test: pin the compaction audit before the persona refusal

Apply the exact two-row fixture assertion approved by mos-1418 and sage-3232. Preserve earlier red logs; no product change and no rerun before review.

agents/rocko/work/queue-219/BUILD.md

@@ -0,0 +1,262 @@
+# Row 219 / C2-09a: one thread per creative instance
+
+Assignment sage-2793, base aca16404c; branch rocko/row219, own worktree
+/mnt/storage/scratch/rocko-r219. Claim waits for Sage's gap. No Node, tests,
+HTTPS git or push while Gander's row253 gate holds the slot.
+
+Read both C2-09a and C2-09b briefs at aca16404c and 51cc0445c: the two
+sections are byte-identical. The newer brief changes C2-06's reply limits
+under Q222, not C2-09a. This row introduces no M5 limit, writer or setting.
+Row265 rooms chains on this row and stays separate.
+
+## Implementation plan
+
+Broker: replace assistant-only #threaded with THREAD_DEFINITIONS membership.
+thread.create gains optional instance, validates it as a declared thread
+instance, and binds both the thread and default session to it. Omitted
+instance retains single-instance fallback and ambiguous/missing refusals.
+User grants must still cover the selected instance and project before
+project lookup; an explicit selector cannot bypass FED R3. Existing tester
+ownership and per-thread/per-session holder checks remain.
+
+Launcher: import shared THREAD_DEFINITIONS and replace its two assistant
+checks (check and ending), preserving launch admission, quotas, session
+isolation and stop policy. No runtime.mjs, bundle or library adapter change;
+Della row224 was notified of these narrow launcher hunks.
+
+Console: actual shipped new-thread UI is in public/chat.js, with transport
+mapping in chat.mjs and HTTP validation in chat-http.mjs, not public/bus.js.
+These three files need Sage's scope addition before their edits. Proposed
+metadata read GET /api/chat/instances in serve.mjs uses the existing
+bus.instances read, filters using shared THREAD_DEFINITIONS, and returns
+only {instance,name}, with vars['persona.name'] or instance as the label.
+It adds no channel operation or bus verb; send still traverses createChat
+and the existing channel dispatch. The new select sends optional instance
+through chat-http validation and chat.mjs. It is disabled when metadata
+cannot be read, so the UI never silently chooses between agents.
+
+## Acceptance evidence to build (runs await CLEAR)
+
+Bus: explicit creative selection binds the requested thread and default
+session; omitted selector preserves assistant compatibility, missing and
+ambiguous cases. Unknown/non-thread/malformed selectors refuse without
+new threads; user grants cover only the selected instance, with prior
+non-disclosure order intact. Real creative role definition messaging still
+holds. A creative thread claims/receives independently of its peer.
+
+CLI: real fixture launcher starts a creative thread on pending input and
+keeps peer thread/session stores separate. Direct non-thread launch of a
+creative instance refuses thread-required. Existing assistant tests remain.
+
+WebUI: metadata lists thread definitions only with persona/name labels;
+selection survives refresh and reaches thread.create exactly. Malformed
+instance fails before a write, old omitted instance still works. Browser
+asserts two creative options, inert hostile labels and read-only disablement.
+Keep all identity/origin/content/SSO fences. Named mutants cover each new
+acceptance guard; no runs until Sage's announced gap/CLEAR.
+
+Before review: grep source readers/hash pins, update only pins required by
+owned changes, rebase onto row253 landing under a new branch, then rerun
+touched files on the new tree. No schema, role-policy, live or canonical
+product-path change. Handoff directly to Dewey, Mos and Sage when ready.
+
+## Scope ruling and picker design before UI edits
+
+Sage-2807 adds public/chat.js, chat.mjs and chat-http.mjs because the shipped
+form is chat.js:55/235, its forwarding is chat.mjs:23, and POST validation is
+chat-http.mjs:80-82. bus.js stays byte-identical. The new route sits after
+existing auth/session checks and uses startServer's own bus, so the tester
+socket's separately supplied testerBus is used too (Dewey U1). No new bus or
+channel operation. The route projects only instance/name and keeps the
+THREAD_DEFINITIONS filter server-side, rather than making the browser read
+all /api/bus/instances vars (Dewey route note).
+
+Dewey-0849 U2-U5: multiple choices start with a required placeholder; exactly
+one starts chosen and is sent explicitly; none disables Create and says no
+thread instances are configured. Failed metadata reads disable Create with
+"Couldn't read the thread instances; reload to try again" and recover on a
+good read. Labels show persona name plus instance key when different. Picks
+live in form(key); a removed pick is cleared with a status and never moved
+to another option, even if only one remains. Repaints retain selection.
+U6 is deferred: thread-list/header still show their existing instance keys.
+The shared sign-out/redirect handling and strict HTTP write key validation
+remain in force. Add unauthenticated metadata and selected-instance user
+grant refusal tests as Sage requires.
+
+## Existing fixture adaptations (unrun)
+
+C2-08 creative.test's setup previously bound creative roles without threads
+and sent human input with message.send. This row makes those roles threaded:
+setup now selects assistant explicitly, creates each creative instance's
+thread and binds its claim there; the human uses thread.send. Existing
+M6/messaging refusal and count assertions stay in place. The user-principal
+fixture gains optional extra threadRoles for the selected-grant regression.
+
+The browser fixture now answers /api/chat/instances with its one assistant.
+Its existing create receipt assertion gains instance:'assistant', since the
+new picker explicitly sends its single preselected choice. No existing
+assertion is dropped. New tests cover multiple/empty/failed metadata,
+duplicate hostile labels, selected-instance POST, refresh and disappearing
+choices. No Node or test has been run under Gander's hold.
+
+The existing launcher.test C2-08 persona-mismatch regression cannot keep
+requesting a standalone creative launch: C2-09a now correctly refuses it
+thread-required before bundle construction. Its trigger is therefore the
+thread pass, with an injected host threadsState snapshot (the persona
+mismatch occurs before any bind). The exact mismatch reason, no persona
+content leak, one refusal and no running session assertions remain. The
+old per-run `['session']` directory assertion changes to `[]` and gains an
+assertion for the thread-owned session directory, matching row121's actual
+thread-store layout. A new e.thread assertion pins the path. This is a
+fixture/expected-layout adaptation, not a product exception for that test.
+
+## Old-test approval: mos-1316
+
+Mos approved the three adaptations in OLD-TEST-CHANGES.md (sha256
+9a1e51e6b43040593a3dd517c4a0c71f5ac42b6b57d66d474cd0517f06e97ed6)
+and old-persona-test.diff (sha256
+6aaca9820b692ec659058e9b044f7f60872cdecb16fe3ac1321c2c0ed530701d).
+The source commit must name mos-1316 and carry OLD-TEST-CHANGES.md.
+Dewey checks each changed line against that record.
+
+Keep the new thread-launch test's fromSession(chief.cap, 'bean') refusal
+(thread-required), and the threads test's direct human message.send refusal
+for each creative definition (thread-required-use-thread-send). The former
+is sandbox-dependent: its gate record must show it ran without a skip;
+otherwise report to Mos rather than claiming the pin. T06 restores the old
+assistant-only launcher check; T22 restores the ending check separately.
+The persona mismatch fixture wraps only threadsState; all other host ops
+remain real. Under mos-1272, a first-run red in launcher.test.mjs,
+creative.test.mjs or chat-browser.test.mjs goes to Mos before any fix.
+No run has occurred as of this approval record.
+
+### mos-1317: always-running standalone admission pin
+
+Added a separate new test next to the assistant standalone refusal:
+`C2-09a: fromSession refuses a creative instance outside a thread without a sandbox`.
+It has no sandbox skip. The real fixture host binds/claims the chief, and
+fromSession must refuse Bean with thread-required before bundle/sandbox
+construction. The existing sandbox-dependent pin remains unchanged.
+T23 restores both launcher assistant-only comparisons and targets this new
+exact refusal assertion. T06 and T22 remain as separate launch/ending checks:
+23 mutants total. No tests run; slot scope amendment sent to Sage.
+Keep the Mos-approved threadsState wrap as the only persona-test host override.
+
+## Inspection candidate under sage-3113 (2026-10-23)
+
+Explicitly UNVERIFIED. Sage authorized a local inspection commit before
+runs; no claim of review readiness or green tests. Base remains aca16404c,
+branch rocko/row219. No rebase has been performed. No Node, browser, test,
+mutant or suite has run; the earlier gate holds and subsequent row219 hold
+were honored. Static Python exact-once preparation named 23 mutant sites;
+git diff --check passes. The mutant execution runner is not yet written.
+
+14 source/test paths: six product files and eight whole test files. The
+candidate manifest excludes this packet. The new no-sandbox fromSession
+Bean test and T23 record mos-1317; old test adaptations stay governed by
+mos-1316 and OLD-TEST-CHANGES.md. First-run reds in launcher, creative and
+chat-browser must go to Mos before any fix. Run evidence must prove the
+sandbox-dependent pin ran, or report its skip to Mos.
+
+Remaining: Sage-directed rebase to current landing base/new branch; slot
+CLEAR and claim; eight whole test files and 23 mutants with process-group
+cleanup; path/hash-reader sweep, acceptance evidence and final review packet.
+No product behavior is verified. Push waits for Sage's named gap; reviewers
+and dependent rows may inspect this commit but must not treat it as approved.
+
+## Rebase under sage-3127 / exact resolution sage-3128
+
+Rebased the unverified c4b4fab98 inspection candidate from aca16404c onto
+062646487451993302c768c6812b827c834e952b. The only conflict was broker.mjs's
+thread.create user guard: row206 added verb-sensitive #granted(s, verb,
+project, instance). Sage-3128 supplied the exact resolution: retain the
+selected-instance validation and call #granted(s, 'thread.create',
+identifier(a.project), instance). No guessed conflict resolution. The merged
+broker has no remaining three-argument #granted(s, ...) call (static balanced
+argument scan). T05 now matches that four-argument call and substitutes null
+only for instance; all 23 mutant old anchors, including T23's second edit,
+remain exact-once. Rebuild manifest/base/patch on this base. Other auto-merges
+were user-principal.test, launcher and thread-launch.test. No tests, Node,
+mutants or reader audit run: CLEAR still required after 574, covering every
+touched test file whole. This branch remains UNVERIFIED.
+
+## Full gate preparation: sage-3174
+
+Clean rebase onto 4a9c536e861f1d9f9a018019b3ac4519d65eccf0, after rows270+271.
+No conflicts or manual product changes. All 23 anchors remain exact-once,
+including T05 and T23's second edit. All 14 candidate hashes rebuilt.
+
+Before first run: eight files whole, then bus/cli/webui whole, then all ten
+scripts/test-*.sh, then 23 mutants, then reader audit with positive control.
+Singles timeout 300s; suites 1800s; mutants 180s, each in its own process
+group, TERM then KILL after 10s and restore in finally. Every stage gets a
+fresh short TMPDIR under /mnt/storage/scratch/tmp/r*. DOCKER_HOST is dead for
+Node runs; shell fixtures may use Docker, with project rocko-r219-gate and
+owned network cleanup in finally. Live provider cases are not enabled.
+
+Each of the ten shell files uses `timeout -k 10 3600`, comfortably above 3x
+the longest entire earlier observed builder gate (roughly 25min -> 75min
+would exceed 3600; use 7200 seconds instead below). To avoid relying on
+old skip-fast samples, the actual shell command is timeout -k 10 7200,
+more than 3x that 25-minute conservative baseline for any individual shell.
+No shell run silently retries. Log each skip verbatim. Initial timings are
+in historical queue114/r1/out/full/gate-results.json (old task run skipped
+live cases, so not used as the Docker worst-case estimate).
+
+Mos1316/1317 first-run launcher/creative/chat-browser reds, any old-test red
+or a second red stop before fixes and go to Sage/Mos. No run evidence yet.
+
+## First red and approved test-only correction: mos-1408 / sage-3178-3179
+
+Run c7bf3622d stopped at launcher.test's row213 persona-mismatch assertion:
+04:07:22.895-04:07:51.870Z, creative 4/0/0, threads 19/0/0,
+user-principal 23/0/0, launcher 33/1/0: total 79 pass, 1 fail, 0 skip.
+The approved threadsState snapshot had no session; row269's session-required
+admission fired before bundle/persona reading. Original logs remain in
+run-4a9c/ and derived-counts-first-stop.json reads their default spec output.
+No retry or fix occurred before Mos's ruling. Slot returned after empty
+Node/Chromium cwd sweep and all 14 source hashes checked.
+
+Mos-1408 permits only an explicit SESSION in that snapshot and literal-path
+assertions: the native threads/acme/<thread>/sessions/<SESSION>/session exists,
+and the legacy threads/acme/<thread>/session does not. No sessionStore() call
+in the assertion: it creates directories and could manufacture the evidence.
+Every other assertion stays exactly as before; no second host op is wrapped.
+No product change. Runner explicitly selects --test-reporter=tap (packet-only)
+and uses new run-4a9c-mos1408/ output, preserving the failed first attempt.
+The next CLEAR reruns from the beginning: whole files, suites, shells, all
+23 mutants, reader audit. Any red or second edit must return to Sage/Mos.
+
+Sage-3179: commit/push during the current gap; hold re-claim until our own
+slot, after 292 then 294. No tests or queue writes under another seat's slot.
+
+## Restart scope: sage-3224
+
+Run HEAD b97a3ff97, source/test manifest a973912f, unchanged. Start every
+stage from the beginning; no prior passing test carry. Sage-3224 explicitly
+requires timeout -k 10 per stage, so the packet driver now wraps each Node
+stage in that command too (shell stages already had it); the existing process
+group timeout/cleanup remains a second bound. No source or test edit.
+Singles 300s, suites 1800s, shells 7200s, mutants 180s, TERM-to-KILL 10s.
+Fresh short stage TMPDIR. Explicit TAP. Separate run-4a9c-mos1408 output.
+
+## Second old-test edit: mos-1418 / sage-3232 (no restart yet)
+
+The b97a restart at 05:48:57.418-05:49:26.296Z stopped at row213 again:
+creative4/0/0, threads19/0/0, user-principal23/0/0, launcher33/1/0.
+Original TAP is run-4a9c-mos1408/single-cli-launcher.test.tap. Row270 now
+records compactions before the persona refusal: captured tuple was
+['compactions',undefined,2], not the full compactions object. Static inference
+of count0/known true/reason null was explicitly identified as inference.
+No edit or rerun occurred before Mos's approval; slot returned after empty
+cwd sweep and 14-hash check. Remaining stages unrun.
+
+Mos-1418 permits this exact second edit: move run-directory lookup above the
+pin, require exactly two rows, deepEqual row0 minus at to event compactions,
+instance bean, thread, SESSION, run runs[0], count0, known true, reason null;
+then take e from row1 and require refused/launch-failed. Later e.thread,
+e.why, content nonleak, no sessions, one run, empty run directory and native/
+legacy store assertions stay unchanged. Only the specified comment changes.
+No product bytes change. If inference is wrong, report red, no third edit.
+Dewey must inspect this test diff before the next full restart. Local commit
+only while294 holds; push waits for Sage's named gap. No runs after this edit.

agents/rocko/work/queue-219/OLD-TEST-CHANGES.md

@@ -0,0 +1,58 @@
+# Old-test changes awaiting Mos under mos-1272 (sage-2822)
+
+No test has run. Row219's product patch is uncommitted on rocko/row219,
+aca16404c, /mnt/storage/scratch/rocko-r219.
+
+## Persona-mismatch regression: launcher.test.mjs
+
+Name: `row 213 a creative instance's persona is read from <configDir>/personas:
+off its digest the launch fails with the mismatch as its reason`.
+
+Old trigger: bind/claim a chief, then
+`assert.deepEqual(await launcher.fromSession(chief.cap, "bean"), { ok: false, error: "launch-failed" });`.
+
+New trigger: fixture-wrap only `host.op({op:'threadsState'})` to report one
+pending Bean thread, then `await launcher.tick()`. No fake grant, bind,
+writer or persona reader. The same actual persona bundle check fails before
+any thread run binds. All other host operations use the real fixture host.
+
+Why: C2-08 declares companion and the shared THREAD_DEFINITIONS. Row219 now
+uses that list in check(). Bean's companion definition is therefore
+threaded, and fromSession's standalone request refuses thread-required
+before start()/buildBundle can read the persona. Keeping that trigger would
+stop testing the persona check. No product exemption is added.
+
+Preserved assertions: exactly one refusal; event/code = refused/launch-failed;
+exact persona-mismatch reason including the fixture persona path; no
+PERSONA-MARKER-d2 in logs; no running sessions; exactly one failed run dir.
+The direct fromSession return assertion is replaced by a thread-id assertion
+on the same refusal record. Both prove the refusal at the appropriate entry.
+
+Old layout assertion:
+`assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), ["session"]);`
+
+New layout assertions:
+`assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), []);`
+`assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "session")), true);`
+
+This matches row121: a thread uses its thread-owned store, never a per-run
+session directory. The failed persona build still writes no bundle files.
+Exact diff: old-persona-test.diff.
+
+## Other existing-test adaptations disclosed with it
+
+- bus creative.test setup now explicitly chooses assistant, creates Bean and
+  Quill threads, and binds those runs with their own thread ids. The existing
+  human `message.send {to:who}` input becomes `thread.send {thread:threads[who]}`.
+  All original M6 decision, messaging refusal and message-count assertions
+  remain unchanged. This lets those same restrictions run on the now-threaded
+  creative roles; direct human messages are correctly thread-required.
+- webui chat-browser.test fixture adds /api/chat/instances metadata. Its old
+  expected create body `{project:P,name:'named thread'}` becomes
+  `{project:P,name:'named thread',instance:'assistant'}` because the one-choice
+  picker explicitly sends its preselected instance (Dewey U2). Every other
+  existing assertion remains. The additional expected key strengthens the
+  forwarding check and matches the requested UI behavior.
+
+Please approve these adaptations before their results count. The builder
+continues static packet preparation only until Sage's test CLEAR.

