && !isTester && !ssoOn) return;
     const path = routeOf().split('?')[0];
     if (path.startsWith('/chat')||path.startsWith('/inbox')||path==='/settings'||path.startsWith('/docs/')) render(false); else if (path === '/' || path === '') paintHeld(heldErr);
   }).catch(() => {});

packages/webui/src/serve.mjs

@@ -10,6 +10,7 @@ const busStatus = code => ['tester-off', 'tester-required'].includes(code) ? 403
 import { ReadError, readStatus, fieldTable } from './reads.mjs';
 import { chatHTTP } from './chat-http.mjs';
 import { processingHTTP } from './processing-http.mjs';
+import { DECISION_ROUTE, decisionHTTP, decisionRefuse, createConfirmations } from './decision-http.mjs';
 
 export const DEFAULT_BOARD = 'http://127.0.0.1:7331';
 export function isLoopback(host) {
@@ -579,7 +580,7 @@ async function projectFileRead(res, read, path, search) {
 // `log` takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
 // `agentWrite` (row 194, D7) is `(verb, args) => Promise` for the Agents section's verbs and instance.request.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, decisionWrite = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
   if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
   if (host === 'localhost') host = '127.0.0.1';
   if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
@@ -590,6 +591,9 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
   if (tester && [send, settingsWrite, projectSave, assistantStop].some(value => value !== null)) throw new Error('tester listener permits only instance, route, name and chat writes');
   if (tester && !testerSocket) throw new Error('tester listener requires private socket');
   if (!tester && testerSocket) throw new Error('tester socket requires tester listener');
+  // Row 252 (#1753, design section 4): Console decision answers need --sso and --send, never the tester.
+  if (decisionWrite !== null && (tester || sso === null || send === null || typeof decisionWrite !== 'function')) throw new Error('Console decision answers need --sso and --send on the main listener');
+  const confirmations = createConfirmations();
   const upstream = boardURL(board);
   // An object with none of the three is refused too: asking for the preview never serves without it.
   if (preview !== null && !(preview = previewOptions({ publicHost: preview.host, authHeader: preview.header, allowUser: preview.user }))) {
@@ -641,18 +645,21 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     // alone stays open on a loopback Host for the status and release gates (Q-C).
     if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });
     // No CORS. JSON content type and same-origin checks keep browser forms out.
-    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
-    let signer = preview;
+    const decisionPath = DECISION_ROUTE.test(path);
+    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`))
+      return decisionPath ? decisionRefuse(res, 'cross-origin') : json(res, 403, { error: 'cross-origin request refused' });
+    let signer = preview, ssoSession = null;
     if (sso !== null && named) {
       if (path.startsWith('/auth/')) return sso.handle(req, res, path, search);
       // Only a page load or a write keeps a session alive; the page's background reads don't (Q-D).
       const session = path === '/healthz' ? null : sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) });
       if (!session && path !== '/healthz') {
+        if (decisionPath) return decisionRefuse(res, 'sign-in-required');
         if (path.startsWith('/api/') || req.method !== 'GET') return json(res, 401, { error: 'sign-in required' });
         res.writeHead(303, { location: `/auth/login?return=${encodeURIComponent(path + search)}`, 'cache-control': 'no-store' });
         return res.end();
       }
-      if (session) signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin };
+      if (session) { signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin }; ssoSession = session; }
     }
     if (named && preview !== null) {
       // One value, equal to the user id; the proxy strips client copies and sets it after sign-in.
@@ -660,6 +667,13 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
       if (!values || values.length !== 1 || values[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });
     }
     const writer = tester ? { tester: true, user: 'tester', origin: TESTER_ORIGIN } : signer;
+    // Row 252: Approve and Deny. The tester listener never offers them. Anywhere else without a signed-in
+    // session on the public name under --sso and --send, they are read-only.
+    if (decisionPath) {
+      if (tester) return decisionRefuse(res, 'not-found');
+      const decide = decisionWrite && send && named && sso ? { call: decisionWrite, origin: sso.publicOrigin } : null;
+      return decisionHTTP(req, res, { path, decide, session: ssoSession, live: () => sso.session(req), confirmations, log });
+    }
     // Row 194 (#1692, D4.1): the tester also launches and terminates.
     if (tester && !['GET', 'HEAD'].includes(req.method) && !['/api/instances', '/api/routes', '/api/name', '/api/agent/launch', '/api/agent/terminate'].includes(path) && !TESTER_CHAT_WRITE.test(path))
       return json(res, 403, { error: 'read-only', sent: false });
@@ -763,7 +777,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
     // `send`: the page shows the composer only where a send can pass (the public name, --send on).
     // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), send: !tester && Boolean(send) && named, decide: !tester && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
     if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
     if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
     const file = files.get(path);

packages/webui/tests/chat.test.mjs

@@ -5,6 +5,12 @@ import { createChat } from '../src/chat.mjs';
 import { startServer } from '../src/serve.mjs';
 import { BusReadError } from '../src/bus.mjs';
 import { close } from './fixture.mjs';
+// Row 264a (#1769): a thread made by hand gets the default session the 3k-3l migration gives a
+// legacy thread, with the thread's id.
+const DEFAULT_SESSION = [
+  'INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,\'default\',\'legacy-3l\' FROM threads WHERE id=?',
+  'INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,\'migration-3l\' FROM threads WHERE id=?',
+];
 
 const P = '10000000-0000-4000-8000-000000000001';
 const T = '20000000-0000-4000-8000-000000000002';
@@ -220,15 +226,17 @@ test('REQ-USER-2 real broker: owned catalog, create/name/filter, isolated histor
   const other = '40000000-0000-4000-8000-000000000004';
   store.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)',
     other, new Date().toISOString(), 'demo', project, 'assistant', 'someone-else', 'PRIVATE-NAME');
+  for (const sql of DEFAULT_SESSION) store.run(sql, other);
   store.run('INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES(?,?,?,?,?,?,?,?)',
     M, new Date().toISOString(), 'demo', 'human', 'human-cli', 'assistant', 'INFO', 'PRIVATE-BODY');
-  store.run('INSERT INTO message_threads(message,thread) VALUES(?,?)', M, other);
+  store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', M, other, other);
   const foreignProject = '50000000-0000-4000-8000-000000000005';
   const foreignThread = '60000000-0000-4000-8000-000000000006';
   store.run('INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)',
     foreignProject, new Date().toISOString(), 'foreign', 'FOREIGN-PROJECT', null, 'jason');
   store.run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)',
     foreignThread, new Date().toISOString(), 'foreign', foreignProject, 'assistant', 'jason', 'FOREIGN-THREAD');
+  for (const sql of DEFAULT_SESSION) store.run(sql, foreignThread);
   assert.equal((await get('/api/chat/threads')).data.rows.length, 2);
   const before = ['messages', 'thread_opens', "events WHERE kind='action.allowed'"].map(table => store.get(`SELECT count(*) n FROM ${table}`).n);
   for (const id of [other, T, foreignThread]) for (const suffix of ['messages', 'open']) {