agents/rocko/work/queue-219/base.txt

@@ -0,0 +1 @@
+4a9c536e861f1d9f9a018019b3ac4519d65eccf0

agents/rocko/work/queue-219/build.patch

@@ -0,0 +1,786 @@
+diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
+index d76085739..11061c778 100644
+--- a/packages/bus/src/broker.mjs
++++ b/packages/bus/src/broker.mjs
+@@ -4,7 +4,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
+ import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
+ import { loadRequirements } from '../../tasks/src/requirements.mjs';
+ import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
+-import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
++import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
+ 
+ // Kept closed while S1 lands; its vocabulary is the integration authority.
+ export const ACTIONS = Object.freeze([
+@@ -314,7 +314,7 @@ const enrollBinding = (enroll) => ({
+ });
+ // r6 E3: the installer line's comment, then the tag's 32 hex digits.
+ const INSTALLER_COMMENT = 'mosaic-installer-';
+-// Row 121 (#1615): an instance of THREAD_DEFINITION (vocabulary.mjs since row 155) talks with the
++// Row 121 (#1615): an instance of THREAD_DEFINITIONS (vocabulary.mjs since row 213) talks with the
+ // user in threads. Its runs claim a thread, not the role, and every message to or from it names its
+ // thread (REQ-MSG-1).
+ // Row 146 (#1640): the sender of the bus's notice to launch.by. A role instance name matches the
+@@ -598,7 +598,7 @@ export class Broker {
+     );
+   }
+   #threaded(business, role) {
+-    return this.#business(business).roles[role]?.definition === THREAD_DEFINITION;
++    return THREAD_DEFINITIONS.includes(this.#business(business).roles[role]?.definition);
+   }
+   // Row 264a (#1769): a claim holds one session of a thread, and each session has its own holder.
+   #sessionHolder(session) {
+@@ -6068,24 +6068,27 @@ export class Broker {
+           .all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business)
+           .filter((p) => !s.user || this.#granted(s, 'project.list', p.id, null));
+       }
+-      // A thread belongs to the user who made it and to the business's one thread instance.
++      // A thread belongs to the user who made it and to one declared thread instance.
+       // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
+       case 'thread.create': {
+         if (!s.tester && !s.user) this.#human(s);
+-        keys(a, ['project', 'name'], ['project', 'name']);
++        keys(a, ['project', 'name', 'instance'], ['project', 'name']);
+         if (!name(a.name)) fail('invalid-request');
++        const instances = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
++        const instance = a.instance === undefined
++          ? (instances.length === 1 ? instances[0] : null)
++          : identifier(a.instance);
+         // FED R3 (design 3.5): a user's grant must cover the project and the thread instance, checked
+         // before the project is looked up, so an ungranted id reads the same whether it exists or not.
+         if (s.user) {
+-          const threaded = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
+-          if (threaded.length !== 1 || !this.#granted(s, 'thread.create', identifier(a.project), threaded[0])) fail('access-refused');
++          if (!instance || !instances.includes(instance) || !this.#granted(s, 'thread.create', identifier(a.project), instance))
++            fail('access-refused');
+         }
+         if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', identifier(a.project), s.business))
+           fail('project-not-found');
+-        // The bus never picks between instances; the business file declares exactly one.
+-        const instances = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
+-        if (!instances.length) fail('thread-instance-missing');
+-        if (instances.length > 1) fail('thread-instance-ambiguous');
++        // The human selects an instance; omission is compatible only with one candidate.
++        if (!instances.length || (a.instance !== undefined && !instances.includes(instance))) fail('thread-instance-missing');
++        if (a.instance === undefined && instances.length > 1) fail('thread-instance-ambiguous');
+         if (this.#store.get('SELECT 1 FROM threads WHERE project=? AND name=?', a.project, a.name)) fail('thread-exists');
+         const tid = randomUUID();
+         this.#store.run(
+@@ -6094,13 +6097,13 @@ export class Broker {
+           this.#now(),
+           s.business,
+           a.project,
+-          instances[0],
++          instance,
+           this.#owner(s),
+           a.name,
+         );
+         // Row 264a (#1769, D3): every thread has a default session from the start.
+-        this.#newSession(s, { id: tid, business: s.business, instance: instances[0], owner: this.#owner(s) }, 'default', 'default', true);
+-        return { id: tid, instance: instances[0] };
++        this.#newSession(s, { id: tid, business: s.business, instance, owner: this.#owner(s) }, 'default', 'default', true);
++        return { id: tid, instance };
+       }
+       // Row 177 (#1675): each lists its own threads. The human's list leaves out the tester's,
+       // and the tester's lists only its own (row 175 listed it the business human's).
+diff --git a/packages/bus/tests/creative.test.mjs b/packages/bus/tests/creative.test.mjs
+index 6cfbf1cd6..6d421ba19 100644
+--- a/packages/bus/tests/creative.test.mjs
++++ b/packages/bus/tests/creative.test.mjs
+@@ -44,15 +44,18 @@ function setup(t) {
+   const caps = {};
+   caps.human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+   const project = b.request(caps.human, { verb: 'project.create', args: { name: 'demo' } }).id;
+-  const thread = b.request(caps.human, { verb: 'thread.create', args: { project, name: 'main' } }).id;
++  const thread = b.request(caps.human, { verb: 'thread.create', args: { project, name: 'main', instance: 'assistant' } }).id;
++  const threads = { assistant: thread };
+   for (const role of Object.keys(roles)) {
+-    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi', ...(role === 'assistant' ? { thread } : {}) });
++    if (['bean', 'quill'].includes(role))
++      threads[role] = b.request(caps.human, { verb: 'thread.create', args: { project, name: role, instance: role } }).id;
++    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi', ...(threads[role] ? { thread: threads[role] } : {}) });
+     b.request(caps[role], { verb: 'role.claim' });
+   }
+   caps.tester = b.bindTester({ business: 'demo' });
+   const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+   const count = (sql) => store.get(sql).n;
+-  return { call, count, store };
++  return { call, count, store, threads };
+ }
+ 
+ const raise = { action: 'policy.change', question: 'Change?', options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false };
+@@ -72,7 +75,7 @@ test('M6: a creative raise refuses decision-not-allowed, cited or not, and no de
+ });
+ 
+ test('a creative instance sends only to the user and hears only from the user', (t) => {
+-  const { call, count } = setup(t);
++  const { call, count, threads } = setup(t);
+   for (const who of ['bean', 'quill']) {
+     call(who, 'message.send', { to: 'human', body: 'hello' });
+     for (const to of ['chief', 'assistant', 'pm', 'bean', 'quill'].filter((n) => n !== who)) {
+@@ -81,7 +84,7 @@ test('a creative instance sends only to the user and hears only from the user',
+     for (const from of ['chief', 'pm']) {
+       assert.throws(() => call(from, 'message.send', { to: who, body: 'hello' }), { code: 'message-sender-refused' }, `${from} to ${who}`);
+     }
+-    call('human', 'message.send', { to: who, body: 'hello' });
++    call('human', 'thread.send', { thread: threads[who], body: 'hello' });
+   }
+   assert.equal(count("SELECT count(*) n FROM messages WHERE from_role IN ('bean','quill')"), 2);
+   assert.equal(count("SELECT count(*) n FROM messages WHERE to_role IN ('bean','quill')"), 2);
+diff --git a/packages/bus/tests/threads.test.mjs b/packages/bus/tests/threads.test.mjs
+index 8b31da9f9..1410ec3fa 100644
+--- a/packages/bus/tests/threads.test.mjs
++++ b/packages/bus/tests/threads.test.mjs
+@@ -601,3 +601,42 @@ test('project.create keeps unrelated names with and without a repository', t =>
+     { id: linked.id, name: 'work', repo: 'stack' },
+   ]);
+ });
++
++test('C2-09a: explicit creative instances bind independent threads, default sessions and holders', t => {
++  const creative = ['companion', 'ideas', 'research', 'proofreader', 'fact-checker', 'continuity'];
++  const extra = Object.fromEntries(creative.map((definition, i) => [`writer${i}`, { definition, authority: { withinRole: ['message.send'], crossRole: [] } }]));
++  const ctx = setup(t, demo({ roles: { ...roles, ...extra }, definitions: {
++    ...definitions, ...Object.fromEntries(creative.map(definition => [definition, { messaging: shipped(definition).messaging }])),
++  } }));
++  const project = ctx.call('human', 'project.create', { name: 'Writing' }).id;
++  assert.throws(() => ctx.call('human', 'thread.create', { project, name: 'ambiguous' }), { code: 'thread-instance-ambiguous' });
++  for (const [instance, role] of Object.entries(extra)) {
++    const receipt = ctx.call('human', 'thread.create', { project, name: instance, instance });
++    assert.equal(receipt.instance, instance);
++    assert.equal(ctx.store.get('SELECT instance FROM threads WHERE id=?', receipt.id).instance, instance);
++    assert.equal(ctx.store.get('SELECT instance FROM sessions WHERE thread=?', receipt.id).instance, instance);
++    ctx.launch(instance, instance, { thread: receipt.id });
++    assert.equal(ctx.claim(instance).thread, receipt.id);
++    const sent = ctx.call('human', 'thread.send', { thread: receipt.id, body: `For ${instance}` });
++    const read = ctx.call(instance, 'message.receive');
++    assert.deepEqual(read.map(m => m.id), [sent.id], role.definition);
++    assert.equal(ctx.threadOf(sent.id), receipt.id);
++    assert.equal(ctx.store.get('SELECT count(*) n FROM role_claims WHERE role=?', instance).n, 0);
++    assert.throws(() => ctx.call('human', 'message.send', { to: instance, body: 'No implicit thread' }),
++      { code: 'thread-required-use-thread-send' });
++  }
++  assert.equal(ctx.count('SELECT count(*) n FROM threads'), creative.length);
++});
++
++test('C2-09a: explicit missing, non-thread and malformed selectors create no thread or session', t => {
++  const ctx = setup(t);
++  const project = ctx.call('human', 'project.create', { name: 'Writing' }).id;
++  for (const instance of ['not-declared', 'pm', 'coder'])
++    assert.throws(() => ctx.call('human', 'thread.create', { project, name: instance, instance }), { code: 'thread-instance-missing' });
++  for (const instance of [null, 7, {}, [], '', 'bad name'])
++    assert.throws(() => ctx.call('human', 'thread.create', { project, name: 'bad', instance }), { code: 'invalid-request' });
++  assert.equal(ctx.count('SELECT count(*) n FROM threads'), 0);
++  assert.equal(ctx.count('SELECT count(*) n FROM sessions'), 0);
++  const legacy = ctx.call('human', 'thread.create', { project, name: 'Default' });
++  assert.equal(legacy.instance, 'assistant');
++});
+diff --git a/packages/bus/tests/user-principal.test.mjs b/packages/bus/tests/user-principal.test.mjs
+index 4dcd1ebeb..8471ddf85 100644
+--- a/packages/bus/tests/user-principal.test.mjs
++++ b/packages/bus/tests/user-principal.test.mjs
+@@ -23,7 +23,7 @@ const grant = (over = {}) => ({
+ });
+ 
+ // `processing` stands in for the halt switch, as lifecycle-verbs.test.mjs's T15 does.
+-function setup(t, { grants = [grant()], processing = null } = {}) {
++function setup(t, { grants = [grant()], processing = null, threadRoles = {} } = {}) {
+   const root = mkdtempSync(join(tmpdir(), 'bus-user-principal-'));
+   const store = new Store(root);
+   t.after(() => {
+@@ -40,6 +40,7 @@ function setup(t, { grants = [grant()], processing = null } = {}) {
+         roles: {
+           chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+           assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
++          ...threadRoles,
+         },
+         definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
+       },
+@@ -394,3 +395,21 @@ test('R3 r4: the chief\'s hire refuses an instance named user with the code it g
+ test('R3 r4: a non-function access throws before the store is read', () => {
+   assert.throws(() => new Broker({ store: null, businesses: { demo: {} }, access: 'access.json' }), /access must be a function/);
+ });
++
++test('C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project', t => {
++  const ctx = setup(t, { threadRoles: { bean: { definition: 'companion', authority: { withinRole: ['message.send'], crossRole: [] } } } });
++  const project = ctx.call('human', 'project.create', { name: 'shared' }).id;
++  const privateProject = ctx.call('human', 'project.create', { name: 'private' }).id;
++  ctx.access.doc.grants = [grant({ projects: [project] })];
++  ctx.user('alice');
++  assert.equal(ctx.code('alice', 'thread.create', { project, name: 'blocked bean', instance: 'bean' }), 'access-refused');
++  for (const id of [privateProject, '00000000-0000-4000-8000-000000000000'])
++    assert.equal(ctx.code('alice', 'thread.create', { project: id, name: 'blocked project', instance: 'assistant' }), 'access-refused');
++  assert.equal(ctx.store.get('SELECT count(*) n FROM threads').n, 0);
++  const allowed = ctx.call('alice', 'thread.create', { project, name: 'assistant work', instance: 'assistant' });
++  assert.equal(allowed.instance, 'assistant');
++  ctx.access.doc.grants = [grant({ projects: [project], instances: ['bean'] })];
++  const bean = ctx.call('alice', 'thread.create', { project, name: 'bean work', instance: 'bean' });
++  assert.equal(bean.instance, 'bean');
++  assert.equal(ctx.code('alice', 'thread.create', { project, name: 'old instance', instance: 'assistant' }), 'access-refused');
++});
+diff --git a/packages/cli/src/launcher.mjs b/packages/cli/src/launcher.mjs
+index bfe55b61e..d8248284c 100644
+--- a/packages/cli/src/launcher.mjs
++++ b/packages/cli/src/launcher.mjs
+@@ -53,7 +53,7 @@
+ // session.json names it as gitSocket.
+ //
+ // Thread sessions (row 121, #1615). A thread instance (an instance whose
+-// role definition is the assistant) runs once per thread, never on its own:
++// role definition is in THREAD_DEFINITIONS) runs once per thread, never on its own:
+ // a launch from a session or --pm refuses thread-required. Every tick
+ // (threadTickMs) the host asks the broker for the business's threads
+ // (launch op threadsState) and:
+@@ -139,6 +139,7 @@ import { createServer } from "node:net";
+ import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+ import { dirname, join, relative } from "node:path";
+ import { configDir, loadBusiness, resolveInstance, systemVars } from "../../business/src/index.mjs";
++import { THREAD_DEFINITIONS } from "../../business/src/vocabulary.mjs";
+ import { limitHit } from "../../business/src/launch.mjs";
+ import { BundleError, buildBundle, hasFallback, readSkills, sessionModel } from "../../harness/src/bundle.mjs";
+ import { createLoader } from "../../plugins/src/loader.mjs";
+@@ -176,8 +177,6 @@ const STOP_TIMEOUT_MS = 30000;
+ const LINE_MAX = 4096;
+ // How often the host asks for the threads' state; a poll period, not a limit.
+ const THREAD_TICK_MS = 2000;
+-// The broker's thread instance definition (packages/bus/src/broker.mjs).
+-const THREAD_DEFINITION = "assistant";
+ // Row 194: the broker's LIFECYCLE_REQUEST_MS. A regenerate's old run must be gone by then.
+ const LIFECYCLE_REQUEST_MS = 60000;
+ 
+@@ -331,7 +330,7 @@ export function createLauncher({
+     try { b=loadBusiness(host.business,{dir:configDir(env),rolesDir:rolesDir(env)}); } catch(e){throw new Refusal("organization-refused",e.message);}
+     if (!b.launch) throw new Refusal("launch-not-configured", `business ${b.id} has no launch block`);
+     if (!(pm ? instance === b.launch.by : b.launch.instances.includes(instance) || (human && Object.hasOwn(b.roles, instance)))) throw new Refusal("instance-not-listed");
+-    const threaded = b.roles[instance]?.definition === THREAD_DEFINITION;
++    const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);
+     if (threaded && !thread) throw new Refusal("thread-required", `${instance} runs only for a thread`);
+     if (!threaded && thread) throw new Refusal("thread-not-allowed", `${instance} isn't a thread instance`);
+     if (threaded && !session) throw new Refusal("session-required", `${instance} runs for one session of a thread`);
+@@ -997,7 +996,7 @@ export function createLauncher({
+   function ending(r) {
+     const runs = r.runs ?? [];
+     const at = Date.parse(r.at);
+-    const threaded = b.roles[r.instance]?.definition === THREAD_DEFINITION;
++    const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);
+     return registry.sessions.filter((s) => s.business === b.id && (runs.includes(s.run) ||
+       (!threaded && s.instance === r.instance && (spawnedAt.get(s.run) ?? Date.parse(s.startedAt)) <= at)));
+   }
+diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
+index 2202c7753..baabd843e 100644
+--- a/packages/cli/tests/launcher.test.mjs
++++ b/packages/cli/tests/launcher.test.mjs
+@@ -773,21 +773,34 @@ test("row 213 a creative instance's persona is read from <configDir>/personas: o
+   const dir = join(given.root, "config", "personas", "acme");
+   mkdirSync(dir, { recursive: true, mode: 0o700 });
+   writeFileSync(join(dir, "bean.md"), "Not the pinned text.\n", { mode: 0o600 });
+-  const { f, host, launcher } = await setup(t, undefined, given);
+-  // The chief of staff holds role.launch; a test chief session bound to this process asks.
+-  const chief = await host.bindLaunch({ business: "acme", role: "chief", run: "chief-test", harness: "pi", pid: process.pid, startTime: startTimeOf(process.pid) });
+-  await new Client({ path: host.path, cap: chief.cap }).call("role.claim");
+-  // The bundle's refusal comes back as launch-failed, as webPlan's does, with its reason in the log.
+-  assert.deepEqual(await launcher.fromSession(chief.cap, "bean"), { ok: false, error: "launch-failed" });
+-  const [e] = log(f);
+-  assert.deepEqual([e.event, e.code, log(f).length], ["refused", "launch-failed", 1]);
++  // Row 219: creative instances launch from their thread, not from a chief's standalone request.
++  // The mismatch occurs before bindLaunch, so only the host's thread-state snapshot is a fixture.
++  const thread = 'persona-thread';
++  const SESSION = 'persona-session';
++  const { f, launcher } = await setup(t, undefined, given, { wrap: host => ({
++    ...host,
++    op: message => message.op === 'threadsState'
++      ? Promise.resolve([{ thread, session: SESSION, instance: 'bean', holder: null, pending: 1 }])
++      : host.op(message),
++  }) });
++  // The thread path records row 270's run-start count before the bundle's persona refusal.
++  await launcher.tick();
++  const runs = readdirSync(join(f.dataRoot, "launches", "acme"));
++  const entries = log(f);
++  assert.equal(entries.length, 2);
++  const { at, ...compactions } = entries[0];
++  assert.deepEqual(compactions, { event: 'compactions', instance: 'bean', thread, session: SESSION, run: runs[0], count: 0, known: true, reason: null });
++  const e = entries[1];
++  assert.deepEqual([e.event, e.code], ["refused", "launch-failed"]);
++  assert.equal(e.thread, thread);
+   assert.equal(e.why, `instance bean: persona file ${join(dir, "bean.md")} isn't the file persona.sha256 names`);
+   assert.ok(!JSON.stringify(log(f)).includes("PERSONA-MARKER-d2"));
+   assert.deepEqual(readSessions(f.dataRoot), []);
+   // The run directory exists by then (BUILD.md residual); the persona is read before any bundle file.
+-  const runs = readdirSync(join(f.dataRoot, "launches", "acme"));
+   assert.equal(runs.length, 1);
+-  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), ["session"]);
++  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), []);
++  assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "sessions", SESSION, "session")), true);
++  assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "session")), false);
+ });
+ 
+ test("row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts", { timeout: 30000 }, async (t) => {
+diff --git a/packages/cli/tests/thread-launch.test.mjs b/packages/cli/tests/thread-launch.test.mjs
+index 0d207a0a0..84f8ed088 100644
+--- a/packages/cli/tests/thread-launch.test.mjs
++++ b/packages/cli/tests/thread-launch.test.mjs
+@@ -396,6 +396,22 @@ test("REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a t
+   assert.deepEqual(launchLog(f).map((e) => [e.event, e.instance, e.code]), [["refused", "assistant", "thread-required"]]);
+ });
+ 
++// Admission refuses before bundle construction or a sandbox is needed.
++test('C2-09a: fromSession refuses a creative instance outside a thread without a sandbox', { timeout: 30000 }, async t => {
++  const prepared = prepare(t, { edit: doc => {
++    doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
++    doc.launch.instances.push('bean');
++    return doc;
++  } });
++  const { f } = prepared;
++  const host = await start(t, prepared);
++  const chief = await host.host.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-bean-refusal', harness: 'pi', pid: process.pid, startTime: startTimeOf(process.pid) });
++  await new Client({ path: host.host.path, cap: chief.cap }).call('role.claim');
++  assert.deepEqual(await host.launcher.fromSession(chief.cap, 'bean'), { ok: false, error: 'thread-required' });
++  assert.deepEqual(readSessions(f.dataRoot), []);
++  assert.deepEqual(launchLog(f).map(e => [e.event, e.instance, e.code]), [['refused', 'bean', 'thread-required']]);
++});
++
+ // Row 125 (#1619, REQ-LIMIT-3, REQ-LIMIT-4): the token-limit check switched on, with the
+ // assistant's limit at 0, so it is at its limit before any turn. The real check runs through the
+ // bus's plug-in loader.
+@@ -443,3 +459,71 @@ test("REQ-LIMIT-4 a thread run at its token limit stops at the end of its turn:
+   assert.deepEqual(threadRuns(f, A), []);
+   assert.equal(host.runtime.threadsState("acme").find((x) => x.thread === A).holder, null);
+ });
++
++test('C2-09a: creative thread messages start distinct runs and keep each instance history separate', { skip, timeout: 90000 }, async t => {
++  const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
++    const vars = { ...doc.roles.assistant.vars };
++    delete doc.roles.assistant;
++    doc.roles.bean = { definition: 'companion', vars: { ...vars } };
++    doc.roles.chet = { definition: 'continuity', vars: { ...vars } };
++    doc.launch.instances = ['coder', 'bean', 'chet'];
++    return doc;
++  } });
++  const host = await start(t, prepared), { f } = prepared;
++  const project = host.call('project.create', { name: 'Writing' }).id;
++  const bean = host.call('thread.create', { project, name: 'Bean', instance: 'bean' }).id;
++  const chet = host.call('thread.create', { project, name: 'Chet', instance: 'chet' }).id;
++  const send = async (thread, instance, body) => {
++    const message = host.call('thread.send', { thread, body });
++    const outcome = await until(() => host.call('thread.messages', { thread }).find(m => m.in_reply_to === message.id) ||
++      launchLog(f).find(row => row.thread === thread && row.event === 'refused'));
++    assert.notEqual(outcome.event, 'refused', `creative thread launch refused: ${outcome.code}`);
++    const reply = outcome;
++    assert.equal(reply.from_role, instance);
++    assert.equal(reply.to_role, 'human');
++    return JSON.parse(reply.body.match(/THREAD (\{.*\})/)[1]);
++  };
++  assert.deepEqual((await send(bean, 'bean', 'Bean input')).before, []);
++  assert.deepEqual((await send(chet, 'chet', 'Chet input')).before, []);
++  assert.deepEqual((await send(bean, 'bean', 'Bean again')).before, ['Bean input']);
++  assert.equal(readFileSync(join(f.dataRoot, 'threads', 'acme', bean, 'session', 'history'), 'utf8'), 'Bean input\nBean again\n');
++  assert.equal(readFileSync(join(f.dataRoot, 'threads', 'acme', chet, 'session', 'history'), 'utf8'), 'Chet input\n');
++  const launches = launchLog(f).filter(row => row.event === 'launch');
++  assert.ok(launches.some(row => row.instance === 'bean' && row.thread === bean));
++  assert.ok(launches.some(row => row.instance === 'chet' && row.thread === chet));
++  const chief = await host.host.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-creative-test', harness: 'pi', pid: process.pid, startTime: startTimeOf(process.pid) });
++  await new Client({ path: host.host.path, cap: chief.cap }).call('role.claim');
++  assert.deepEqual(await host.launcher.fromSession(chief.cap, 'bean'), { ok: false, error: 'thread-required' });
++});
++
++test('C2-09a: terminating one creative thread does not signal an unselected peer of the same instance', { skip, timeout: 90000 }, async t => {
++  const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
++    doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
++    delete doc.roles.assistant;
++    doc.launch.instances = ['coder', 'bean'];
++    return doc;
++  } });
++  let requests = [];
++  const host = await start(t, prepared, { ops: () => ({
++    lifecycleRequests: () => requests,
++    lifecycleTake: () => ({ ...requests[0], go: true }),
++    lifecycleDone: () => { requests = []; return {}; },
++  }) });
++  const { f } = prepared;
++  const project = host.call('project.create', { name: 'Writing' }).id;
++  const threads = ['one', 'two'].map(name => host.call('thread.create', { project, name, instance: 'bean' }).id);
++  for (const thread of threads) {
++    const message = host.call('thread.send', { thread, body: 'Stay in this thread' });
++    const outcome = await until(() => host.call('thread.messages', { thread }).find(row => row.in_reply_to === message.id) ||
++      launchLog(f).find(row => row.thread === thread && row.event === 'refused'));
++    assert.notEqual(outcome.event, 'refused', `creative thread launch refused: ${outcome.code}`);
++  }
++  const runs = threads.map(thread => launchLog(f).find(row => row.thread === thread && row.event === 'launch').run);
++  requests = [{ request: 'one-thread-end', state: 'open', business: 'acme', action: 'lifecycle.end',
++    instance: 'bean', runs: [runs[0]], by: f.doc.human, at: new Date(Date.now() + 1000).toISOString() }];
++  await host.launcher.tick();
++  await until(() => launchLog(f).some(row => row.event === 'lifecycle-end' && row.run === runs[0]));
++  assert.deepEqual(launchLog(f).filter(row => row.event === 'lifecycle-end').map(row => row.run), [runs[0]]);
++  await until(() => !readSessions(f.dataRoot).some(row => row.run === runs[0]));
++  assert.ok(readSessions(f.dataRoot).some(row => row.run === runs[1]));
++});
+diff --git a/packages/webui/src/chat-http.mjs b/packages/webui/src/chat-http.mjs
+index c7770726d..396b42f3c 100644
+--- a/packages/webui/src/chat-http.mjs
++++ b/packages/webui/src/chat-http.mjs
+@@ -78,7 +78,8 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
+             (Object.hasOwn(v, 'repo') && (typeof v.repo !== 'string' || !KEY.test(v.repo)))) throw Error();
+         action = 'createProject'; args = v;
+       } else if (path === '/api/chat/threads') {
+-        if (!exact(v, ['project', 'name']) || !id(v.project) || !name(v.name)) throw Error();
++        if (!exact(v, ['project', 'name', 'instance'], ['project', 'name']) || !id(v.project) || !name(v.name) ||
++            (Object.hasOwn(v, 'instance') && (typeof v.instance !== 'string' || !KEY.test(v.instance)))) throw Error();
+         action = 'createThread'; args = v;
+       } else if (match?.[2] === 'messages') {
+         if (!exact(v, ['body']) || typeof v.body !== 'string' || !v.body.trim() || v.body.length > 32768) throw Error();
+diff --git a/packages/webui/src/chat.mjs b/packages/webui/src/chat.mjs
+index 018574ad4..65b89dab3 100644
+--- a/packages/webui/src/chat.mjs
++++ b/packages/webui/src/chat.mjs
+@@ -20,7 +20,7 @@ export function createChat({ call }) {
+     projects: () => channel('project.list', {}),
+     createProject: ({ name, repo }) => channel('project.create', { name, ...(repo === undefined ? {} : { repo }) }),
+     threads: ({ project } = {}) => channel('thread.list', project === undefined ? {} : { project }),
+-    createThread: ({ project, name }) => channel('thread.create', { project, name }),
++    createThread: ({ project, name, instance }) => channel('thread.create', { project, name, ...(instance === undefined ? {} : { instance }) }),
+     messages: ({ thread, after, limit }) => channel('thread.messages', { thread, ...(after ? { after } : {}), limit }),
+     send: ({ thread, body }) => channel('thread.send', { thread, body, class: 'REQUEST' }),
+     open: ({ thread }) => channel('thread.open', { thread }),
+diff --git a/packages/webui/src/public/chat.js b/packages/webui/src/public/chat.js
+index a6b805c1b..15066bdc6 100644
+--- a/packages/webui/src/public/chat.js
++++ b/packages/webui/src/public/chat.js
+@@ -14,7 +14,7 @@
+     return states.get(id);
+   };
+   const form = key => {
+-    if (!forms.has(key)) forms.set(key, { name: '', repo: '', receipt: '', pending: false });
++    if (!forms.has(key)) forms.set(key, { name: '', repo: '', instance: '', instanceChosen: false, receipt: '', pending: false });
+     return forms.get(key);
+   };
+   class ChatError extends Error {
+@@ -58,7 +58,11 @@
+   function creation(kind, key) {
+     const f = form(key), project = kind === 'project';
+     const repo = project && current.repos.length ? `<label>Repository (optional)<select id="chat-repo" data-chat-field="repo"><option value="">No repository link</option>${current.repos.map(r => `<option value="${esc(r)}"${r === f.repo ? ' selected' : ''}>${txt(r)}</option>`).join('')}</select></label>` : '';
+-    return `<form id="chat-${kind}-form" class="chat-create" data-key="${esc(key)}"><h2>New ${kind}</h2><label>Name<input id="chat-${kind}-name" data-chat-field="name" value="${esc(f.name)}" maxlength="200" required${disabled(f.pending)}></label>${repo}<button class="btn" type="submit"${disabled(f.pending)}>${f.pending ? 'Creating…' : `Create ${kind}`}</button><p role="status">${txt(f.receipt)}</p></form>`;
++    const choices = current.instances ?? [];
++    const picker = project ? '' : `<label>Thread with<select id="chat-instance" data-chat-field="instance" required${disabled(f.pending || !!current.instanceError || !choices.length)}><option value="">Choose who this thread is with</option>${choices.map(row => `<option value="${esc(row.instance)}"${row.instance === f.instance ? ' selected' : ''}>${txt(row.name === row.instance ? row.instance : `${row.name} (${row.instance})`)}</option>`).join('')}</select></label>`;
++    const unavailable = !project && (!!current.instanceError || !choices.some(row => row.instance === f.instance));
++    const status = !project && current.instanceError ? current.instanceError : f.receipt || (!project && !choices.length ? 'No thread instances are configured.' : '');
++    return `<form id="chat-${kind}-form" class="chat-create" data-key="${esc(key)}"><h2>New ${kind}</h2><label>Name<input id="chat-${kind}-name" data-chat-field="name" value="${esc(f.name)}" maxlength="200" required${disabled(f.pending)}></label>${repo}${picker}<button class="btn" type="submit"${disabled(f.pending || unavailable)}>${f.pending ? 'Creating…' : `Create ${kind}`}</button><p role="status">${txt(status)}</p></form>`;
+   }
+   function threads(rows) {
+     return rows.length ? `<ul class="chat-thread-list">${rows.map(t => `<li>${link('threads', t.id, t.name)} <span class="muted">${txt(t.instance)}</span></li>`).join('')}</ul>` : '<p>No threads yet.</p>';
+@@ -106,7 +110,7 @@
+       const f = document.getElementById(keep.field.id);
+       if (f && !f.disabled) {
+         f.focus({ preventScroll: true });
+-        if (keep.field.start !== null) f.setSelectionRange(keep.field.start, keep.field.end);
++        if (keep.field.start != null && typeof f.setSelectionRange === 'function') f.setSelectionRange(keep.field.start, keep.field.end);
+       }
+     } else if (navigated) c.container.querySelector('h1')?.focus({ preventScroll: true });
+   }
+@@ -126,7 +130,7 @@
+       paint(); return;
+     }
+     const old = current;
+-    current = { container, kind, id, canSend, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], error: '', refused: false };
++    current = { container, kind, id, canSend, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], instances: old?.instances ?? [], instanceError: kind === 'project' ? 'Reading thread instances…' : '', error: '', refused: false };
+     if (navigated || !old) container.innerHTML = '<p class="chat-loading" role="status">Reading chat…</p>';
+     try {
+       const s = kind === 'thread' ? state(id) : null;
+@@ -147,6 +151,25 @@
+           s.receipt = 'Message shown in this conversation.'; s.receiptId = null;
+         }
+       }
++      if (kind === 'project') {
++        try {
++          const listed = await request('instances', undefined, signal);
++          if (g !== generation || out()) return;
++          if (!listed.rows.every(row => typeof row?.instance === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(row.instance) && typeof row.name === 'string'))
++            throw new ChatError('invalid-response');
++          current.instances = listed.rows; current.instanceError = '';
++          const f = form(id);
++          if (f.instance && !listed.rows.some(row => row.instance === f.instance)) {
++            f.instance = ''; f.instanceChosen = true;
++            f.receipt = 'The selected instance is no longer available. Choose who this thread is with.';
++          }
++          if (!f.instanceChosen && !f.instance && listed.rows.length === 1) f.instance = listed.rows[0].instance;
++        } catch (err) {
++          if (err.name === 'AbortError' || out() || g !== generation) return;
++          current.instances = [];
++          current.instanceError = "Couldn't read the thread instances; reload to try again";
++        }
++      }
+       // Repository choices are optional metadata; an unavailable read must not block unlinked chat.
+       if (kind === 'list') {
+         try {
+@@ -179,7 +202,11 @@
+     if (!current || out()) return;
+     if (event.target.id === 'chat-body') state(current.id).draft = event.target.value;
+     const f = event.target.closest('.chat-create');
+-    if (f && event.target.dataset.chatField) form(f.dataset.key)[event.target.dataset.chatField] = event.target.value;
++    if (f && event.target.dataset.chatField) {
++      const draft = form(f.dataset.key), field = event.target.dataset.chatField;
++      draft[field] = event.target.value;
++      if (field === 'instance') { draft.instanceChosen = true; draft.receipt = ''; paint(); }
++    }
+   });
+   document.addEventListener('scroll', event => {
+     if (event.target.matches?.('.chat-log') && current?.kind === 'thread') {
+@@ -232,7 +259,8 @@
+       void write('send', id, { body: state(id).draft }, `threads/${id}/messages`);
+     } else if (event.target.classList.contains('chat-create')) {
+       const key = event.target.dataset.key, f = form(key), project = key === 'projects';
+-      const value = project ? { name: f.name, ...(f.repo ? { repo: f.repo } : {}) } : { project: key, name: f.name };
++      if (!project && (current.instanceError || !(current.instances ?? []).some(row => row.instance === f.instance))) return;
++      const value = project ? { name: f.name, ...(f.repo ? { repo: f.repo } : {}) } : { project: key, name: f.name, instance: f.instance };
+       void write(project ? 'createProject' : 'createThread', key, value, project ? 'projects' : 'threads');
+     }
+   });
+diff --git a/packages/webui/src/serve.mjs b/packages/webui/src/serve.mjs
+index 288871d0c..d9d27a062 100644
+--- a/packages/webui/src/serve.mjs
++++ b/packages/webui/src/serve.mjs
+@@ -8,6 +8,7 @@ import { BusReadError, busStatus as coreBusStatus, subjectOk, sendOutcome } from
+ // Row 176, sage-1111: HTTP-only tester refusals; the row-164 transport pin stays untouched.
+ const busStatus = code => ['tester-off', 'tester-required'].includes(code) ? 403 : coreBusStatus(code);
+ import { ReadError, readStatus, fieldTable } from './reads.mjs';
++import { THREAD_DEFINITIONS } from '../../business/src/vocabulary.mjs';
+ import { chatHTTP } from './chat-http.mjs';
+ import { processingHTTP } from './processing-http.mjs';
+ 
+@@ -705,6 +706,25 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
+       if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
+       return busSend(req, res, { send, preview: signer, log });
+     }
++    // Row 219: labels only, from this listener's own human or tester bus, after auth above.
++    if (path === '/api/chat/instances') {
++      if (req.method !== 'GET') return json(res, 405, { error: 'method-not-allowed' });
++      if (search) return json(res, 400, { error: 'invalid-request' });
++      if (!bus?.instances) return json(res, 503, { error: 'not-configured' });
++      try {
++        const value = await bus.instances();
++        if (!value || !value.instances || typeof value.instances !== 'object' || Array.isArray(value.instances))
++          throw new BusReadError('invalid-response');
++        const rows = Object.entries(value.instances)
++          .filter(([, entry]) => THREAD_DEFINITIONS.includes(entry?.definition))
++          .map(([instance, entry]) => ({ instance, name: entry.vars?.['persona.name'] || instance }));
++        if (rows.some(row => typeof row.name !== 'string')) throw new BusReadError('invalid-response');
++        return json(res, 200, { rows, at: new Date().toISOString() });
++      } catch (err) {
++        const code = err instanceof BusReadError ? err.code : 'invalid-response';
++        return json(res, busStatus(code), { error: code });
++      }
++    }
+     if (path === '/api/chat' || path.startsWith('/api/chat/')) {
+       return chatHTTP(req, res, { path, search, chat, named, send, preview: writer, log });
+     }
+diff --git a/packages/webui/tests/chat-browser.test.mjs b/packages/webui/tests/chat-browser.test.mjs
+index f3eeeca96..cc3ec093d 100644
+--- a/packages/webui/tests/chat-browser.test.mjs
++++ b/packages/webui/tests/chat-browser.test.mjs
+@@ -12,6 +12,7 @@ const HOSTILE = '<img src=x onerror="window.injected=1">\u001b[31m\u202eevil';
+ const stub = `(() => {
+   const real = fetch.bind(window);
+   window.__writes=[];window.__reads=[];window.__answers=[];window.__pages=[];
++  window.__instances=[{instance:'assistant',name:'assistant'}];
+   window.__projects=[{id:'${P}', name:${JSON.stringify(HOSTILE)}, repo:null},{id:'\"><img src=x>',name:'Invalid record'}];
+   window.__threads=[{id:'${A}',project:'${P}',name:'alpha',instance:'assistant'}, {id:'${B}',project:'${P}',name:'beta',instance:'assistant'}];
+   window.fetch=async (url,init={})=>{
+@@ -33,6 +34,7 @@ const stub = `(() => {
+     window.__reads.push(path);
+     if(window.__holdRead && path.includes(window.__holdRead)){window.__heldSignal=init.signal;await new Promise(r=>window.__releaseRead=r);}
+     if(window.__readFailure)return new Response(JSON.stringify({error:window.__readFailure}),{status:window.__readFailure==='thread-not-owned'?403:503});
++    if(path==='/api/chat/instances')return window.__instanceFailure ? new Response(JSON.stringify({error:'not-configured'}),{status:503}) : data({rows:window.__instances});
+     if(path==='/api/chat/projects')return data({rows:window.__projects});
+     if(path.startsWith('/api/chat/threads')&&!path.includes('/messages'))return data({rows:window.__threads});
+     if(window.__pages.length)return data(window.__pages.shift());
+@@ -82,7 +84,7 @@ test('chat browser: list/create named projects and threads, hostile labels inert
+   await b.evaluate(`window.__answers.push({body:{id:'${A}',instance:'assistant'}}),true`);
+   await click('#chat-thread-form button[type=submit]');
+   await wait('document.querySelector("#chat-send-form")');
+-  assert.deepEqual(await b.evaluate('window.__writes[1].body'), { project: P, name: 'named thread' });
++  assert.deepEqual(await b.evaluate('window.__writes[1].body'), { project: P, name: 'named thread', instance: 'assistant' });
+   assert.equal(await b.evaluate('window.__writes[1].path'), '/api/chat/threads');
+   assert.equal(await b.evaluate('window.__writes.length'), 2);
+ });
+@@ -264,3 +266,65 @@ test('chat browser: a late project creation receipt cannot navigate away from an
+   assert.equal(await b.evaluate('location.hash'), '#/chat/threads/' + A);
+   assert.equal(await b.evaluate('document.querySelector("#chat-body").value'), 'stay in alpha');
+ });
++
++test('C2-09a picker: no silent choice, duplicate hostile labels stay inert, selection survives refresh and reaches POST', async t => {
++  const { b, wait, set, click, refresh } = await setup(t);
++  await b.evaluate(`window.__instances=[{instance:'bean',name:${JSON.stringify(HOSTILE)}},{instance:'chet',name:${JSON.stringify(HOSTILE)}}];location.hash='#/chat/projects/${P}';true`);
++  await wait('document.querySelectorAll("#chat-instance option").length===3');
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '');
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").required'), true);
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
++  const labels = await b.evaluate('[...document.querySelectorAll("#chat-instance option")].map(o=>o.textContent)');
++  assert.match(labels[1], /\(bean\)/);
++  assert.match(labels[2], /\(chet\)/);
++  assert.doesNotMatch(labels.join(''), /[\u202a-\u202e\u2066-\u2069]/u);
++  assert.equal(await b.evaluate('!!document.querySelector("#chat-thread-form img")'), false);
++  assert.equal(await b.evaluate('window.injected'), undefined);
++  await set('#chat-thread-name', 'Bean discussion');
++  await click('#chat-thread-form button');
++  assert.equal(await b.evaluate('window.__writes.length'), 0);
++  await set('#chat-instance', 'bean');
++  await refresh();
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), 'bean');
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-name").value'), 'Bean discussion');
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), false);
++  await b.evaluate(`window.__answers.push({body:{id:'${A}',instance:'bean'}});true`);
++  await click('#chat-thread-form button');
++  await wait('window.__writes.length===1');
++  assert.deepEqual(await b.evaluate('window.__writes[0]'), { path: '/api/chat/threads', body: { project: P, name: 'Bean discussion', instance: 'bean' }, redirect: 'manual' });
++});
++
++test('C2-09a picker: metadata failure, empty set and removed pick explain disabled state and recover without switching', async t => {
++  const { b, wait, set, refresh } = await setup(t);
++  await b.evaluate(`window.__instanceFailure=true;location.hash='#/chat/projects/${P}';true`);
++  await wait('document.querySelector("#chat-thread-form") && !document.querySelector(".chat-loading")');
++  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /read the thread instances/);
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
++  await b.evaluate('window.__instanceFailure=false;window.__instances=[];true');
++  await refresh();
++  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /No thread instances/);
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
++  await b.evaluate("window.__instances=[{instance:'bean',name:'Bean'},{instance:'chet',name:'Chet'}];true");
++  await refresh();
++  await set('#chat-instance', 'bean');
++  await b.evaluate("window.__instances=[{instance:'chet',name:'Chet'}];true");
++  await refresh();
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '');
++  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /no longer available/);
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
++  await refresh();
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '', 'another refresh must not silently select the one remaining instance');
++  await set('#chat-instance', 'chet');
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), false);
++});
++
++test('C2-09a picker: a single instance is chosen explicitly but read-only mode cannot create a thread', async t => {
++  const { b, wait } = await setup(t, '?readonly');
++  await b.evaluate(`location.hash='#/chat/projects/${P}';true`);
++  await wait('document.querySelectorAll("#chat-instance option").length===2');
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), 'assistant');
++  assert.equal(await b.evaluate('document.querySelector("#chat-instance").disabled'), true);
++  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
++  assert.match(await b.evaluate('document.querySelector(".chat-area").textContent'), /only reads/);
++  assert.equal(await b.evaluate('window.__writes.length'), 0);
++});
+diff --git a/packages/webui/tests/chat-instances.test.mjs b/packages/webui/tests/chat-instances.test.mjs
+new file mode 100644
+index 000000000..893c38f80
+--- /dev/null
++++ b/packages/webui/tests/chat-instances.test.mjs
+@@ -0,0 +1,87 @@
++import test from 'node:test';
++import assert from 'node:assert/strict';
++import { request } from 'node:http';
++import { mkdtempSync, rmSync } from 'node:fs';
++import { join } from 'node:path';
++import { tmpdir } from 'node:os';
++import { startServer } from '../src/serve.mjs';
++import { startTesterSocket, TESTER_ORIGIN } from '../src/tester-socket.mjs';
++import { close } from './fixture.mjs';
++
++const path = '/api/chat/instances';
++const preview = { host: 'chat.example', header: 'x-user', user: 'jason' };
++const snapshot = {
++  revision: 'a'.repeat(64), plugins: { private: 'do-not-project' },
++  instances: {
++    assistant: { definition: 'assistant', vars: { model: 'private-model' } },
++    bean: { definition: 'companion', vars: { 'persona.name': 'Bean', 'persona.sha256': 'private-hash' } },
++    chet: { definition: 'continuity', vars: { 'persona.name': 'Bean', file: '/private/path' } },
++    pm: { definition: 'pm', vars: { 'persona.name': 'Hidden PM' } },
++  },
++};
++function get(server, { route = path, method = 'GET', headers = {} } = {}) {
++  const address = server.address(), unix = typeof address === 'string';
++  return new Promise((resolve, reject) => {
++    const req = request({ ...(unix ? { socketPath: address } : { host: '127.0.0.1', port: address.port }),
++      path: route, method, headers: { host: unix ? new URL(TESTER_ORIGIN).host : preview.host, ...headers } }, res => {
++      let text = '';
++      res.on('data', chunk => text += chunk);
++      res.on('end', () => resolve({ status: res.statusCode, text, value: JSON.parse(text) }));
++    });
++    req.on('error', reject); req.end();
++  });
++}
++test('C2-09a metadata uses the human listener bus, projects labels only and refuses unauthenticated reads', async t => {
++  let calls = 0;
++  const server = await startServer({ port: 0, preview, bus: { instances: async () => { calls++; return snapshot; } } });
++  t.after(() => close(server));
++  const refused = await get(server);
++  assert.equal(refused.status, 401);
++  assert.equal(calls, 0);
++  const answer = await get(server, { headers: { 'x-user': 'jason' } });
++  assert.equal(answer.status, 200);
++  assert.deepEqual(answer.value.rows, [{ instance: 'assistant', name: 'assistant' }, { instance: 'bean', name: 'Bean' }, { instance: 'chet', name: 'Bean' }]);
++  for (const row of answer.value.rows) assert.deepEqual(Object.keys(row).sort(), ['instance', 'name']);
++  assert.doesNotMatch(answer.text, /private|Hidden PM/);
++  assert.equal(calls, 1);
++  for (const options of [{ route: path + '?extra=1' }, { method: 'POST' }]) {
++    const result = await get(server, { ...options, headers: { 'x-user': 'jason' } });
++    assert.ok([400, 405].includes(result.status));
++  }
++  assert.equal(calls, 1, 'invalid metadata requests never call a bus');
++});
++test('C2-09a metadata uses the private tester listener own bus and no human transport', async t => {
++  const root = mkdtempSync(join(tmpdir(), 'chat219-')); t.after(() => rmSync(root, { recursive: true, force: true }));
++  let reads = 0;
++  const server = await startTesterSocket({ dataRoot: root, board: 'http://127.0.0.1:9',
++    bus: { instances: async () => { reads++; return { instances: { quill: { definition: 'proofreader', vars: { 'persona.name': 'Quill' } } } }; } } });
++  t.after(() => close(server));
++  const answer = await get(server);
++  assert.equal(answer.status, 200);
++  assert.deepEqual(answer.value.rows, [{ instance: 'quill', name: 'Quill' }]);
++  assert.equal(reads, 1);
++});
++test('C2-09a metadata refuses missing or malformed reads and never echoes untrusted fields', async t => {
++  for (const bus of [null, { instances: async () => ({ instances: [] }) }, { instances: async () => { throw new Error('private-path'); } }]) {
++    const server = await startServer({ port: 0, preview, bus }); t.after(() => close(server));
++    const answer = await get(server, { headers: { 'x-user': 'jason' } });
++    assert.ok(answer.status >= 400);
++    assert.doesNotMatch(answer.text, /private-path/);
++  }
++});
++
++test('C2-09a metadata stays behind the SSO session check and a GET never refreshes session activity', async t => {
++  let session = null, reads = 0;
++  const touches = [];
++  const sso = { publicHost: 'sso-chat.example', publicOrigin: 'https://sso-chat.example', formTargets: () => [],
++    session: (_req, { touch }) => { touches.push(touch); return session; } };
++  const server = await startServer({ port: 0, sso, bus: { instances: async () => { reads++; return snapshot; } } });
++  t.after(() => close(server));
++  const headers = { host: sso.publicHost };
++  assert.equal((await get(server, { headers })).status, 401);
++  assert.equal(reads, 0);
++  session = { name: 'jason' };
++  assert.equal((await get(server, { headers })).status, 200);
++  assert.equal(reads, 1);
++  assert.deepEqual(touches, [false, false]);
++});
+diff --git a/packages/webui/tests/chat.test.mjs b/packages/webui/tests/chat.test.mjs
+index 8c11611cf..b47ecf1a7 100644
+--- a/packages/webui/tests/chat.test.mjs
++++ b/packages/webui/tests/chat.test.mjs
+@@ -335,3 +335,21 @@ test('the chat seam names the transport it is given: the human one and the teste
+   assert.throws(() => createChat({}), { name: 'TypeError', message: 'chat needs a bus transport function' });
+   assert.equal(typeof createChat({ call: async () => ({}) }).projects, 'function');
+ });
++
++test('C2-09a createThread forwards an explicit instance through the existing channel', async t => {
++  const c = await setup(t);
++  c.state.answer = { id: T, instance: 'bean' };
++  const answer = await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'Bean work', instance: 'bean' } });
++  assert.equal(answer.status, 200);
++  assert.deepEqual(c.calls, [['thread.create', { project: P, name: 'Bean work', instance: 'bean' }]]);
++  assert.equal(answer.data.instance, 'bean');
++});
++test('C2-09a malformed instance and extra thread fields refuse before the channel write', async t => {
++  const c = await setup(t);
++  for (const value of [null, 7, {}, [], '', 'bad name', 'bean/../../other']) {
++    const answer = await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'work', instance: value } });
++    assert.equal(answer.status, 400, JSON.stringify(value));
++  }
++  assert.equal((await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'work', instance: 'bean', extra: true } })).status, 400);
++  assert.deepEqual(c.calls, []);
++});