packages/webui/tests/decide-browser.test.mjs

@@ -0,0 +1,231 @@
+// Row 252 (#1753, design section 5, J16 and J17): Approve and Deny on a decision page, in a browser.
+// A loopback page has no sign-in, so a script added before the page loads sets `sso` and `decide`
+// in /api/config from the page URL, and answers each POST /api/decisions/... from a queue, recording
+// what the page sent. Server-side checks are decision-http.test.mjs's and the bus side is
+// packages/bus/tests/console-decide.test.mjs's. The decisions come from an in-process broker
+// through its reader session. Refresh timers fire after 150 ms.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Store } from '../../bus/src/store.mjs';
+import { Broker } from '../../bus/src/broker.mjs';
+import { views } from '../../bus/src/views.mjs';
+import { grantDecision } from '../../bus/tests/host-fixtures.mjs';
+import { startServer } from '../src/serve.mjs';
+import { browser } from './browser.mjs';
+import { fixture, close } from './fixture.mjs';
+
+const HOSTILE = '<script>window.injected=1</script><img src=x onerror="window.injected=2">';
+const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'pm' }, roles: { chief: { authority: { withinRole: ['message.send'], crossRole: [] } }, pm: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
+
+// Answers in order; `hold` waits for window.__release(), `reject` is a network failure, `redirect`
+// what fetch gives for the sign-in proxy's redirect under redirect: 'manual'.
+const STUB = `(() => {
+  const real = window.fetch.bind(window);
+  window.__posts = []; window.__answers = [];
+  const timeout = window.setTimeout.bind(window);
+  window.setTimeout = (f, ms, ...rest) => timeout(f, ms === 10000 ? 150 : ms, ...rest);
+  const q = new URLSearchParams(location.search);
+  const answer = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+  window.fetch = async (url, init = {}) => {
+    const u = String(url);
+    if (u === '/api/config') {
+      const c = await (await real(url, init)).json();
+      return answer(200, { ...c, ...(q.has('sso') ? { sso: true } : {}), ...(q.has('send') ? { send: true } : {}), ...(q.has('decide') ? { send: true, decide: true } : {}), ...(q.has('tester') ? { tester: true } : {}) });
+    }
+    if (!u.startsWith('/api/decisions/')) return real(url, init);
+    window.__posts.push({ url: u, method: init.method, headers: init.headers, body: init.body, cache: init.cache, redirect: init.redirect });
+    const a = window.__answers.shift();
+    if (!a) throw new TypeError('no answer queued');
+    if (a.hold) await new Promise(r => { window.__release = r; });
+    if (a.reject) throw new TypeError('Failed to fetch');
+    if (a.redirect) return { type: 'opaqueredirect', ok: false, status: 0, json: async () => { throw new SyntaxError('no body'); } };
+    return answer(a.status, a.body);
+  };
+})();`;
+
+async function setup() {
+  const root = mkdtempSync(join(tmpdir(), 'webui-decide-browser-'));
+  const store = new Store(root), b0 = new Broker({ store, businesses });
+  const grant = { method: 'host-enroll', host: 'web1', address: '192.0.2.10', port: 22, user: 'jarvis', sudo: true, fingerprints: [] };
+  const open = grantDecision(store, { grant, close: null });
+  store.run('UPDATE decisions SET question=? WHERE id=?', `Enroll web1? ${HOSTILE}`, open);
+  const deploy = grantDecision(store, { action: 'deploy', grant, close: null });
+  const bare = grantDecision(store, { close: null });
+  const reader = b0.bindReader({ business: 'demo' });
+  const bus = views({ call: async (verb, args = {}) => structuredClone(b0.request(reader, { verb, args })) });
+  const f = await fixture(), b = await browser();
+  const web = await startServer({ port: 0, board: f.boardURL, bus }), base = `http://127.0.0.1:${web.address().port}/`;
+  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: STUB });
+  await b.viewport(1280);
+  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
+  const text = sel => b.evaluate(`document.querySelector(${JSON.stringify(sel)})?.textContent ?? null`);
+  const has = sel => b.evaluate(`!!document.querySelector(${JSON.stringify(sel)})`);
+  const posts = () => b.evaluate('window.__posts');
+  const queue = a => b.evaluate(`window.__answers.push(${JSON.stringify(a)}), true`);
+  const click = step => b.evaluate(`document.querySelector('#decide-section [data-decide="${step}"]').click(), true`);
+  const page = async (query, id) => {
+    await b.navigate(`${base}?${query}#/inbox/${id}`);
+    await wait('document.querySelector("#bus-view h1")?.textContent.startsWith("Decision") && !document.querySelector("#bus-view [aria-busy]")');
+    // The config read redraws once it lands; a refresh tick after it settles the page.
+    await new Promise(r => setTimeout(r, 400));
+  };
+  const settle = () => new Promise(r => setTimeout(r, 600));
+  const done = async () => { await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
+  return { b, store, base, open, deploy, bare, wait, text, has, posts, queue, click, page, settle, done };
+}
+
+const CONFIRM = (s, action, choice, text) => ({ status: 200, body: { id: s.open, question: `Enroll web1? ${HOSTILE}`, action, choice, text, grant: { method: 'host-enroll', host: 'web1' }, confirmation: 'c'.repeat(64) } });
+
+test('J16: no controls without sso and decide, read-only reasons, terminal lines kept, and only an eligible grant gets the panel', { timeout: 120000 }, async () => {
+  const s = await setup();
+  try {
+    // Without SSO: no panel, no button, and the reason names both flags.
+    await s.page('x', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.equal(await s.has('[data-decide]'), false);
+    assert.match(await s.text('#bus-view'), /needs sign-in \(--sso\) and writes enabled \(--send\)/);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 2);
+    // SSO without --send: read-only, still the terminal lines.
+    await s.page('sso', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.match(await s.text('#bus-view'), /read-only for decisions: it was started without writes enabled \(--send\)/);
+    // send alone, without decide, still draws nothing.
+    await s.page('sso&send', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    // A tester Console never answers, whatever the config says.
+    await s.page('sso&decide&tester', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    // Eligible: the panel, both buttons, the escaped question and the terminal lines too.
+    await s.page('sso&decide', s.open);
+    assert.equal(await s.text('#decide-section h2'), 'Answer in Console');
+    assert.deepEqual(await s.b.evaluate('[...document.querySelectorAll("#decide-section [data-decide]")].map(e => [e.dataset.decide, e.textContent, e.disabled])'), [['approve', 'Approve', false], ['deny', 'Deny', false]]);
+    assert.match(await s.text('#decide-section'), /Grant: method host-enroll · host web1\./);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 2);
+    assert.equal(await s.b.evaluate('window.injected ?? null'), null);
+    assert.ok((await s.text('#bus-view .s1-q')).includes(HOSTILE));
+    // A grant raise with another action, and a credential.mint with no grant, keep the terminal only.
+    for (const id of [s.deploy, s.bare]) {
+      await s.page('sso&decide', id);
+      assert.equal(await s.has('#decide-section'), false);
+      assert.equal(await s.has('[data-decide]'), false);
+    }
+    // The Inbox says so, and marks only the eligible row.
+    await s.b.navigate(`${s.base}?sso&decide#/inbox`);
+    await s.wait('document.querySelector("#bus-view h1")?.textContent.startsWith("Inbox") && document.querySelectorAll("#bus-view .s1-decs > li").length === 3');
+    await s.settle();
+    assert.match(await s.text('#bus-view'), /A grant request can be approved or denied here, after a confirmation\./);
+    assert.equal(await s.b.evaluate('[...document.querySelectorAll("#bus-view .s1-decs > li")].filter(li => li.textContent.includes("Approve or Deny here")).length'), 1);
+    assert.deepEqual(await s.posts(), []);
+  } finally { await s.done(); }
+});
+
+test('J17: one POST per click, confirm then answer, cancel, refusals and an unknown outcome never retry', { timeout: 120000 }, async () => {
+  const s = await setup();
+  const enc = encodeURIComponent;
+  try {
+    await s.page('sso&decide', s.open);
+
+    // Approve asks for a confirmation and answers nothing. The button holds while the request is out.
+    await s.queue({ ...CONFIRM(s, 'approve', 'yes', 'Yes'), hold: true });
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=approve]")?.textContent === "Checking…"');
+    assert.equal(await s.b.evaluate('[...document.querySelectorAll("#decide-section [data-decide]")].every(e => e.disabled)'), true);
+    await s.click('approve');
+    await s.b.evaluate('window.__release(), true');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    let sent = await s.posts();
+    assert.equal(sent.length, 1);
+    assert.deepEqual(sent[0], { url: `/api/decisions/${enc(s.open)}/confirmation`, method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ choice: 'yes' }), cache: 'no-store', redirect: 'manual' });
+    assert.equal(await s.text('#decide-section [data-decide=confirm]'), 'Confirm approve');
+    assert.match(await s.text('#decide-section .s1-confirm'), /Approving starts this grant\./);
+    assert.equal(await s.b.evaluate('document.activeElement?.dataset.decide ?? null'), 'confirm');
+    assert.equal(await s.b.evaluate('window.injected ?? null'), null);
+
+    // A refresh keeps the confirmation open.
+    await s.settle();
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), true);
+
+    // Cancel drops it without a request.
+    await s.click('cancel');
+    await s.wait('document.querySelector("#decide-section [data-decide=approve]")');
+    assert.equal((await s.posts()).length, 1);
+
+    // A refusal the Console wrote shows its code and message; a 408 or a lost answer is unavailable.
+    await s.queue({ status: 409, body: { error: 'decision-stale', message: 'The choices changed. Review the decision again.' } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status")');
+    assert.equal(await s.text('#decide-status'), 'Not answered here: The choices changed. Review the decision again. (decision-stale).');
+    await s.queue({ status: 408, body: { error: 'x', message: 'y' } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "confirmation-unavailable"');
+    await s.queue({ reject: true });
+    await s.click('deny');
+    await s.wait('document.querySelectorAll("#decide-section [data-decide]:not([disabled])").length === 2');
+    assert.equal(await s.b.evaluate('document.querySelector("#decide-status code")?.textContent'), 'confirmation-unavailable');
+    assert.equal((await s.posts()).length, 4);
+
+    // A reply that doesn't match what was asked is not a confirmation.
+    await s.queue({ status: 200, body: { ...CONFIRM(s, 'approve', 'yes', 'Yes').body } });
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "confirmation-unavailable" && document.querySelectorAll("#decide-section [data-decide]:not([disabled])").length === 2');
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), false);
+
+    // An unknown outcome at the answer says to refresh, drops the confirmation and sends nothing again.
+    await s.queue(CONFIRM(s, 'deny', 'no', 'No'));
+    await s.click('deny');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    assert.match(await s.text('#decide-section .s1-confirm'), /Denying starts nothing\./);
+    await s.queue({ status: 503, body: { error: 'outcome-unknown', message: 'The answer may have reached the bus. Refresh before trying again.' } });
+    await s.click('confirm');
+    await s.wait('document.querySelector("#decide-status code")?.textContent === "outcome-unknown"');
+    assert.match(await s.text('#decide-status'), /Nothing was sent again\.$/);
+    sent = await s.posts();
+    assert.equal(sent.length, 7);
+    assert.deepEqual(sent[6], { url: `/api/decisions/${enc(s.open)}/resolve`, method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ choice: 'no', confirmation: 'c'.repeat(64) }), cache: 'no-store', redirect: 'manual' });
+    assert.equal(await s.has('#decide-section [data-decide=confirm]'), false);
+    await s.settle();
+    await s.settle();
+    assert.equal((await s.posts()).length, 7, 'the page sent again by itself');
+
+    // A confirmed approve: one answer, a receipt, and no buttons after it, across refreshes.
+    await s.queue(CONFIRM(s, 'approve', 'yes', 'Yes'));
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    await s.queue({ status: 200, body: { id: s.open, op: 'resolved', choice: 'yes', grant: 'started' } });
+    await s.click('confirm');
+    await s.wait('document.querySelector("#decide-status")?.textContent.startsWith("Approved")');
+    assert.equal(await s.text('#decide-status'), 'Approved: you chose “yes”, Yes. The grant executor started. History below shows it once the bus is read again.');
+    await s.settle();
+    assert.equal(await s.has('[data-decide]'), false);
+    assert.equal((await s.posts()).length, 9);
+
+    // Closed elsewhere: the next read drops the panel and shows the recorded answer with its provenance.
+    s.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', s.open, '2026-10-22T00:00:00.000Z', 'resolved', 'jason', 'yes', 'console');
+    await s.page('sso&decide', s.open);
+    assert.equal(await s.has('#decide-section'), false);
+    assert.match(await s.text('#bus-view'), /Resolved: jason chose “yes” via console/);
+    assert.equal(await s.b.evaluate('document.querySelectorAll("#bus-view [data-copy]").length'), 0);
+  } finally { await s.done(); }
+});
+
+test('a sign-in redirect at either step signs the page out and answers nothing', { timeout: 120000 }, async () => {
+  const s = await setup();
+  try {
+    await s.page('sso&decide', s.open);
+    await s.queue({ redirect: true });
+    await s.click('approve');
+    await s.wait('document.body.classList.contains("signed-out")');
+    assert.equal((await s.posts()).length, 1);
+    await s.page('sso&decide', s.open);
+    await s.queue(CONFIRM(s, 'approve', 'yes', 'Yes'));
+    await s.click('approve');
+    await s.wait('document.querySelector("#decide-section [data-decide=confirm]")');
+    await s.queue({ redirect: true });
+    await s.click('confirm');
+    await s.wait('document.body.classList.contains("signed-out")');
+    assert.equal((await s.posts()).length, 2);
+  } finally { await s.done(); }
+});