agents/rocko/work/queue-219/busy-first.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+import os,json
+busy=[]
+for p in Path('/proc').glob('[0-9]*'):
+ try:
+  if int(p.name)==os.getpid():continue
+  comm=(p/'comm').read_text().strip()
+  if not any(x in comm for x in ['node','python','bash']):continue
+  args=(p/'cmdline').read_bytes().split(b'\0')
+  if (comm.startswith('node') and b'--test' in args) or any(x.rsplit(b'/',1)[-1] in (b'run-mutants.py',b'gate-run.sh') for x in args):
+   busy.append(dict(pid=int(p.name),cwd=str((p/'cwd').resolve()),name=comm))
+ except (PermissionError,FileNotFoundError,ProcessLookupError):pass
+print('BUSY_CHECK',json.dumps(busy))
+raise SystemExit(bool(busy))

agents/rocko/work/queue-219/candidate-manifest.sha256

@@ -0,0 +1,14 @@
+142a210882535108159e045c61be288bc8703910a8ee0169137bc1eb80baff64  packages/bus/src/broker.mjs
+b0c66c8999b567896923f6c876911dba936c6eca1ccc7aaeada51369fd613594  packages/bus/tests/creative.test.mjs
+de4913f50801a11fd172e3f2c2b3cb41ab04e84d32a6650d1c8662b5e227ea3d  packages/bus/tests/threads.test.mjs
+8f7d6745fffb2a0898ac80c012084ac48964748da6439a8c56facc6529ffb19b  packages/bus/tests/user-principal.test.mjs
+b74275ce43249bafc97edc87a6a3aa0431c62fe1a28cd9fa265246e6d6da219b  packages/cli/src/launcher.mjs
+2c3f120dfdc0b52bf8ab38a88e86251be75d4b0d218e23df489dcaf815d6bc15  packages/cli/tests/launcher.test.mjs
+a219036737419870e0aa9d0da20843759a66be5bafff44d3292593833f8fcb9a  packages/cli/tests/thread-launch.test.mjs
+cbfd54e6b375561d1e4679ee8d78a3285f970d9a7198cec9d22a06510a36afba  packages/webui/src/chat-http.mjs
+f49a49c6ec69783190d3f5eaf34316cb4d2c44d10d2ee9336fe1383207afefff  packages/webui/src/chat.mjs
+8e89df5fe8a9da35de41b5968afc6efcd92503e92ef28c6f557bb5371d10d1a4  packages/webui/src/public/chat.js
+a597cc4902a873fe15650dacfce14dbc897db26310a7b6a24c293287add946c8  packages/webui/src/serve.mjs
+d918e5b061ced9db28337a9b02c7042f9ddafaf09f32affce9f51190c0cba93f  packages/webui/tests/chat-browser.test.mjs
+2bad14535372488de326b82b791b79a61e1a4ab839458535132958ef85b746eb  packages/webui/tests/chat-instances.test.mjs
+7779d33d5b1dd3fe183722d0f91ff1f71e741e113cf2d5ee407f3d26428fc162  packages/webui/tests/chat.test.mjs

agents/rocko/work/queue-219/changed-paths.txt

@@ -0,0 +1,14 @@
+packages/bus/src/broker.mjs
+packages/bus/tests/creative.test.mjs
+packages/bus/tests/threads.test.mjs
+packages/bus/tests/user-principal.test.mjs
+packages/cli/src/launcher.mjs
+packages/cli/tests/launcher.test.mjs
+packages/cli/tests/thread-launch.test.mjs
+packages/webui/src/chat-http.mjs
+packages/webui/src/chat.mjs
+packages/webui/src/public/chat.js
+packages/webui/src/serve.mjs
+packages/webui/tests/chat-browser.test.mjs
+packages/webui/tests/chat-instances.test.mjs
+packages/webui/tests/chat.test.mjs