packages/webui/tests/decide-sso.test.mjs

@@ -0,0 +1,154 @@
+// Row 252 (#1753, design sections 4 and 5): the Console decision routes on the human listener, signed
+// in through the fake OP in helpers/fake-oidc.mjs on loopback. The bus transport is a recording stub,
+// so this covers the listener's gates and the session it passes; decision-http.test.mjs covers the
+// endpoint's own table and console-decide.test.mjs the bus. The public name is console.example.test,
+// sent only as a Host header to the test's own listener. sso.test.mjs pins its own log lines, so the
+// decide lines are checked here.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { request } from 'node:http';
+import { readFileSync } from 'node:fs';
+import { startServer } from '../src/serve.mjs';
+import { createSso, SESSION_COOKIE } from '../src/sso.mjs';
+import { DECISION_REFUSALS } from '../src/decision-http.mjs';
+import { consoleCall } from '../src/bus.mjs';
+import { close } from './fixture.mjs';
+import { fakeOidc } from './helpers/fake-oidc.mjs';
+
+const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
+const DIGEST = 'b'.repeat(64);
+const PREVIEW = { id: 'd1', business: 'demo', question: 'Enroll web1?', digest: DIGEST, approve: { key: 'yes', text: 'Yes' }, deny: { key: 'no', text: 'No' }, grant: { method: 'host-enroll', host: 'web1' } };
+
+// node:http, not fetch: fetch can't set Host, Origin or Sec-Fetch-Site.
+function call(port, { method = 'GET', path = '/', headers = {}, body, host = HOST } = {}) {
+  return new Promise((resolve, reject) => {
+    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
+    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
+      let text = '';
+      res.on('data', c => (text += c));
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text && (res.headers['content-type'] ?? '').startsWith('application/json') ? JSON.parse(text) : text }));
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+const writeHeaders = cookie => ({ ...(cookie ? { cookie } : {}), origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
+
+// The fake OP, createSso over it, and the human listener. `server` overrides startServer options.
+// The decision transport records each call and answers a preview or a resolve.
+async function setup(t, server = {}) {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const iss = op.issuer('a');
+  const config = { publicOrigin: ORIGIN, providers: [{ id: 'a', issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: 'a' }, algs: ['RS256'], subjects: [{ sub: 'user-a', name: 'person-a' }] }] };
+  const lines = [];
+  const sso = await createSso(config, { secrets: new Map([['a', iss.clientSecret]]), fetch: op.fetch, log: l => lines.push(l) });
+  t.after(() => sso.close());
+  const calls = [];
+  const decisionWrite = async (verb, args, ctx) => {
+    calls.push({ verb, args, ctx });
+    return verb === 'decision.preview.console' ? { ...PREVIEW } : { id: args.id, op: 'resolved', choice: args.choice };
+  };
+  const bus = Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions'].map(v => [v, async () => []]));
+  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, sso, send: async () => ({ id: 'msg-0001' }), decisionWrite, log: l => lines.push(l), ...server });
+  t.after(() => close(web));
+  const port = web.address().port;
+  const signIn = async () => {
+    const start = await call(port, { path: '/auth/login' });
+    assert.equal(start.status, 303);
+    const cookie = [start.headers['set-cookie']].flat()[0].split(';')[0];
+    const g = op.grant(iss, start.headers.location);
+    const q = new URLSearchParams({ code: g.code, state: new URL(start.headers.location).searchParams.get('state') });
+    const r = await call(port, { path: `/auth/callback?${q}`, headers: { cookie } });
+    return [r.headers['set-cookie'] ?? []].flat().find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0')).split(';')[0];
+  };
+  const post = (cookie, path, body, headers = {}) => call(port, { method: 'POST', path, headers: { ...writeHeaders(cookie), ...headers }, body: JSON.stringify(body) });
+  return { port, iss, calls, lines, signIn, post };
+}
+const refused = (r, code) => {
+  assert.equal(r.status, DECISION_REFUSALS[code][0], `${code}: ${r.status} ${JSON.stringify(r.body)}`);
+  assert.deepEqual(r.body, { error: code, message: DECISION_REFUSALS[code][1] });
+};
+
+test('a signed-in owner confirms and answers, with the session\'s provider, issuer and sub as the subject', async t => {
+  const env = await setup(t);
+  const session = await env.signIn();
+  const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
+  assert.equal(config.body.decide, true);
+  assert.equal(config.body.sso, true);
+  const c = await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' });
+  assert.equal(c.status, 200, JSON.stringify(c.body));
+  const r = await env.post(session, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(r.body, { id: 'd1', op: 'resolved', choice: 'yes' });
+  const subject = { provider: 'a', iss: env.iss.issuer, sub: 'user-a' };
+  assert.deepEqual(env.calls, [
+    { verb: 'decision.preview.console', args: { id: 'd1' }, ctx: { subject } },
+    { verb: 'decision.resolve.console', args: { id: 'd1', choice: 'yes', digest: DIGEST }, ctx: { subject, business: 'demo' } },
+  ]);
+  assert.match(env.lines.at(-1), / decide user="person-a" decision="d1" step=resolve choice="yes"$/);
+  assert.equal(env.lines.some(l => l.includes(c.body.confirmation) || l.includes(session.split('=')[1])), false);
+});
+
+test('the listener gates: no session, a cross-origin page, a loopback Host, a GET, and a sign-out between the steps', async t => {
+  const env = await setup(t);
+  refused(await env.post(null, '/api/decisions/d1/confirmation', { choice: 'yes' }), 'sign-in-required');
+  const session = await env.signIn();
+  refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }, { origin: 'https://evil.test' }), 'cross-origin');
+  refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }, { 'sec-fetch-site': 'cross-site' }), 'cross-origin');
+  const loop = await call(env.port, { method: 'POST', path: '/api/decisions/d1/confirmation', host: `127.0.0.1:${env.port}`, headers: { cookie: session, 'content-type': 'application/json' }, body: '{"choice":"yes"}' });
+  assert.equal(loop.status, 403);
+  refused(await call(env.port, { path: '/api/decisions/d1/confirmation', headers: { cookie: session } }), 'method-not-allowed');
+  assert.equal(env.calls.length, 0);
+  const c = await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' });
+  assert.equal(c.status, 200);
+  const out = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'same-origin' } });
+  assert.equal(out.status, 303);
+  refused(await env.post(session, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation }), 'sign-in-required');
+  assert.equal(env.calls.length, 1);
+  // A new session can't use the old session's confirmation.
+  const again = await env.signIn();
+  refused(await env.post(again, '/api/decisions/d1/resolve', { choice: 'yes', confirmation: c.body.confirmation }), 'confirmation-required');
+  assert.equal(env.calls.length, 1);
+});
+
+test('J16: without --send or a decision transport the routes are read-only and /api/config says no; startServer refuses decide without sso or send', async t => {
+  for (const server of [{ send: null }, { decisionWrite: null }]) {
+    const env = await setup(t, server);
+    const session = await env.signIn();
+    const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
+    assert.equal(config.body.decide, false);
+    assert.equal(config.body.sso, true);
+    refused(await env.post(session, '/api/decisions/d1/confirmation', { choice: 'yes' }), 'read-only');
+    assert.equal(env.calls.length, 0);
+  }
+  const write = async () => ({});
+  await assert.rejects(startServer({ port: 0, decisionWrite: write, send: async () => ({}) }), /need --sso and --send/);
+  await assert.rejects(startServer({ port: 0, tester: true, testerSocket: {}, decisionWrite: write }), /need --sso and --send/);
+  const plain = await startServer({ port: 0, board: 'http://127.0.0.1:9' });
+  t.after(() => close(plain));
+  const port = plain.address().port, host = `127.0.0.1:${port}`;
+  const r = await call(port, { method: 'POST', path: '/api/decisions/d1/confirmation', host, headers: { origin: `http://${host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' }, body: '{"choice":"yes"}' });
+  refused(r, 'read-only');
+  const config = await call(port, { path: '/api/config', host });
+  assert.equal(config.body.decide, false);
+  assert.equal('sso' in config.body, false);
+});
+
+test('N4: decision.resolve has no Console route, the --send caller names no decision verb, and consoleCall takes only the two console verbs', async t => {
+  const env = await setup(t);
+  const session = await env.signIn();
+  for (const verb of ['decision.resolve', 'decision.resolve.console', 'decision.preview.console']) {
+    for (const method of ['GET', 'POST']) {
+      const r = await call(env.port, { method, path: `/api/bus/${verb}`, headers: writeHeaders(session), ...(method === 'POST' ? { body: '{}' } : {}) });
+      assert.equal(r.status, 404, `${method} ${verb}`);
+    }
+  }
+  assert.equal(env.calls.length, 0);
+  const cli = readFileSync(new URL('../src/cli.mjs', import.meta.url), 'utf8');
+  assert.doesNotMatch(cli, /['"]decision\./);
+  const c = consoleCall({ dataRoot: '/nonexistent', socket: '/nonexistent', business: 'demo', cli: '/nonexistent/console-cli.mjs', timeoutMs: 1000 });
+  for (const verb of ['decision.resolve', 'decision.seen', 'message.send', 'inbox']) {
+    await assert.rejects(c(verb, { id: 'd1', choice: 'yes' }, { subject: { provider: 'a', iss: 'i', sub: 's' } }), /the Console does not call/);
+  }
+});