agents/rocko/work/queue-219/mutants.json

@@ -0,0 +1,193 @@
+[
+  {
+    "id": "T01",
+    "file": "packages/bus/src/broker.mjs",
+    "old": "return THREAD_DEFINITIONS.includes(this.#business(business).roles[role]?.definition);",
+    "new": "return this.#business(business).roles[role]?.definition === 'assistant';",
+    "test": "packages/bus/tests/threads.test.mjs",
+    "pattern": "C2-09a: explicit creative"
+  },
+  {
+    "id": "T02",
+    "file": "packages/bus/src/broker.mjs",
+    "old": ": identifier(a.instance);",
+    "new": ": instances[0];",
+    "test": "packages/bus/tests/threads.test.mjs",
+    "pattern": "C2-09a: explicit creative"
+  },
+  {
+    "id": "T03",
+    "file": "packages/bus/src/broker.mjs",
+    "old": "if (!instances.length || (a.instance !== undefined && !instances.includes(instance))) fail('thread-instance-missing');",
+    "new": "if (!instances.length) fail('thread-instance-missing');",
+    "test": "packages/bus/tests/threads.test.mjs",
+    "pattern": "C2-09a: explicit missing"
+  },
+  {
+    "id": "T04",
+    "file": "packages/bus/src/broker.mjs",
+    "old": "if (a.instance === undefined && instances.length > 1) fail('thread-instance-ambiguous');",
+    "new": "if (false) fail('thread-instance-ambiguous');",
+    "test": "packages/bus/tests/threads.test.mjs",
+    "pattern": "C2-09a: explicit creative"
+  },
+  {
+    "id": "T05",
+    "file": "packages/bus/src/broker.mjs",
+    "old": "!this.#granted(s, 'thread.create', identifier(a.project), instance)",
+    "new": "!this.#granted(s, 'thread.create', identifier(a.project), null)",
+    "test": "packages/bus/tests/user-principal.test.mjs",
+    "pattern": "C2-09a: naming an instance"
+  },
+  {
+    "id": "T06",
+    "file": "packages/cli/src/launcher.mjs",
+    "old": "const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);",
+    "new": "const threaded = b.roles[instance]?.definition === \"assistant\";",
+    "test": "packages/cli/tests/thread-launch.test.mjs",
+    "pattern": "C2-09a: creative thread messages"
+  },
+  {
+    "id": "T07",
+    "file": "packages/webui/src/serve.mjs",
+    "old": ".filter(([, entry]) => THREAD_DEFINITIONS.includes(entry?.definition))",
+    "new": ".filter(() => true)",
+    "test": "packages/webui/tests/chat-instances.test.mjs",
+    "pattern": "C2-09a metadata uses the human"
+  },
+  {
+    "id": "T08",
+    "file": "packages/webui/src/serve.mjs",
+    "old": "name: entry.vars?.['persona.name'] || instance",
+    "new": "name: instance",
+    "test": "packages/webui/tests/chat-instances.test.mjs",
+    "pattern": "C2-09a metadata uses the human"
+  },
+  {
+    "id": "T09",
+    "file": "packages/webui/src/chat-http.mjs",
+    "old": "(Object.hasOwn(v, 'instance') && (typeof v.instance !== 'string' || !KEY.test(v.instance)))",
+    "new": "false",
+    "test": "packages/webui/tests/chat.test.mjs",
+    "pattern": "C2-09a malformed instance"
+  },
+  {
+    "id": "T10",
+    "file": "packages/webui/src/chat.mjs",
+    "old": "createThread: ({ project, name, instance }) => channel('thread.create', { project, name, ...(instance === undefined ? {} : { instance }) }),",
+    "new": "createThread: ({ project, name, instance }) => channel('thread.create', { project, name }),",
+    "test": "packages/webui/tests/chat.test.mjs",
+    "pattern": "C2-09a createThread forwards"
+  },
+  {
+    "id": "T11",
+    "file": "packages/webui/src/public/chat.js",
+    "old": ": { project: key, name: f.name, instance: f.instance };",
+    "new": ": { project: key, name: f.name };",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: no silent choice"
+  },
+  {
+    "id": "T12",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "!f.instance && listed.rows.length === 1",
+    "new": "!f.instance && listed.rows.length >= 1",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: no silent choice"
+  },
+  {
+    "id": "T13",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "current.instanceError = \"Couldn't read the thread instances; reload to try again\";",
+    "new": "current.instanceError = '';",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: metadata failure"
+  },
+  {
+    "id": "T14",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "txt(row.name === row.instance ? row.instance : `${row.name} (${row.instance})`)",
+    "new": "txt(row.name)",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: no silent choice"
+  },
+  {
+    "id": "T15",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "if (f.instance && !listed.rows.some(row => row.instance === f.instance)) {",
+    "new": "if (false) {",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: metadata failure"
+  },
+  {
+    "id": "T16",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "f.instance = ''; f.instanceChosen = true;",
+    "new": "f.instance = ''; f.instanceChosen = false;",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: metadata failure"
+  },
+  {
+    "id": "T17",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "const unavailable = !project && (!!current.instanceError || !choices.some(row => row.instance === f.instance));",
+    "new": "const unavailable = false;",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: no silent choice"
+  },
+  {
+    "id": "T18",
+    "file": "packages/webui/src/serve.mjs",
+    "old": "if (req.method !== 'GET') return json(res, 405, { error: 'method-not-allowed' });",
+    "new": "if (false) return json(res, 405, { error: 'method-not-allowed' });",
+    "test": "packages/webui/tests/chat-instances.test.mjs",
+    "pattern": "C2-09a metadata uses the human"
+  },
+  {
+    "id": "T19",
+    "file": "packages/webui/src/serve.mjs",
+    "old": "if (search) return json(res, 400, { error: 'invalid-request' });",
+    "new": "if (false) return json(res, 400, { error: 'invalid-request' });",
+    "test": "packages/webui/tests/chat-instances.test.mjs",
+    "pattern": "C2-09a metadata uses the human"
+  },
+  {
+    "id": "T20",
+    "file": "packages/webui/src/public/chat.js",
+    "old": "current.instances = listed.rows; current.instanceError = '';",
+    "new": "current.instances = listed.rows;",
+    "test": "packages/webui/tests/chat-browser.test.mjs",
+    "pattern": "C2-09a picker: metadata failure"
+  },
+  {
+    "id": "T21",
+    "file": "packages/webui/src/serve.mjs",
+    "old": "({ instance, name: entry.vars?.['persona.name'] || instance })",
+    "new": "({ instance, name: entry.vars?.['persona.name'] || instance, vars: entry.vars })",
+    "test": "packages/webui/tests/chat-instances.test.mjs",
+    "pattern": "C2-09a metadata uses the human"
+  },
+  {
+    "id": "T22",
+    "file": "packages/cli/src/launcher.mjs",
+    "old": "const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);",
+    "new": "const threaded = b.roles[r.instance]?.definition === \"assistant\";",
+    "test": "packages/cli/tests/thread-launch.test.mjs",
+    "pattern": "C2-09a: terminating one creative thread"
+  },
+  {
+    "id": "T23",
+    "file": "packages/cli/src/launcher.mjs",
+    "old": "const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);",
+    "new": "const threaded = b.roles[instance]?.definition === \"assistant\";",
+    "test": "packages/cli/tests/thread-launch.test.mjs",
+    "pattern": "C2-09a: fromSession refuses a creative instance outside a thread without a sandbox",
+    "additional_edits": [
+      {
+        "file": "packages/cli/src/launcher.mjs",
+        "old": "const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);",
+        "new": "const threaded = b.roles[r.instance]?.definition === \"assistant\";"
+      }
+    ]
+  }
+]

agents/rocko/work/queue-219/old-persona-test.diff

@@ -0,0 +1,40 @@
+diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
+index 2202c7753..0a34fe27a 100644
+--- a/packages/cli/tests/launcher.test.mjs
++++ b/packages/cli/tests/launcher.test.mjs
+@@ -773,21 +773,28 @@ test("row 213 a creative instance's persona is read from <configDir>/personas: o
+   const dir = join(given.root, "config", "personas", "acme");
+   mkdirSync(dir, { recursive: true, mode: 0o700 });
+   writeFileSync(join(dir, "bean.md"), "Not the pinned text.\n", { mode: 0o600 });
+-  const { f, host, launcher } = await setup(t, undefined, given);
+-  // The chief of staff holds role.launch; a test chief session bound to this process asks.
+-  const chief = await host.bindLaunch({ business: "acme", role: "chief", run: "chief-test", harness: "pi", pid: process.pid, startTime: startTimeOf(process.pid) });
+-  await new Client({ path: host.path, cap: chief.cap }).call("role.claim");
+-  // The bundle's refusal comes back as launch-failed, as webPlan's does, with its reason in the log.
+-  assert.deepEqual(await launcher.fromSession(chief.cap, "bean"), { ok: false, error: "launch-failed" });
++  // Row 219: creative instances launch from their thread, not from a chief's standalone request.
++  // The mismatch occurs before bindLaunch, so only the host's thread-state snapshot is a fixture.
++  const thread = 'persona-thread';
++  const { f, launcher } = await setup(t, undefined, given, { wrap: host => ({
++    ...host,
++    op: message => message.op === 'threadsState'
++      ? Promise.resolve([{ thread, instance: 'bean', holder: null, pending: 1 }])
++      : host.op(message),
++  }) });
++  // The bundle's refusal remains launch-failed with the persona mismatch as its reason.
++  await launcher.tick();
+   const [e] = log(f);
+   assert.deepEqual([e.event, e.code, log(f).length], ["refused", "launch-failed", 1]);
++  assert.equal(e.thread, thread);
+   assert.equal(e.why, `instance bean: persona file ${join(dir, "bean.md")} isn't the file persona.sha256 names`);
+   assert.ok(!JSON.stringify(log(f)).includes("PERSONA-MARKER-d2"));
+   assert.deepEqual(readSessions(f.dataRoot), []);
+   // The run directory exists by then (BUILD.md residual); the persona is read before any bundle file.
+   const runs = readdirSync(join(f.dataRoot, "launches", "acme"));
+   assert.equal(runs.length, 1);
+-  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), ["session"]);
++  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), []);
++  assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "session")), true);
+ });
+ 
+ test("row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts", { timeout: 30000 }, async (t) => {

agents/rocko/work/queue-219/prepare-mutants.py

@@ -0,0 +1,39 @@
+"""Static preparation only. Executing tests requires Sage CLEAR."""
+from pathlib import Path
+import json
+root=Path(__file__).resolve().parents[4]
+p=Path(__file__).resolve().parent
+specs=[]
+def site(id,file,old,new,test,pattern):
+ text=(root/file).read_text();assert text.count(old)==1,(id,text.count(old))
+ specs.append(dict(id=id,file=file,old=old,new=new,test=test,pattern=pattern))
+bus='packages/bus/src/broker.mjs';bt='packages/bus/tests/threads.test.mjs';cli='packages/cli/src/launcher.mjs';ct='packages/cli/tests/thread-launch.test.mjs';web='packages/webui/src/serve.mjs';wt='packages/webui/tests/chat-instances.test.mjs';browser='packages/webui/src/public/chat.js';brtest='packages/webui/tests/chat-browser.test.mjs'
+site('T01',bus,'return THREAD_DEFINITIONS.includes(this.#business(business).roles[role]?.definition);',"return this.#business(business).roles[role]?.definition === 'assistant';",bt,'C2-09a: explicit creative')
+site('T02',bus,': identifier(a.instance);',': instances[0];',bt,'C2-09a: explicit creative')
+site('T03',bus,"if (!instances.length || (a.instance !== undefined && !instances.includes(instance))) fail('thread-instance-missing');","if (!instances.length) fail('thread-instance-missing');",bt,'C2-09a: explicit missing')
+site('T04',bus,"if (a.instance === undefined && instances.length > 1) fail('thread-instance-ambiguous');","if (false) fail('thread-instance-ambiguous');",bt,'C2-09a: explicit creative')
+site('T05',bus,"!this.#granted(s, 'thread.create', identifier(a.project), instance)","!this.#granted(s, 'thread.create', identifier(a.project), null)",'packages/bus/tests/user-principal.test.mjs','C2-09a: naming an instance')
+site('T06',cli,'const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);','const threaded = b.roles[instance]?.definition === "assistant";',ct,'C2-09a: creative thread messages')
+site('T07',web,'.filter(([, entry]) => THREAD_DEFINITIONS.includes(entry?.definition))','.filter(() => true)',wt,'C2-09a metadata uses the human')
+site('T08',web,"name: entry.vars?.['persona.name'] || instance",'name: instance',wt,'C2-09a metadata uses the human')
+site('T09','packages/webui/src/chat-http.mjs',"(Object.hasOwn(v, 'instance') && (typeof v.instance !== 'string' || !KEY.test(v.instance)))",'false','packages/webui/tests/chat.test.mjs','C2-09a malformed instance')
+site('T10','packages/webui/src/chat.mjs',"createThread: ({ project, name, instance }) => channel('thread.create', { project, name, ...(instance === undefined ? {} : { instance }) }),","createThread: ({ project, name, instance }) => channel('thread.create', { project, name }),",'packages/webui/tests/chat.test.mjs','C2-09a createThread forwards')
+site('T11',browser,": { project: key, name: f.name, instance: f.instance };",": { project: key, name: f.name };",brtest,'C2-09a picker: no silent choice')
+site('T12',browser,'!f.instance && listed.rows.length === 1','!f.instance && listed.rows.length >= 1',brtest,'C2-09a picker: no silent choice')
+site('T13',browser,'current.instanceError = "Couldn\'t read the thread instances; reload to try again";',"current.instanceError = '';",brtest,'C2-09a picker: metadata failure')
+site('T14',browser,'txt(row.name === row.instance ? row.instance : `${row.name} (${row.instance})`)','txt(row.name)',brtest,'C2-09a picker: no silent choice')
+site('T15',browser,'if (f.instance && !listed.rows.some(row => row.instance === f.instance)) {','if (false) {',brtest,'C2-09a picker: metadata failure')
+site('T16',browser,"f.instance = ''; f.instanceChosen = true;","f.instance = ''; f.instanceChosen = false;",brtest,'C2-09a picker: metadata failure')
+site('T17',browser,"const unavailable = !project && (!!current.instanceError || !choices.some(row => row.instance === f.instance));",'const unavailable = false;',brtest,'C2-09a picker: no silent choice')
+# Route-local guards include their full unique response text to avoid touching other routes.
+site('T18',web,"if (req.method !== 'GET') return json(res, 405, { error: 'method-not-allowed' });","if (false) return json(res, 405, { error: 'method-not-allowed' });",wt,'C2-09a metadata uses the human')
+site('T19',web,"if (search) return json(res, 400, { error: 'invalid-request' });","if (false) return json(res, 400, { error: 'invalid-request' });",wt,'C2-09a metadata uses the human')
+site('T20',browser,"current.instances = listed.rows; current.instanceError = '';","current.instances = listed.rows;",brtest,'C2-09a picker: metadata failure')
+site('T21',web,"({ instance, name: entry.vars?.['persona.name'] || instance })","({ instance, name: entry.vars?.['persona.name'] || instance, vars: entry.vars })",wt,'C2-09a metadata uses the human')
+site('T22',cli,'const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);','const threaded = b.roles[r.instance]?.definition === "assistant";',ct,'C2-09a: terminating one creative thread')
+site('T23',cli,'const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);','const threaded = b.roles[instance]?.definition === "assistant";',ct,'C2-09a: fromSession refuses a creative instance outside a thread without a sandbox')
+ending_old='const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);'
+assert (root/cli).read_text().count(ending_old)==1
+specs[-1]['additional_edits']=[dict(file=cli,old=ending_old,new='const threaded = b.roles[r.instance]?.definition === "assistant";')]
+(p/'mutants.json').write_text(json.dumps(specs,indent=2)+'\n')
+print('STATIC_PREFLIGHT',len(specs),'exact-once sites; no tests run')