packages/webui/tests/decision-http.test.mjs

@@ -0,0 +1,205 @@
+// Row 252 (#1753): the Console decision endpoint, driven with a fake request, response and bus
+// transport. The real bus side is in packages/bus/tests/console-decide.test.mjs and the page side
+// in the browser tests.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { BusReadError } from '../src/bus.mjs';
+import { DECISION_REFUSALS, createConfirmations, decisionHTTP } from '../src/decision-http.mjs';
+
+const ORIGIN = 'https://console.test';
+const DIGEST = 'a'.repeat(64);
+const PREVIEW = {
+  id: 'd1', business: 'demo', question: 'Enroll host?', digest: DIGEST,
+  approve: { key: 'yes', text: 'Yes, enroll it' }, deny: { key: 'no', text: 'No' },
+  grant: { method: 'host-enroll', host: 'h1' },
+};
+
+function request({ method = 'POST', body = {}, headers = {}, raw } = {}) {
+  const h = { origin: [ORIGIN], 'sec-fetch-site': ['same-origin'], 'content-type': ['application/json'], ...headers };
+  for (const k of Object.keys(h)) if (h[k] === null) delete h[k];
+  const data = Buffer.from(raw ?? JSON.stringify(body));
+  return { method, headersDistinct: h, async *[Symbol.asyncIterator]() { yield data; } };
+}
+function response() {
+  const r = { status: null, headers: null, text: '' };
+  r.writeHead = (s, h) => { r.status = s; r.headers = h; };
+  r.end = (t = '') => { r.text += t; };
+  r.json = () => JSON.parse(r.text);
+  return r;
+}
+function setup({ answer = () => ({ ...PREVIEW }), resolve = (a) => ({ id: a.id, op: 'resolved', choice: a.choice, grant: 'started' }), now } = {}) {
+  const session = { name: 'jason', provider: 'fake-oidc', iss: 'https://idp.test', sub: 'owner-1' };
+  const calls = [], lines = [];
+  const s = {
+    session, calls, lines, current: session,
+    confirmations: createConfirmations(now ? { now } : {}),
+    decide: {
+      origin: ORIGIN,
+      call: async (verb, args, ctx) => {
+        calls.push({ verb, args, ctx });
+        return verb === 'decision.preview.console' ? answer(args) : resolve(args);
+      },
+    },
+  };
+  s.run = async (path, req) => {
+    const res = response();
+    await decisionHTTP(req, res, { path, decide: s.decide, session: s.session, live: () => s.current, confirmations: s.confirmations, log: (l) => lines.push(l) });
+    return res;
+  };
+  s.confirm = (choice = 'yes', id = 'd1') => s.run(`/api/decisions/${id}/confirmation`, request({ body: { choice } }));
+  s.resolve = (body, id = 'd1') => s.run(`/api/decisions/${id}/resolve`, request({ body }));
+  return s;
+}
+const refused = (res, code) => {
+  assert.equal(res.status, DECISION_REFUSALS[code][0], `${code}: ${res.text}`);
+  assert.deepEqual(res.json(), { error: code, message: DECISION_REFUSALS[code][1] });
+  assert.equal(res.headers['cache-control'], 'no-store');
+};
+
+test('a confirmation then a resolve answers once with the held choice and digest, and a second resolve refuses', async () => {
+  const s = setup();
+  const c = await s.confirm('yes');
+  assert.equal(c.status, 200);
+  const body = c.json();
+  assert.match(body.confirmation, /^[a-f0-9]{64}$/);
+  assert.deepEqual({ ...body, confirmation: 'x' }, { id: 'd1', question: 'Enroll host?', action: 'approve', choice: 'yes', text: 'Yes, enroll it', grant: PREVIEW.grant, confirmation: 'x' });
+  assert.deepEqual(s.calls[0], { verb: 'decision.preview.console', args: { id: 'd1' }, ctx: { subject: { provider: 'fake-oidc', iss: 'https://idp.test', sub: 'owner-1' } } });
+  const r = await s.resolve({ choice: 'yes', confirmation: body.confirmation });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json(), { id: 'd1', op: 'resolved', choice: 'yes', grant: 'started' });
+  assert.deepEqual(s.calls[1], { verb: 'decision.resolve.console', args: { id: 'd1', choice: 'yes', digest: DIGEST }, ctx: { subject: { provider: 'fake-oidc', iss: 'https://idp.test', sub: 'owner-1' }, business: 'demo' } });
+  // J12: the confirmation is spent, so a repeat never reaches the bus.
+  refused(await s.resolve({ choice: 'yes', confirmation: body.confirmation }), 'confirmation-required');
+  assert.equal(s.calls.length, 2);
+  assert.equal(s.lines.length, 3);
+  assert.match(s.lines[0], / decide user="jason" decision="d1" step=confirmation action=approve$/);
+  assert.match(s.lines[1], / step=resolve choice="yes" grant=started$/);
+  assert.doesNotMatch(s.lines.join('\n'), new RegExp(body.confirmation));
+});
+
+test('deny resolves without a grant field', async () => {
+  const s = setup({ resolve: (a) => ({ id: a.id, op: 'resolved', choice: a.choice }) });
+  const c = (await s.confirm('no')).json();
+  assert.equal(c.action, 'deny');
+  assert.equal(c.text, 'No');
+  const r = await s.resolve({ choice: 'no', confirmation: c.confirmation });
+  assert.deepEqual(r.json(), { id: 'd1', op: 'resolved', choice: 'no' });
+});
+
+test('the gates before the body: method, read-only, sign-in and same origin', async () => {
+  const s = setup();
+  refused(await s.run('/api/decisions/d1/confirmation', request({ method: 'GET' })), 'method-not-allowed');
+  const res = response();
+  await decisionHTTP(request({ body: { choice: 'yes' } }), res, { path: '/api/decisions/d1/confirmation', decide: null, session: s.session, live: () => s.session, confirmations: s.confirmations, log: () => {} });
+  refused(res, 'read-only');
+  const out = response();
+  await decisionHTTP(request({ body: { choice: 'yes' } }), out, { path: '/api/decisions/d1/confirmation', decide: s.decide, session: null, live: () => null, confirmations: s.confirmations, log: () => {} });
+  refused(out, 'sign-in-required');
+  for (const headers of [{ origin: ['https://evil.test'] }, { origin: null }, { origin: [ORIGIN, ORIGIN] }, { 'sec-fetch-site': ['same-site'] }, { 'sec-fetch-site': null }]) {
+    refused(await s.run('/api/decisions/d1/confirmation', request({ body: { choice: 'yes' }, headers })), 'cross-origin');
+  }
+  assert.equal(s.calls.length, 0);
+});
+
+test('a bad body, id or content type refuses before the bus', async () => {