agents/rocko/work/queue-219/run-219.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""Row219 serial gate. Requires Sage CLEAR; all children use a process group."""
+import os,sys,time,json,signal,subprocess,tempfile,hashlib,re,glob
+from pathlib import Path
+from datetime import datetime,timezone
+ROOT=Path(__file__).resolve().parents[4]
+PACKET=Path(__file__).resolve().parent
+OUT=PACKET/'run-4a9c-mos1408';OUT.mkdir(exist_ok=True)
+def stamp():return datetime.now(timezone.utc).isoformat()
+def verify():
+ for line in (PACKET/'candidate-manifest.sha256').read_text().splitlines():
+  sha,path=line.split('  ',1)
+  if hashlib.sha256((ROOT/path).read_bytes()).hexdigest()!=sha:raise RuntimeError('candidate drift: '+path)
+def sweep():
+ found=[]
+ for proc in Path('/proc').glob('[0-9]*'):
+  try:
+   cwd=(proc/'cwd').resolve();name=(proc/'comm').read_text().strip()
+   if (str(cwd).startswith(str(ROOT)) or str(cwd).startswith('/mnt/storage/scratch/tmp/')) and ('node' in name or 'chrom' in name):found.append(dict(pid=int(proc.name),name=name,cwd=str(cwd)))
+  except (FileNotFoundError,PermissionError,ProcessLookupError):pass
+ return found
+def execute(label,args,cwd=ROOT,deadline=300,docker=False):
+ if args[0]=='node' and '--test' in args and '--test-reporter=tap' not in args:args=[args[0],'--test-reporter=tap',*args[1:]]
+ if args[0]!='timeout':args=['timeout','-k','10',str(deadline),*args]
+ verify();short=tempfile.mkdtemp(prefix='r',dir='/mnt/storage/scratch/tmp')
+ env=os.environ.copy();env.update(TMPDIR=short,NO_COLOR='1',COMPOSE_PROJECT_NAME='rocko-r219-gate')
+ env.pop('MOSAIC_GITEA_CREDENTIAL_FILE',None);env.pop('MOSAIC_LIVE_PROVIDER',None)
+ if docker:env.pop('DOCKER_HOST',None)
+ else:env['DOCKER_HOST']='unix:///mnt/storage/scratch/rocko-r219-dead.sock'
+ log=OUT/(label+'.tap');begin=stamp();t=time.monotonic();timeout=False
+ print('START',label,begin,flush=True)
+ with log.open('wb') as f:
+  child=subprocess.Popen(args,cwd=cwd,env=env,stdout=f,stderr=subprocess.STDOUT,start_new_session=True)
+  try:rc=child.wait(timeout=deadline+15)
+  except subprocess.TimeoutExpired:
+   timeout=True
+   try:os.killpg(child.pid,signal.SIGTERM)
+   except ProcessLookupError:pass
+   try:child.wait(timeout=10)
+   except subprocess.TimeoutExpired:
+    try:os.killpg(child.pid,signal.SIGKILL)
+    except ProcessLookupError:pass
+    child.wait()
+   rc=child.returncode
+  finally:
+   try:os.killpg(child.pid,signal.SIGTERM)
+   except ProcessLookupError:pass
+ text=log.read_text(errors='replace')
+ counts={k:int(m[-1]) if (m:=re.findall(r'^# '+k+r' (\d+)\s*$',text,re.M)) else None for k in ['tests','pass','fail','cancelled','skipped']}
+ row=dict(label=label,args=args,start=begin,end=stamp(),seconds=round(time.monotonic()-t,3),exit=rc,timeout=timeout,counts=counts,skips=[l for l in text.splitlines() if re.search(r'^skip|# SKIP',l,re.I)],log=str(log.relative_to(ROOT)),tmpdir=short)
+ with (OUT/'results.jsonl').open('a') as f:f.write(json.dumps(row)+'\n')
+ print('END',json.dumps(row),flush=True)
+ if rc or timeout or re.search(r'^\s*not ok\b',text,re.M):raise RuntimeError('RED '+label+' '+str(log))
+ return row
+singles=[line for line in (PACKET/'changed-paths.txt').read_text().splitlines() if '/tests/' in line]
+def stages():
+ for path in singles:execute('single-'+Path(path).parent.parent.name+'-'+Path(path).stem,['node','--test',path],deadline=300)
+ for package in ['bus','cli','webui']:
+  files=sorted(glob.glob(str(ROOT/'packages'/package/'tests'/'*.test.mjs')))
+  execute('suite-'+package,['node','--test',*files],cwd=ROOT/'packages'/package,deadline=1800)
+ for path in sorted(ROOT.glob('scripts/test-*.sh')):
+  # timeout itself implements TERM then KILL, inside the dedicated child group.
+  execute(path.stem,['timeout','-k','10','7200','bash',str(path)],deadline=7200,docker=True)
+ # Every mutant starts from verified candidate bytes and restores in finally.
+ for spec in json.loads((PACKET/'mutants.json').read_text()):
+  verify();edits=[spec]+spec.get('additional_edits',[]);saved={}
+  try:
+   for e in edits:
+    path=ROOT/e['file'];saved.setdefault(path,path.read_bytes());text=path.read_text()
+    if text.count(e['old'])!=1:raise RuntimeError('anchor '+spec['id'])
+    path.write_text(text.replace(e['old'],e['new'],1))
+   # Mutation intentionally changes candidate bytes; execute has its own verify.
+   oldverify=globals()['verify'];globals()['verify']=lambda:None
+   try:
+    execute('mutant-'+spec['id'],['node','--test','--test-name-pattern',spec['pattern'],spec['test']],deadline=180)
+    status='survived'
+   except RuntimeError:
+    record=json.loads((OUT/'results.jsonl').read_text().splitlines()[-1]);text=(ROOT/record['log']).read_text(errors='replace')
+    failing=re.findall(r'^\s*not ok \d+ - (.*)$',text,re.M)
+    status='killed' if record['exit'] and not record['timeout'] and any(re.search(spec['pattern'],name) for name in failing) and 'SyntaxError:' not in text else 'invalid-failure'
+   finally:globals()['verify']=oldverify
+  finally:
+   for path,data in saved.items():path.write_bytes(data)
+  verify()
+  with (OUT/'mutants.jsonl').open('a') as f:f.write(json.dumps(dict(id=spec['id'],status=status,test=spec['test'],pattern=spec['pattern']))+'\n')
+  if status!='killed':raise RuntimeError(spec['id']+' '+status)
+if __name__=='__main__':
+ if Path.cwd()!=ROOT:raise SystemExit('wrong cwd')
+ head=subprocess.check_output(['git','rev-parse','HEAD'],cwd=ROOT,text=True).strip()
+ expected=(PACKET/'run-head.txt').read_text().strip()
+ if head!=expected:raise SystemExit('wrong HEAD')
+ (OUT/'head.json').write_text(json.dumps(dict(head=head,manifest=hashlib.sha256((PACKET/'candidate-manifest.sha256').read_bytes()).hexdigest(),start=stamp())))
+ verify()
+ try:stages()
+ finally:
+  verify();(OUT/'cwd-sweep.json').write_text(json.dumps(sweep(),indent=2))
+  # Remove only the owned fixture compose network, if any; never daemon/volumes.
+  subprocess.run(['docker','network','rm','rocko-r219-gate_default'],stdout=(OUT/'network-cleanup.log').open('w'),stderr=subprocess.STDOUT)

agents/rocko/work/queue-219/run-4a9c-mos1408/cwd-sweep-final.json

@@ -0,0 +1 @@
+[]

agents/rocko/work/queue-219/run-4a9c-mos1408/cwd-sweep.json

@@ -0,0 +1 @@
+[]

agents/rocko/work/queue-219/run-4a9c-mos1408/head.json

@@ -0,0 +1 @@
+{"head": "b97a3ff9757ec2ac39d9ab4cebb9769e471df932", "manifest": "a973912fe2fb9c64606cd99a385305b8f51498a096511b3a980bca6b0a5b98aa", "start": "2026-10-23T05:48:57.416807+00:00"}

agents/rocko/work/queue-219/run-4a9c-mos1408/network-cleanup.log

@@ -0,0 +1,2 @@
+Error response from daemon: network rocko-r219-gate_default not found
+exit status 1

agents/rocko/work/queue-219/run-4a9c-mos1408/results.jsonl

@@ -0,0 +1,4 @@
+{"label": "single-bus-creative.test", "args": ["timeout", "-k", "10", "300", "node", "--test-reporter=tap", "--test", "packages/bus/tests/creative.test.mjs"], "start": "2026-10-23T05:48:57.418927+00:00", "end": "2026-10-23T05:48:57.834246+00:00", "seconds": 0.415, "exit": 0, "timeout": false, "counts": {"tests": 4, "pass": 4, "fail": 0, "cancelled": 0, "skipped": 0}, "skips": ["# skipped 0"], "log": "agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-creative.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/rs156uowe"}
+{"label": "single-bus-threads.test", "args": ["timeout", "-k", "10", "300", "node", "--test-reporter=tap", "--test", "packages/bus/tests/threads.test.mjs"], "start": "2026-10-23T05:48:57.835837+00:00", "end": "2026-10-23T05:48:59.152912+00:00", "seconds": 1.317, "exit": 0, "timeout": false, "counts": {"tests": 19, "pass": 19, "fail": 0, "cancelled": 0, "skipped": 0}, "skips": ["# skipped 0"], "log": "agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-threads.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/rbqz65jtz"}
+{"label": "single-bus-user-principal.test", "args": ["timeout", "-k", "10", "300", "node", "--test-reporter=tap", "--test", "packages/bus/tests/user-principal.test.mjs"], "start": "2026-10-23T05:48:59.154288+00:00", "end": "2026-10-23T05:48:59.719646+00:00", "seconds": 0.565, "exit": 0, "timeout": false, "counts": {"tests": 23, "pass": 23, "fail": 0, "cancelled": 0, "skipped": 0}, "skips": ["# skipped 0"], "log": "agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-user-principal.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/rztf343rx"}
+{"label": "single-cli-launcher.test", "args": ["timeout", "-k", "10", "300", "node", "--test-reporter=tap", "--test", "packages/cli/tests/launcher.test.mjs"], "start": "2026-10-23T05:48:59.721051+00:00", "end": "2026-10-23T05:49:26.296570+00:00", "seconds": 26.576, "exit": 1, "timeout": false, "counts": {"tests": 34, "pass": 33, "fail": 1, "cancelled": 0, "skipped": 0}, "skips": ["# skipped 0"], "log": "agents/rocko/work/queue-219/run-4a9c-mos1408/single-cli-launcher.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/r8xucbjgl"}

agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-creative.test.tap

@@ -0,0 +1,36 @@
+TAP version 13
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# organization: {"event":"reload-needs-restart","business":"demo"}
+# Subtest: M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
+ok 1 - M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
+  ---
+  duration_ms: 37.235384
+  type: 'test'
+  ...
+# Subtest: a creative instance sends only to the user and hears only from the user
+ok 2 - a creative instance sends only to the user and hears only from the user
+  ---
+  duration_ms: 44.266739
+  type: 'test'
+  ...
+# Subtest: M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
+ok 3 - M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
+  ---
+  duration_ms: 83.079495
+  type: 'test'
+  ...
+# Subtest: row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
+ok 4 - row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
+  ---
+  duration_ms: 63.576082
+  type: 'test'
+  ...
+1..4
+# tests 4
+# suites 0
+# pass 4
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 356.82109

agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-threads.test.tap

@@ -0,0 +1,124 @@
+TAP version 13
+# Subtest: REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
+ok 1 - REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
+  ---
+  duration_ms: 37.957781
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
+ok 2 - REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
+  ---
+  duration_ms: 68.301373
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-1: a message to or from the assistant names its thread, or is refused
+ok 3 - REQ-MSG-1: a message to or from the assistant names its thread, or is refused
+  ---
+  duration_ms: 31.316512
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
+ok 4 - REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
+  ---
+  duration_ms: 593.922455
+  type: 'test'
+  ...
+# Subtest: REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
+ok 5 - REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
+  ---
+  duration_ms: 24.857971
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
+ok 6 - REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
+  ---
+  duration_ms: 27.519976
+  type: 'test'
+  ...
+# Subtest: REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
+ok 7 - REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
+  ---
+  duration_ms: 30.716822
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
+ok 8 - REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
+  ---
+  duration_ms: 33.754906
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
+ok 9 - REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
+  ---
+  duration_ms: 29.046481
+  type: 'test'
+  ...
+# Subtest: REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
+ok 10 - REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
+  ---
+  duration_ms: 26.449042
+  type: 'test'
+  ...
+# Subtest: Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
+ok 11 - Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
+  ---
+  duration_ms: 38.524966
+  type: 'test'
+  ...
+# Subtest: REQ-USER-2: the human verbs refuse another owner's thread
+ok 12 - REQ-USER-2: the human verbs refuse another owner's thread
+  ---
+  duration_ms: 28.558392
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
+ok 13 - REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
+  ---
+  duration_ms: 23.166467
+  type: 'test'
+  ...
+# Subtest: REQ-ORG-2: projects and threads are named once, and the repo names a business project
+ok 14 - REQ-ORG-2: projects and threads are named once, and the repo names a business project
+  ---
+  duration_ms: 28.154835
+  type: 'test'
+  ...
+# Subtest: REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
+ok 15 - REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
+  ---
+  duration_ms: 86.802213
+  type: 'test'
+  ...
+# Subtest: project.create refuses a repository name without its matching repo before any write
+ok 16 - project.create refuses a repository name without its matching repo before any write
+  ---
+  duration_ms: 15.244016
+  type: 'test'
+  ...
+# Subtest: project.create keeps unrelated names with and without a repository
+ok 17 - project.create keeps unrelated names with and without a repository
+  ---
+  duration_ms: 11.57841
+  type: 'test'
+  ...
+# Subtest: C2-09a: explicit creative instances bind independent threads, default sessions and holders
+ok 18 - C2-09a: explicit creative instances bind independent threads, default sessions and holders
+  ---
+  duration_ms: 46.82113
+  type: 'test'
+  ...
+# Subtest: C2-09a: explicit missing, non-thread and malformed selectors create no thread or session
+ok 19 - C2-09a: explicit missing, non-thread and malformed selectors create no thread or session
+  ---
+  duration_ms: 20.263528
+  type: 'test'
+  ...
+1..19
+# tests 19
+# suites 0
+# pass 19
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 1283.575562

agents/rocko/work/queue-219/run-4a9c-mos1408/single-bus-user-principal.test.tap

@@ -0,0 +1,148 @@
+TAP version 13
+# Subtest: R3: bindUser binds a granted user and refuses one with no live grant
+ok 1 - R3: bindUser binds a granted user and refuses one with no live grant
+  ---
+  duration_ms: 15.216913
+  type: 'test'
+  ...
+# Subtest: R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
+ok 2 - R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
+  ---
+  duration_ms: 10.127905
+  type: 'test'
+  ...
+# Subtest: R3: each collaborator verb is allowed to a granted user
+ok 3 - R3: each collaborator verb is allowed to a granted user
+  ---
+  duration_ms: 18.491408
+  type: 'test'
+  ...
+# Subtest: R3: every verb off the collaborator list refuses a user access-refused before its own checks
+ok 4 - R3: every verb off the collaborator list refuses a user access-refused before its own checks
+  ---
+  duration_ms: 95.840429
+  type: 'test'
+  ...
+# Subtest: R3: task, web and host verbs refuse a user access-refused
+ok 5 - R3: task, web and host verbs refuse a user access-refused
+  ---
+  duration_ms: 22.333602
+  type: 'test'
+  ...
+# Subtest: R3 leak: project.list shows granted projects only
+ok 6 - R3 leak: project.list shows granted projects only
+  ---
+  duration_ms: 12.494935
+  type: 'test'
+  ...
+# Subtest: R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
+ok 7 - R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
+  ---
+  duration_ms: 15.195921
+  type: 'test'
+  ...
+# Subtest: R3 leak: thread.list shows the user its own threads that are still granted, never others
+ok 8 - R3 leak: thread.list shows the user its own threads that are still granted, never others
+  ---
+  duration_ms: 33.037437
+  type: 'test'
+  ...
+# Subtest: R3 leak: names shows granted instances only
+ok 9 - R3 leak: names shows granted instances only
+  ---
+  duration_ms: 14.891286
+  type: 'test'
+  ...
+# Subtest: R3: thread.send is from user:<id> and writes no human.input
+ok 10 - R3: thread.send is from user:<id> and writes no human.input
+  ---
+  duration_ms: 13.366772
+  type: 'test'
+  ...
+# Subtest: R3: a reply-chain message.send into another user thread is refused
+ok 11 - R3: a reply-chain message.send into another user thread is refused
+  ---
+  duration_ms: 15.523733
+  type: 'test'
+  ...
+# Subtest: R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
+ok 12 - R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
+  ---
+  duration_ms: 18.163702
+  type: 'test'
+  ...
+# Subtest: R3: a reply to: user without a matching in_reply_to is refused user-reply-required
+ok 13 - R3: a reply to: user without a matching in_reply_to is refused user-reply-required
+  ---
+  duration_ms: 26.445744
+  type: 'test'
+  ...
+# Subtest: R3: a non-thread run, the human and the tester cannot send to: user
+ok 14 - R3: a non-thread run, the human and the tester cannot send to: user
+  ---
+  duration_ms: 17.29104
+  type: 'test'
+  ...
+# Subtest: R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
+ok 15 - R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
+  ---
+  duration_ms: 19.258704
+  type: 'test'
+  ...
+# Subtest: R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
+ok 16 - R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
+  ---
+  duration_ms: 18.231409
+  type: 'test'
+  ...
+# Subtest: R3: a user refusal is recorded as action.refused by user:<id>
+ok 17 - R3: a user refusal is recorded as action.refused by user:<id>
+  ---
+  duration_ms: 13.797301
+  type: 'test'
+  ...
+# Subtest: R3: a business with a role keyed user refuses invalid-business
+ok 18 - R3: a business with a role keyed user refuses invalid-business
+  ---
+  duration_ms: 9.468564
+  type: 'test'
+  ...
+# Subtest: R3: name.set refuses the name user
+ok 19 - R3: name.set refuses the name user
+  ---
+  duration_ms: 9.752458
+  type: 'test'
+  ...
+# Subtest: R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
+ok 20 - R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
+  ---
+  duration_ms: 13.617784
+  type: 'test'
+  ...
+# Subtest: R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
+ok 21 - R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
+  ---
+  duration_ms: 14.726171
+  type: 'test'
+  ...
+# Subtest: R3 r4: a non-function access throws before the store is read
+ok 22 - R3 r4: a non-function access throws before the store is read
+  ---
+  duration_ms: 0.105564
+  type: 'test'
+  ...
+# Subtest: C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project
+ok 23 - C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project
+  ---
+  duration_ms: 15.883063
+  type: 'test'
+  ...
+1..23
+# tests 23
+# suites 0
+# pass 23
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 523.149354