+  const s = setup();
+  const path = '/api/decisions/d1/confirmation';
+  refused(await s.run(path, request({ body: { choice: 'yes' }, headers: { 'content-type': ['text/plain'] } })), 'invalid-request');
+  refused(await s.run(path, request({ raw: '{' })), 'invalid-request');
+  refused(await s.run(path, request({ raw: '[]' })), 'invalid-request');
+  refused(await s.run(path, request({ body: { choice: 'yes', extra: 1 } })), 'invalid-request');
+  refused(await s.run(path, request({ body: { choice: 1 } })), 'invalid-request');
+  refused(await s.run(path, request({ raw: JSON.stringify({ choice: 'y'.repeat(5000) }) })), 'request-too-large');
+  refused(await s.run('/api/decisions/..%2Fx/confirmation', request({ body: { choice: 'yes' } })), 'decision-not-found');
+  refused(await s.run('/api/decisions/%E0%A4%A/confirmation', request({ body: { choice: 'yes' } })), 'decision-not-found');
+  refused(await s.resolve({ choice: 'yes' }), 'invalid-request');
+  refused(await s.resolve({ choice: 'yes', confirmation: 'a'.repeat(64), more: 1 }), 'invalid-request');
+  assert.equal(s.calls.length, 0);
+});
+
+test('a choice that is neither key is decision-stale, and a malformed preview is confirmation-unavailable', async () => {
+  refused(await setup().confirm('maybe'), 'decision-stale');
+  for (const bad of [{ ...PREVIEW, id: 'd2' }, { ...PREVIEW, digest: 'short' }, { ...PREVIEW, deny: { key: 'yes', text: 'No' } }, { ...PREVIEW, grant: null }, null]) {
+    const s = setup({ answer: () => bad });
+    refused(await s.confirm('yes'), 'confirmation-unavailable');
+    assert.equal(s.confirmations.size, 0);
+  }
+});
+
+test('bus refusals map by code, and an unknown or missing code is unavailable at preview and outcome-unknown at resolve', async () => {
+  const cases = [
+    ['human-required', 'human-required'], ['agent-required', 'human-required'], ['access-revoked', 'human-required'],
+    ['peercred-required', 'peercred-required'], ['decision-not-eligible', 'decision-not-eligible'],
+    ['decision-closed', 'decision-closed'], ['decision-stale', 'decision-stale'], ['invalid-choice', 'decision-stale'],
+    ['decision-not-found', 'decision-not-found'], ['outcome-unknown', 'confirmation-unavailable'], ['weird', 'confirmation-unavailable'],
+  ];
+  for (const [bus, code] of cases) {
+    const s = setup({ answer: () => { throw new BusReadError(bus); } });
+    refused(await s.confirm('yes'), code);
+  }
+  refused(await setup({ answer: () => { throw new Error('boom'); } }).confirm('yes'), 'confirmation-unavailable');
+  for (const [bus, code] of [['decision-closed', 'decision-closed'], ['outcome-unknown', 'outcome-unknown'], ['weird', 'outcome-unknown']]) {
+    const s = setup({ resolve: () => { throw new BusReadError(bus); } });
+    const c = (await s.confirm('yes')).json();
+    refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }), code);
+    // Nothing retries, and the confirmation stays spent.
+    assert.equal(s.calls.length, 2);
+    refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }), 'confirmation-required');
+  }
+  for (const reply of [null, { id: 'd2', op: 'resolved', choice: 'yes' }, { id: 'd1', op: 'refused', choice: 'yes' }, { id: 'd1', op: 'resolved', choice: 'no' }]) {
+    const s = setup({ resolve: () => reply });
+    const c = (await s.confirm('yes')).json();
+    refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }), 'outcome-unknown');
+  }
+});
+
+test('a confirmation binds the session, decision and choice, and any mismatch spends it', async () => {
+  const s = setup();
+  let c = (await s.confirm('yes')).json();
+  refused(await s.resolve({ choice: 'no', confirmation: c.confirmation }), 'confirmation-required');
+  refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }), 'confirmation-required');
+  c = (await s.confirm('yes')).json();
+  refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }, 'd2'), 'confirmation-required');
+  c = (await s.confirm('yes')).json();
+  const other = setup();
+  other.confirmations = s.confirmations;
+  other.session = { ...s.session };
+  other.current = other.session;
+  refused(await other.resolve({ choice: 'yes', confirmation: c.confirmation }), 'confirmation-required');
+  refused(await s.resolve({ choice: 'yes', confirmation: 'not-a-token' }), 'confirmation-required');
+  assert.equal(s.calls.filter((x) => x.verb === 'decision.resolve.console').length, 0);
+  assert.equal(other.calls.length, 0);
+});
+
+test('a session that ends between the steps refuses before the bus', async () => {
+  const s = setup();
+  s.current = null;
+  refused(await s.confirm('yes'), 'sign-in-required');
+  assert.equal(s.calls.length, 0);
+  s.current = s.session;
+  const c = (await s.confirm('yes')).json();
+  s.current = { ...s.session };
+  refused(await s.resolve({ choice: 'yes', confirmation: c.confirmation }), 'sign-in-required');
+  assert.equal(s.calls.length, 1);
+  // A sign-out during the preview also refuses, and no confirmation is issued.
+  const t = setup({ answer: () => { t.current = null; return { ...PREVIEW }; } });
+  refused(await t.confirm('yes'), 'sign-in-required');
+  assert.equal(t.confirmations.size, 0);
+});
+
+test('confirmations expire after the TTL, cap at the limit without dropping a live one, and are one use', () => {
+  let t = 0;
+  const store = createConfirmations({ ttlMs: 1000, max: 2, now: () => t });
+  const bind = { session: 's', business: 'demo', decision: 'd1', choice: 'yes', digest: DIGEST };
+  const a = store.issue(bind), b = store.issue(bind);
+  assert.equal(store.issue(bind), null);
+  assert.equal(store.size, 2);
+  assert.equal(store.consume(a, bind).digest, DIGEST);
+  assert.equal(store.consume(a, bind), null);
+  t = 1000;
+  assert.equal(store.consume(b, bind), null);
+  assert.equal(store.size, 0);
+  assert.match(store.issue(bind), /^[a-f0-9]{64}$/);
+  assert.equal(store.consume(undefined, bind), null);
+  assert.equal(store.consume('A'.repeat(64), bind), null);
+});