agents/rocko/work/queue-219/run-4a9c-mos1408/single-cli-launcher.test.tap

@@ -0,0 +1,259 @@
+TAP version 13
+# Subtest: C2-04: launcher workspace clones code but never the library
+ok 1 - C2-04: launcher workspace clones code but never the library
+  ---
+  duration_ms: 1444.885132
+  type: 'test'
+  ...
+# Subtest: bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest
+ok 2 - bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest
+  ---
+  duration_ms: 1312.408111
+  type: 'test'
+  ...
+# usage: {"event":"usage-unknown","business":"acme","run":"r910aab09c0d6","instance":"chief","turn":"368e3045-8783-47d3-8ae1-e429b321d9b1","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r5bb5f0657d94","instance":"coder","turn":"3432d01f-ca94-4a5e-88d3-19588a40a81d","source":"@none","code":"baseline-unknown"}
+# Subtest: the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code
+ok 3 - the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code
+  ---
+  duration_ms: 745.868459
+  type: 'test'
+  ...
+# usage: {"event":"usage-unknown","business":"acme","run":"r0f3692812967","instance":"chief","turn":"3bd3e4d7-3af4-4a1c-99f1-a8f25b7ab1dd","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"re94397bc3680","instance":"pm","turn":"b2db478d-2905-49fd-a81a-0800643bed6a","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r0f3692812967","instance":"chief","turn":"ac2aa380-f3a0-40d4-960f-a543acb8c431","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"re94397bc3680","instance":"pm","turn":"e8b5124b-591b-4d5b-829c-e944bb3e24bb","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"re94397bc3680","instance":"pm","turn":"6a6e1fa4-5182-42dc-bbc2-26f136eedee3","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r0f3692812967","instance":"chief","turn":"54eb77b5-3880-4afb-9772-0b9d590eb328","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"re94397bc3680","instance":"pm","turn":"11fe8b92-1dae-416a-838b-ae305db74bc6","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r0f3692812967","instance":"chief","turn":"68266357-b477-433c-99ed-f1af37143d91","source":"@none","code":"baseline-unknown"}
+# Subtest: a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold
+ok 4 - a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold
+  ---
+  duration_ms: 1245.265675
+  type: 'test'
+  ...
+# Subtest: each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged
+ok 5 - each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged
+  ---
+  duration_ms: 4072.119958
+  type: 'test'
+  ...
+# Subtest: a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none
+ok 6 - a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none
+  ---
+  duration_ms: 621.888037
+  type: 'test'
+  ...
+# Subtest: REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing
+ok 7 - REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing
+  ---
+  duration_ms: 417.133166
+  type: 'test'
+  ...
+# usage: {"event":"usage-unknown","business":"acme","run":"r8e91dd37dc4b","instance":"coder","turn":"a7b24e30-ac5e-47cf-a951-90cf0d948b4d","source":"@none","code":"baseline-unknown"}
+# Subtest: a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited
+ok 8 - a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited
+  ---
+  duration_ms: 730.904044
+  type: 'test'
+  ...
+# Subtest: a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder
+ok 9 - a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder
+  ---
+  duration_ms: 698.470719
+  type: 'test'
+  ...
+# Subtest: after a restart, the new host's first tick starts a holder whose decision is still held
+ok 10 - after a restart, the new host's first tick starts a holder whose decision is still held
+  ---
+  duration_ms: 920.432738
+  type: 'test'
+  ...
+# Subtest: a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder
+ok 11 - a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder
+  ---
+  duration_ms: 641.309798
+  type: 'test'
+  ...
+# Subtest: a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left
+ok 12 - a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left
+  ---
+  duration_ms: 267.647539
+  type: 'test'
+  ...
+# Subtest: a runner that stops at once ends its launch with the runner's reason
+ok 13 - a runner that stops at once ends its launch with the runner's reason
+  ---
+  duration_ms: 332.423482
+  type: 'test'
+  ...
+# Subtest: a Claude Code launch with no session credential refuses before it starts
+ok 14 - a Claude Code launch with no session credential refuses before it starts
+  ---
+  duration_ms: 181.931254
+  type: 'test'
+  ...
+# Subtest: a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables
+ok 15 - a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables
+  ---
+  duration_ms: 315.27683
+  type: 'test'
+  ...
+# usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/scratch/rocko-r219/packages/plugins/harness/down is missing","kept":[]}
+# plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/scratch/rocko-r219/packages/plugins/harness/down is missing","kept":[]}
+# Subtest: row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason
+ok 16 - row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason
+  ---
+  duration_ms: 353.028786
+  type: 'test'
+  ...
+# Subtest: a runner killed from the host ends its launch as killed, not failed
+ok 17 - a runner killed from the host ends its launch as killed, not failed
+  ---
+  duration_ms: 375.548364
+  type: 'test'
+  ...
+# Subtest: a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback
+ok 18 - a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback
+  ---
+  duration_ms: 187.871873
+  type: 'test'
+  ...
+# Subtest: row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts
+ok 19 - row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts
+  ---
+  duration_ms: 187.807189
+  type: 'test'
+  ...
+# Subtest: row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason
+not ok 20 - row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason
+  ---
+  duration_ms: 255.698016
+  type: 'test'
+  location: '/mnt/storage/scratch/rocko-r219/packages/cli/tests/launcher.test.mjs:766:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    Expected values to be strictly deep-equal:
+    + actual - expected
+    
+      [
+    +   'compactions',
+    +   undefined,
+    +   2
+    -   'refused',
+    -   'launch-failed',
+    -   1
+      ]
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected:
+    0: 'refused'
+    1: 'launch-failed'
+    2: 1
+  actual:
+    0: 'compactions'
+    2: 2
+  operator: 'deepStrictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///mnt/storage/scratch/rocko-r219/packages/cli/tests/launcher.test.mjs:789:10)
+    process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+    async Test.run (node:internal/test_runner/test:1409:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+  ...
+# Subtest: row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts
+ok 21 - row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts
+  ---
+  duration_ms: 194.030218
+  type: 'test'
+  ...
+# usage: {"event":"usage-unknown","business":"acme","run":"r3715d40bd7fb","instance":"chief","turn":"4c85d22f-fdab-4ab7-ad8a-6b4c4d1fbf72","source":"@none","code":"baseline-unknown"}
+# usage: {"event":"usage-unknown","business":"acme","run":"r16ae936abadf","instance":"coder","turn":"2c6b06f1-8f36-4261-81b7-2689b9bb7ff4","source":"@none","code":"baseline-unknown"}
+# Subtest: a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold
+ok 22 - a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold
+  ---
+  duration_ms: 1456.773218
+  type: 'test'
+  ...
+# Subtest: a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again
+ok 23 - a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again
+  ---
+  duration_ms: 1063.59923
+  type: 'test'
+  ...
+# Subtest: a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again
+ok 24 - a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again
+  ---
+  duration_ms: 4016.888246
+  type: 'test'
+  ...
+# Subtest: bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was
+ok 25 - bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was
+  ---
+  duration_ms: 237.364574
+  type: 'test'
+  ...
+# Subtest: bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned
+ok 26 - bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned
+  ---
+  duration_ms: 197.775267
+  type: 'test'
+  ...
+# Subtest: bus start --no-launch starts no thread tick; the same host with launches runs it
+ok 27 - bus start --no-launch starts no thread tick; the same host with launches runs it
+  ---
+  duration_ms: 1181.987654
+  type: 'test'
+  ...
+# Subtest: a malformed sessions.json refuses the host start with exit 3 and stays as it was
+ok 28 - a malformed sessions.json refuses the host start with exit 3 and stays as it was
+  ---
+  duration_ms: 177.111363
+  type: 'test'
+  ...
+# Subtest: an over-long launch request is refused at once, not at the 10 s idle timeout
+ok 29 - an over-long launch request is refused at once, not at the 10 s idle timeout
+  ---
+  duration_ms: 183.364128
+  type: 'test'
+  ...
+# Subtest: a launch client that never closes its side doesn't hold the host's close
+ok 30 - a launch client that never closes its side doesn't hold the host's close
+  ---
+  duration_ms: 179.49662
+  type: 'test'
+  ...
+# Subtest: a runner that ignores SIGTERM is killed when the host closes
+ok 31 - a runner that ignores SIGTERM is killed when the host closes
+  ---
+  duration_ms: 1352.083242
+  type: 'test'
+  ...
+# Subtest: kill switch refuses chief and hire before launch work and a clear permits a later request
+ok 32 - kill switch refuses chief and hire before launch work and a clear permits a later request
+  ---
+  duration_ms: 319.505559
+  type: 'test'
+  ...
+# Subtest: kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle
+ok 33 - kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle
+  ---
+  duration_ms: 334.076309
+  type: 'test'
+  ...
+# Subtest: a launch waiting across halt and resume cannot use its stale admission
+ok 34 - a launch waiting across halt and resume cannot use its stale admission
+  ---
+  duration_ms: 201.932098
+  type: 'test'
+  ...
+1..34
+# tests 34
+# suites 0
+# pass 33
+# fail 1
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 26522.233904

agents/rocko/work/queue-219/run-4a9c/cwd-sweep-final.json

@@ -0,0 +1 @@
+[]

agents/rocko/work/queue-219/run-4a9c/cwd-sweep.json

@@ -0,0 +1 @@
+[]

agents/rocko/work/queue-219/run-4a9c/derived-counts-first-stop.json

@@ -0,0 +1,130 @@
+[
+  {
+    "label": "single-bus-creative.test",
+    "args": [
+      "node",
+      "--test",
+      "packages/bus/tests/creative.test.mjs"
+    ],
+    "start": "2026-10-23T04:07:22.895462+00:00",
+    "end": "2026-10-23T04:07:23.260724+00:00",
+    "seconds": 0.365,
+    "exit": 0,
+    "timeout": false,
+    "counts": {
+      "tests": null,
+      "pass": null,
+      "fail": null,
+      "cancelled": null,
+      "skipped": null
+    },
+    "skips": [],
+    "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-creative.test.tap",
+    "tmpdir": "/mnt/storage/scratch/tmp/rsrt5bzap",
+    "derived_spec_counts": {
+      "tests": 4,
+      "pass": 4,
+      "fail": 0,
+      "cancelled": 0,
+      "skipped": 0
+    },
+    "failed_test_names": []
+  },
+  {
+    "label": "single-bus-threads.test",
+    "args": [
+      "node",
+      "--test",
+      "packages/bus/tests/threads.test.mjs"
+    ],
+    "start": "2026-10-23T04:07:23.262757+00:00",
+    "end": "2026-10-23T04:07:24.629883+00:00",
+    "seconds": 1.367,
+    "exit": 0,
+    "timeout": false,
+    "counts": {
+      "tests": null,
+      "pass": null,
+      "fail": null,
+      "cancelled": null,
+      "skipped": null
+    },
+    "skips": [],
+    "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-threads.test.tap",
+    "tmpdir": "/mnt/storage/scratch/tmp/r5anojtow",
+    "derived_spec_counts": {
+      "tests": 19,
+      "pass": 19,
+      "fail": 0,
+      "cancelled": 0,
+      "skipped": 0
+    },
+    "failed_test_names": []
+  },
+  {
+    "label": "single-bus-user-principal.test",
+    "args": [
+      "node",
+      "--test",
+      "packages/bus/tests/user-principal.test.mjs"
+    ],
+    "start": "2026-10-23T04:07:24.631177+00:00",
+    "end": "2026-10-23T04:07:25.246596+00:00",
+    "seconds": 0.615,
+    "exit": 0,
+    "timeout": false,
+    "counts": {
+      "tests": null,
+      "pass": null,
+      "fail": null,
+      "cancelled": null,
+      "skipped": null
+    },
+    "skips": [],
+    "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-user-principal.test.tap",
+    "tmpdir": "/mnt/storage/scratch/tmp/rg47u_3c2",
+    "derived_spec_counts": {
+      "tests": 23,
+      "pass": 23,
+      "fail": 0,
+      "cancelled": 0,
+      "skipped": 0
+    },
+    "failed_test_names": []
+  },
+  {
+    "label": "single-cli-launcher.test",
+    "args": [
+      "node",
+      "--test",
+      "packages/cli/tests/launcher.test.mjs"
+    ],
+    "start": "2026-10-23T04:07:25.247904+00:00",
+    "end": "2026-10-23T04:07:51.870129+00:00",
+    "seconds": 26.622,
+    "exit": 1,
+    "timeout": false,
+    "counts": {
+      "tests": null,
+      "pass": null,
+      "fail": null,
+      "cancelled": null,
+      "skipped": null
+    },
+    "skips": [],
+    "log": "agents/rocko/work/queue-219/run-4a9c/single-cli-launcher.test.tap",
+    "tmpdir": "/mnt/storage/scratch/tmp/r8oua_z8g",
+    "derived_spec_counts": {
+      "tests": 34,
+      "pass": 33,
+      "fail": 1,
+      "cancelled": 0,
+      "skipped": 0
+    },
+    "failed_test_names": [
+      "row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason",
+      "failing tests:",
+      "row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason"
+    ]
+  }
+]

agents/rocko/work/queue-219/run-4a9c/head.json

@@ -0,0 +1 @@
+{"head": "c7bf3622dd617ea1e3e68a1c9ce44774e2cfe9da", "manifest": "cd791883449f0d64fca06a9a855f855c93d7db74ced53ccebbcb0bad5a0206a7", "start": "2026-10-23T04:07:22.892671+00:00"}

agents/rocko/work/queue-219/run-4a9c/network-cleanup.log

@@ -0,0 +1,2 @@
+Error response from daemon: network rocko-r219-gate_default not found
+exit status 1

agents/rocko/work/queue-219/run-4a9c/results.jsonl

@@ -0,0 +1,4 @@
+{"label": "single-bus-creative.test", "args": ["node", "--test", "packages/bus/tests/creative.test.mjs"], "start": "2026-10-23T04:07:22.895462+00:00", "end": "2026-10-23T04:07:23.260724+00:00", "seconds": 0.365, "exit": 0, "timeout": false, "counts": {"tests": null, "pass": null, "fail": null, "cancelled": null, "skipped": null}, "skips": [], "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-creative.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/rsrt5bzap"}
+{"label": "single-bus-threads.test", "args": ["node", "--test", "packages/bus/tests/threads.test.mjs"], "start": "2026-10-23T04:07:23.262757+00:00", "end": "2026-10-23T04:07:24.629883+00:00", "seconds": 1.367, "exit": 0, "timeout": false, "counts": {"tests": null, "pass": null, "fail": null, "cancelled": null, "skipped": null}, "skips": [], "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-threads.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/r5anojtow"}
+{"label": "single-bus-user-principal.test", "args": ["node", "--test", "packages/bus/tests/user-principal.test.mjs"], "start": "2026-10-23T04:07:24.631177+00:00", "end": "2026-10-23T04:07:25.246596+00:00", "seconds": 0.615, "exit": 0, "timeout": false, "counts": {"tests": null, "pass": null, "fail": null, "cancelled": null, "skipped": null}, "skips": [], "log": "agents/rocko/work/queue-219/run-4a9c/single-bus-user-principal.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/rg47u_3c2"}
+{"label": "single-cli-launcher.test", "args": ["node", "--test", "packages/cli/tests/launcher.test.mjs"], "start": "2026-10-23T04:07:25.247904+00:00", "end": "2026-10-23T04:07:51.870129+00:00", "seconds": 26.622, "exit": 1, "timeout": false, "counts": {"tests": null, "pass": null, "fail": null, "cancelled": null, "skipped": null}, "skips": [], "log": "agents/rocko/work/queue-219/run-4a9c/single-cli-launcher.test.tap", "tmpdir": "/mnt/storage/scratch/tmp/r8oua_z8g"}

agents/rocko/work/queue-219/run-4a9c/single-bus-creative.test.tap

@@ -0,0 +1,14 @@
+organization: {"event":"reload-needs-restart","business":"demo"}
+organization: {"event":"reload-needs-restart","business":"demo"}
+✔ M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises (34.696206ms)
+✔ a creative instance sends only to the user and hears only from the user (41.081291ms)
+✔ M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works (81.11191ms)
+✔ row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb (57.456912ms)
+ℹ tests 4
+ℹ suites 0
+ℹ pass 4
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 334.223966

agents/rocko/work/queue-219/run-4a9c/single-bus-threads.test.tap

@@ -0,0 +1,27 @@
+✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (36.004676ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (68.738374ms)
+✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (32.515768ms)
+✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (610.990913ms)
+✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (23.409918ms)
+✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (28.817937ms)
+✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (30.260544ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (32.327162ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (29.133476ms)
+✔ REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant (26.476132ms)
+✔ Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's (39.418785ms)
+✔ REQ-USER-2: the human verbs refuse another owner's thread (28.785396ms)
+✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (22.979076ms)
+✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (25.496215ms)
+✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (90.366693ms)
+✔ project.create refuses a repository name without its matching repo before any write (16.151198ms)
+✔ project.create keeps unrelated names with and without a repository (11.187274ms)
+✔ C2-09a: explicit creative instances bind independent threads, default sessions and holders (47.776915ms)
+✔ C2-09a: explicit missing, non-thread and malformed selectors create no thread or session (20.207317ms)
+ℹ tests 19
+ℹ suites 0
+ℹ pass 19
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1299.709199

agents/rocko/work/queue-219/run-4a9c/single-bus-user-principal.test.tap

@@ -0,0 +1,31 @@
+✔ R3: bindUser binds a granted user and refuses one with no live grant (14.786261ms)
+✔ R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say (9.870795ms)
+✔ R3: each collaborator verb is allowed to a granted user (19.637409ms)
+✔ R3: every verb off the collaborator list refuses a user access-refused before its own checks (105.182773ms)
+✔ R3: task, web and host verbs refuse a user access-refused (25.672551ms)
+✔ R3 leak: project.list shows granted projects only (13.27019ms)
+✔ R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist (15.965771ms)
+✔ R3 leak: thread.list shows the user its own threads that are still granted, never others (35.018528ms)
+✔ R3 leak: names shows granted instances only (15.057536ms)
+✔ R3: thread.send is from user:<id> and writes no human.input (13.514578ms)
+✔ R3: a reply-chain message.send into another user thread is refused (16.631267ms)
+✔ R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice (18.899841ms)
+✔ R3: a reply to: user without a matching in_reply_to is refused user-reply-required (28.916725ms)
+✔ R3: a non-thread run, the human and the tester cannot send to: user (17.965675ms)
+✔ R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 (19.241443ms)
+✔ R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request (17.997053ms)
+✔ R3: a user refusal is recorded as action.refused by user:<id> (14.840437ms)
+✔ R3: a business with a role keyed user refuses invalid-business (10.081108ms)
+✔ R3: name.set refuses the name user (10.301262ms)
+✔ R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers (14.447561ms)
+✔ R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester (15.786706ms)
+✔ R3 r4: a non-function access throws before the store is read (0.121803ms)
+✔ C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project (16.966486ms)
+ℹ tests 23
+ℹ suites 0
+ℹ pass 23
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 545.0572