packages/webui/tests/shell.test.mjs

@@ -50,14 +50,18 @@ test('shipped strings are unchanged, and the web keeps its write boundary', () =
     ['bus.js', 'No open tasks.'], ['bus.js', 'No role is held right now.'], ['bus.js', 'Nothing of this kind in the trail.'],
     ['bus.js', 'Console shows nothing rather than a guess. Nothing was written.'],
   ]) assert.equal(plain[file].split(s).length - 1, n, `${file}: ${s}`);
-  // No Resolve control. The board's Seen and reply are app.js's POSTs; bus.js has four explicit writes:
+  // Row 252 (#1753, mos-1321): the one decision control is the Console's grant Approve and Deny, one
+  // fetch(url, ...) in decidePost, called only for a decision's confirmation and its resolve. Its labels
+  // come from ACTIONS, and the doesNotMatch below keeps any literal Resolve, Decide or Approve label out
+  // of the markup. The board's Seen and reply are app.js's POSTs; bus.js's other explicit writes are
   // row 76's message to a role, row 122's human Settings update, row 125's token-limit reset (one path,
   // to the same Settings route) and row 148's spec and docs save. Row 165 (#1662) adds the role
   // instance add or change to /api/instances, and row 65 the routing table's save to /api/routes.
   assert.doesNotMatch(src, /<button[^>]*>[^<]*(Resolve|Decide|Approve)/i);
   const writes = read('bus.js').toString().match(/fetch\([^;]*method:\s*['"](POST|PUT|PATCH|DELETE)[^;]*;/g) ?? [];
-  assert.deepEqual(writes, ["fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision,reset:[JSON.parse(path)]}),cache:'no-store',redirect:'manual'});", "fetch(url,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/instances',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/routes',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/project-file', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(sent), cache: 'no-store', redirect: 'manual' });", "fetch('/api/bus/message', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ to, body: text }), cache: 'no-store', redirect: 'manual' });"]);
-  assert.equal(read('bus.js').toString().split(/method:/).length - 1, 7);
+  assert.deepEqual(writes, ["fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), cache: 'no-store', redirect: 'manual' });", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision,reset:[JSON.parse(path)]}),cache:'no-store',redirect:'manual'});", "fetch(url,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/instances',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/routes',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/project-file', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(sent), cache: 'no-store', redirect: 'manual' });", "fetch('/api/bus/message', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ to, body: text }), cache: 'no-store', redirect: 'manual' });"]);
+  assert.equal(read('bus.js').toString().split(/method:/).length - 1, 8);
+  assert.deepEqual([...read('bus.js').toString().matchAll(/decidePost\(([^,]*),/g)].map(m => m[1]), ['url', '`/api/decisions/${enc(a.id)}/confirmation`', '`/api/decisions/${enc(a.id)}/resolve`']);
   // Row 155 (#1649): the one fetch(url, ...) posts only to these three routes, each a literal.
   // Row 176 (#1674): the tester name form adds a second /api/name caller.
   assert.deepEqual([...read('bus.js').toString().matchAll(/assistantPost\(([^,]*),/g)].map(m => m[1]), ['url', "'/api/settings'", "'/api/name'", "'/api/assistant-stop'", "'/api/name'"]);

packages/webui/tests/tester-listener.test.mjs

@@ -183,3 +183,14 @@ test('row 177 W4: the main listener refuses x-mosaic-tester on chat reads and wr
   assert.equal((await http(web, '/api/chat/threads', { headers: signed })).status, 200);
   assert.deepEqual(calls, ['threads']);
 });
+
+test('Row 252: the tester listener has no decision answer routes, and its config never offers them', async t => {
+  const s = await testerFixture(t);
+  for (const step of ['confirmation', 'resolve']) {
+    const r = await post(s.web, `/api/decisions/d1/${step}`, step === 'confirmation' ? { choice: 'yes' } : { choice: 'yes', confirmation: 'a'.repeat(64) });
+    assert.equal(r.status, 404, r.text);
+    assert.equal(r.body.error, 'not-found');
+  }
+  assert.equal((await http(s.web, '/api/config')).body.decide, false);
+  assert.deepEqual(s.calls, []);
+});

scripts/stack-release.sh

@@ -417,7 +417,7 @@ plugin_checks() {
 # Row 181: the tables a bus writer fills without an event in the same transaction, in schema
 # order. A restore drops their rows after STAMP as it drops events, so the guard counts them too.
 # BUILD.md for row 181 names each writer; the T46 guard classifies every table in the schema.
-COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads thread_opens instance_names usage_records"
+COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads sessions session_defaults thread_opens instance_names usage_records"
 
 STORE_JS='
 const {DatabaseSync}=require("node:sqlite");const {pathToFileURL}=require("node:url");