agents/rocko/work/queue-219/run-4a9c/single-cli-launcher.test.tap

@@ -0,0 +1,84 @@
+✔ C2-04: launcher workspace clones code but never the library (1405.320275ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1322.785792ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r6724498202ca","instance":"chief","turn":"4d5e8541-7110-44bb-8a7a-ed92208a0fd3","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rd57aefe67267","instance":"coder","turn":"b9afd99d-fad8-48ce-8c03-ca9f9b329cfb","source":"@none","code":"baseline-unknown"}
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (726.266248ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r6e78d96da940","instance":"chief","turn":"0286a736-4a58-46ff-92bb-e974030f5bd7","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r7a24261c88d1","instance":"pm","turn":"a6496c08-1b00-4b40-8d0e-03bc7e972248","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r6e78d96da940","instance":"chief","turn":"cdf4283b-3be0-415c-88d2-ea1e45163617","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r6e78d96da940","instance":"chief","turn":"046a20f2-e7eb-477b-b6e6-b7588b603cbd","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r7a24261c88d1","instance":"pm","turn":"9a07e317-c472-4f17-bb7d-2309cf341af7","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r7a24261c88d1","instance":"pm","turn":"b0ebda74-f2a9-440a-a173-39dcae896036","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r6e78d96da940","instance":"chief","turn":"15238cb8-619f-4a31-b853-fb55d9b86e79","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r7a24261c88d1","instance":"pm","turn":"8a3ef9b0-73bb-4a3f-bf0e-06dcbc0f60c4","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r6e78d96da940","instance":"chief","turn":"4077ae80-1bfc-4cdd-bfca-27c992282797","source":"@none","code":"baseline-unknown"}
+✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1123.845931ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (4152.636087ms)
+✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (617.243337ms)
+✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (412.306281ms)
+usage: {"event":"usage-unknown","business":"acme","run":"rcf551273e0ad","instance":"coder","turn":"c4220d02-0bf0-4122-aa52-925afe04df92","source":"@none","code":"baseline-unknown"}
+✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (700.748992ms)
+✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (638.103132ms)
+✔ after a restart, the new host's first tick starts a holder whose decision is still held (890.273051ms)
+✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (632.625787ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (266.198371ms)
+✔ a runner that stops at once ends its launch with the runner's reason (345.619813ms)
+✔ a Claude Code launch with no session credential refuses before it starts (189.183758ms)
+✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (338.515656ms)
+usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/scratch/rocko-r219/packages/plugins/harness/down is missing","kept":[]}
+plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/scratch/rocko-r219/packages/plugins/harness/down is missing","kept":[]}
+✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (364.92973ms)
+✔ a runner killed from the host ends its launch as killed, not failed (396.074165ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (192.417417ms)
+✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (190.827519ms)
+✖ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (192.548301ms)
+✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (189.824532ms)
+usage: {"event":"usage-unknown","business":"acme","run":"rf7aede34a71b","instance":"chief","turn":"799876e4-fe02-4621-aaac-dfc5cf192082","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"ref958a5bcbb6","instance":"coder","turn":"ce0a5214-37f5-48d4-ae90-c9f6745e058d","source":"@none","code":"baseline-unknown"}
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1782.388685ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1025.160483ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3976.016342ms)
+✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (236.101723ms)
+✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (195.720542ms)
+✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1179.765366ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (174.297238ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (187.137601ms)
+✔ a launch client that never closes its side doesn't hold the host's close (184.807395ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1359.638326ms)
+✔ kill switch refuses chief and hire before launch work and a clear permits a later request (317.536928ms)
+✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (326.035999ms)
+✔ a launch waiting across halt and resume cannot use its stale admission (196.129785ms)
+ℹ tests 34
+ℹ suites 0
+ℹ pass 33
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 26568.728775
+
+✖ failing tests:
+
+test at packages/cli/tests/launcher.test.mjs:766:1
+✖ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (192.548301ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+    [
+      'refused',
+  +   'session-required',
+  -   'launch-failed',
+      1
+    ]
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/rocko-r219/packages/cli/tests/launcher.test.mjs:788:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: [ 'refused', 'session-required', 1 ],
+    expected: [ 'refused', 'launch-failed', 1 ],
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }

packages/bus/src/broker.mjs

@@ -4,7 +4,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
-import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
+import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
 
 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -314,7 +314,7 @@ const enrollBinding = (enroll) => ({
 });
 // r6 E3: the installer line's comment, then the tag's 32 hex digits.
 const INSTALLER_COMMENT = 'mosaic-installer-';
-// Row 121 (#1615): an instance of THREAD_DEFINITION (vocabulary.mjs since row 155) talks with the
+// Row 121 (#1615): an instance of THREAD_DEFINITIONS (vocabulary.mjs since row 213) talks with the
 // user in threads. Its runs claim a thread, not the role, and every message to or from it names its
 // thread (REQ-MSG-1).
 // Row 146 (#1640): the sender of the bus's notice to launch.by. A role instance name matches the
@@ -598,7 +598,7 @@ export class Broker {
     );
   }
   #threaded(business, role) {
-    return this.#business(business).roles[role]?.definition === THREAD_DEFINITION;
+    return THREAD_DEFINITIONS.includes(this.#business(business).roles[role]?.definition);
   }
   // Row 264a (#1769): a claim holds one session of a thread, and each session has its own holder.
   #sessionHolder(session) {
@@ -6068,24 +6068,27 @@ export class Broker {
           .all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business)
           .filter((p) => !s.user || this.#granted(s, 'project.list', p.id, null));
       }
-      // A thread belongs to the user who made it and to the business's one thread instance.
+      // A thread belongs to the user who made it and to one declared thread instance.
       // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
       case 'thread.create': {
         if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['project', 'name'], ['project', 'name']);
+        keys(a, ['project', 'name', 'instance'], ['project', 'name']);
         if (!name(a.name)) fail('invalid-request');
+        const instances = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
+        const instance = a.instance === undefined
+          ? (instances.length === 1 ? instances[0] : null)
+          : identifier(a.instance);
         // FED R3 (design 3.5): a user's grant must cover the project and the thread instance, checked
         // before the project is looked up, so an ungranted id reads the same whether it exists or not.
         if (s.user) {
-          const threaded = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
-          if (threaded.length !== 1 || !this.#granted(s, 'thread.create', identifier(a.project), threaded[0])) fail('access-refused');
+          if (!instance || !instances.includes(instance) || !this.#granted(s, 'thread.create', identifier(a.project), instance))
+            fail('access-refused');
         }
         if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', identifier(a.project), s.business))
           fail('project-not-found');
-        // The bus never picks between instances; the business file declares exactly one.
-        const instances = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
-        if (!instances.length) fail('thread-instance-missing');
-        if (instances.length > 1) fail('thread-instance-ambiguous');
+        // The human selects an instance; omission is compatible only with one candidate.
+        if (!instances.length || (a.instance !== undefined && !instances.includes(instance))) fail('thread-instance-missing');
+        if (a.instance === undefined && instances.length > 1) fail('thread-instance-ambiguous');
         if (this.#store.get('SELECT 1 FROM threads WHERE project=? AND name=?', a.project, a.name)) fail('thread-exists');
         const tid = randomUUID();
         this.#store.run(
@@ -6094,13 +6097,13 @@ export class Broker {
           this.#now(),
           s.business,
           a.project,
-          instances[0],
+          instance,
           this.#owner(s),
           a.name,
         );
         // Row 264a (#1769, D3): every thread has a default session from the start.
-        this.#newSession(s, { id: tid, business: s.business, instance: instances[0], owner: this.#owner(s) }, 'default', 'default', true);
-        return { id: tid, instance: instances[0] };
+        this.#newSession(s, { id: tid, business: s.business, instance, owner: this.#owner(s) }, 'default', 'default', true);
+        return { id: tid, instance };
       }
       // Row 177 (#1675): each lists its own threads. The human's list leaves out the tester's,
       // and the tester's lists only its own (row 175 listed it the business human's).

packages/bus/tests/creative.test.mjs

@@ -44,15 +44,18 @@ function setup(t) {
   const caps = {};
   caps.human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const project = b.request(caps.human, { verb: 'project.create', args: { name: 'demo' } }).id;
-  const thread = b.request(caps.human, { verb: 'thread.create', args: { project, name: 'main' } }).id;
+  const thread = b.request(caps.human, { verb: 'thread.create', args: { project, name: 'main', instance: 'assistant' } }).id;
+  const threads = { assistant: thread };
   for (const role of Object.keys(roles)) {
-    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi', ...(role === 'assistant' ? { thread } : {}) });
+    if (['bean', 'quill'].includes(role))
+      threads[role] = b.request(caps.human, { verb: 'thread.create', args: { project, name: role, instance: role } }).id;
+    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi', ...(threads[role] ? { thread: threads[role] } : {}) });
     b.request(caps[role], { verb: 'role.claim' });
   }
   caps.tester = b.bindTester({ business: 'demo' });
   const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
   const count = (sql) => store.get(sql).n;
-  return { call, count, store };
+  return { call, count, store, threads };
 }
 
 const raise = { action: 'policy.change', question: 'Change?', options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false };
@@ -72,7 +75,7 @@ test('M6: a creative raise refuses decision-not-allowed, cited or not, and no de
 });
 
 test('a creative instance sends only to the user and hears only from the user', (t) => {
-  const { call, count } = setup(t);
+  const { call, count, threads } = setup(t);
   for (const who of ['bean', 'quill']) {
     call(who, 'message.send', { to: 'human', body: 'hello' });
     for (const to of ['chief', 'assistant', 'pm', 'bean', 'quill'].filter((n) => n !== who)) {
@@ -81,7 +84,7 @@ test('a creative instance sends only to the user and hears only from the user',
     for (const from of ['chief', 'pm']) {
       assert.throws(() => call(from, 'message.send', { to: who, body: 'hello' }), { code: 'message-sender-refused' }, `${from} to ${who}`);
     }
-    call('human', 'message.send', { to: who, body: 'hello' });
+    call('human', 'thread.send', { thread: threads[who], body: 'hello' });
   }
   assert.equal(count("SELECT count(*) n FROM messages WHERE from_role IN ('bean','quill')"), 2);
   assert.equal(count("SELECT count(*) n FROM messages WHERE to_role IN ('bean','quill')"), 2);

packages/bus/tests/threads.test.mjs

@@ -601,3 +601,42 @@ test('project.create keeps unrelated names with and without a repository', t =>
     { id: linked.id, name: 'work', repo: 'stack' },
   ]);
 });
+
+test('C2-09a: explicit creative instances bind independent threads, default sessions and holders', t => {
+  const creative = ['companion', 'ideas', 'research', 'proofreader', 'fact-checker', 'continuity'];
+  const extra = Object.fromEntries(creative.map((definition, i) => [`writer${i}`, { definition, authority: { withinRole: ['message.send'], crossRole: [] } }]));
+  const ctx = setup(t, demo({ roles: { ...roles, ...extra }, definitions: {
+    ...definitions, ...Object.fromEntries(creative.map(definition => [definition, { messaging: shipped(definition).messaging }])),
+  } }));
+  const project = ctx.call('human', 'project.create', { name: 'Writing' }).id;
+  assert.throws(() => ctx.call('human', 'thread.create', { project, name: 'ambiguous' }), { code: 'thread-instance-ambiguous' });
+  for (const [instance, role] of Object.entries(extra)) {
+    const receipt = ctx.call('human', 'thread.create', { project, name: instance, instance });
+    assert.equal(receipt.instance, instance);
+    assert.equal(ctx.store.get('SELECT instance FROM threads WHERE id=?', receipt.id).instance, instance);
+    assert.equal(ctx.store.get('SELECT instance FROM sessions WHERE thread=?', receipt.id).instance, instance);
+    ctx.launch(instance, instance, { thread: receipt.id });
+    assert.equal(ctx.claim(instance).thread, receipt.id);
+    const sent = ctx.call('human', 'thread.send', { thread: receipt.id, body: `For ${instance}` });
+    const read = ctx.call(instance, 'message.receive');
+    assert.deepEqual(read.map(m => m.id), [sent.id], role.definition);
+    assert.equal(ctx.threadOf(sent.id), receipt.id);
+    assert.equal(ctx.store.get('SELECT count(*) n FROM role_claims WHERE role=?', instance).n, 0);
+    assert.throws(() => ctx.call('human', 'message.send', { to: instance, body: 'No implicit thread' }),
+      { code: 'thread-required-use-thread-send' });
+  }
+  assert.equal(ctx.count('SELECT count(*) n FROM threads'), creative.length);
+});
+
+test('C2-09a: explicit missing, non-thread and malformed selectors create no thread or session', t => {
+  const ctx = setup(t);
+  const project = ctx.call('human', 'project.create', { name: 'Writing' }).id;
+  for (const instance of ['not-declared', 'pm', 'coder'])
+    assert.throws(() => ctx.call('human', 'thread.create', { project, name: instance, instance }), { code: 'thread-instance-missing' });
+  for (const instance of [null, 7, {}, [], '', 'bad name'])
+    assert.throws(() => ctx.call('human', 'thread.create', { project, name: 'bad', instance }), { code: 'invalid-request' });
+  assert.equal(ctx.count('SELECT count(*) n FROM threads'), 0);
+  assert.equal(ctx.count('SELECT count(*) n FROM sessions'), 0);
+  const legacy = ctx.call('human', 'thread.create', { project, name: 'Default' });
+  assert.equal(legacy.instance, 'assistant');
+});

packages/bus/tests/user-principal.test.mjs

@@ -23,7 +23,7 @@ const grant = (over = {}) => ({
 });
 
 // `processing` stands in for the halt switch, as lifecycle-verbs.test.mjs's T15 does.
-function setup(t, { grants = [grant()], processing = null } = {}) {
+function setup(t, { grants = [grant()], processing = null, threadRoles = {} } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'bus-user-principal-'));
   const store = new Store(root);
   t.after(() => {
@@ -40,6 +40,7 @@ function setup(t, { grants = [grant()], processing = null } = {}) {
         roles: {
           chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
           assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+          ...threadRoles,
         },
         definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
       },
@@ -394,3 +395,21 @@ test('R3 r4: the chief\'s hire refuses an instance named user with the code it g
 test('R3 r4: a non-function access throws before the store is read', () => {
   assert.throws(() => new Broker({ store: null, businesses: { demo: {} }, access: 'access.json' }), /access must be a function/);
 });
+
+test('C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project', t => {
+  const ctx = setup(t, { threadRoles: { bean: { definition: 'companion', authority: { withinRole: ['message.send'], crossRole: [] } } } });
+  const project = ctx.call('human', 'project.create', { name: 'shared' }).id;
+  const privateProject = ctx.call('human', 'project.create', { name: 'private' }).id;
+  ctx.access.doc.grants = [grant({ projects: [project] })];
+  ctx.user('alice');
+  assert.equal(ctx.code('alice', 'thread.create', { project, name: 'blocked bean', instance: 'bean' }), 'access-refused');
+  for (const id of [privateProject, '00000000-0000-4000-8000-000000000000'])
+    assert.equal(ctx.code('alice', 'thread.create', { project: id, name: 'blocked project', instance: 'assistant' }), 'access-refused');
+  assert.equal(ctx.store.get('SELECT count(*) n FROM threads').n, 0);
+  const allowed = ctx.call('alice', 'thread.create', { project, name: 'assistant work', instance: 'assistant' });
+  assert.equal(allowed.instance, 'assistant');
+  ctx.access.doc.grants = [grant({ projects: [project], instances: ['bean'] })];
+  const bean = ctx.call('alice', 'thread.create', { project, name: 'bean work', instance: 'bean' });
+  assert.equal(bean.instance, 'bean');
+  assert.equal(ctx.code('alice', 'thread.create', { project, name: 'old instance', instance: 'assistant' }), 'access-refused');
+});

packages/cli/src/launcher.mjs

@@ -53,7 +53,7 @@
 // session.json names it as gitSocket.
 //
 // Thread sessions (row 121, #1615). A thread instance (an instance whose
-// role definition is the assistant) runs once per thread, never on its own:
+// role definition is in THREAD_DEFINITIONS) runs once per thread, never on its own:
 // a launch from a session or --pm refuses thread-required. Every tick
 // (threadTickMs) the host asks the broker for the business's threads
 // (launch op threadsState) and:
@@ -139,6 +139,7 @@ import { createServer } from "node:net";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { configDir, loadBusiness, resolveInstance, systemVars } from "../../business/src/index.mjs";
+import { THREAD_DEFINITIONS } from "../../business/src/vocabulary.mjs";
 import { limitHit } from "../../business/src/launch.mjs";
 import { BundleError, buildBundle, hasFallback, readSkills, sessionModel } from "../../harness/src/bundle.mjs";
 import { createLoader } from "../../plugins/src/loader.mjs";
@@ -176,8 +177,6 @@ const STOP_TIMEOUT_MS = 30000;
 const LINE_MAX = 4096;
 // How often the host asks for the threads' state; a poll period, not a limit.
 const THREAD_TICK_MS = 2000;
-// The broker's thread instance definition (packages/bus/src/broker.mjs).
-const THREAD_DEFINITION = "assistant";
 // Row 194: the broker's LIFECYCLE_REQUEST_MS. A regenerate's old run must be gone by then.
 const LIFECYCLE_REQUEST_MS = 60000;
 
@@ -331,7 +330,7 @@ export function createLauncher({
     try { b=loadBusiness(host.business,{dir:configDir(env),rolesDir:rolesDir(env)}); } catch(e){throw new Refusal("organization-refused",e.message);}
     if (!b.launch) throw new Refusal("launch-not-configured", `business ${b.id} has no launch block`);
     if (!(pm ? instance === b.launch.by : b.launch.instances.includes(instance) || (human && Object.hasOwn(b.roles, instance)))) throw new Refusal("instance-not-listed");
-    const threaded = b.roles[instance]?.definition === THREAD_DEFINITION;
+    const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);
     if (threaded && !thread) throw new Refusal("thread-required", `${instance} runs only for a thread`);
     if (!threaded && thread) throw new Refusal("thread-not-allowed", `${instance} isn't a thread instance`);
     if (threaded && !session) throw new Refusal("session-required", `${instance} runs for one session of a thread`);
@@ -997,7 +996,7 @@ export function createLauncher({
   function ending(r) {
     const runs = r.runs ?? [];
     const at = Date.parse(r.at);
-    const threaded = b.roles[r.instance]?.definition === THREAD_DEFINITION;
+    const threaded = THREAD_DEFINITIONS.includes(b.roles[r.instance]?.definition);
     return registry.sessions.filter((s) => s.business === b.id && (runs.includes(s.run) ||
       (!threaded && s.instance === r.instance && (spawnedAt.get(s.run) ?? Date.parse(s.startedAt)) <= at)));
   }

packages/cli/tests/launcher.test.mjs

@@ -773,21 +773,34 @@ test("row 213 a creative instance's persona is read from <configDir>/personas: o
   const dir = join(given.root, "config", "personas", "acme");
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   writeFileSync(join(dir, "bean.md"), "Not the pinned text.\n", { mode: 0o600 });
-  const { f, host, launcher } = await setup(t, undefined, given);
-  // The chief of staff holds role.launch; a test chief session bound to this process asks.
-  const chief = await host.bindLaunch({ business: "acme", role: "chief", run: "chief-test", harness: "pi", pid: process.pid, startTime: startTimeOf(process.pid) });
-  await new Client({ path: host.path, cap: chief.cap }).call("role.claim");
-  // The bundle's refusal comes back as launch-failed, as webPlan's does, with its reason in the log.
-  assert.deepEqual(await launcher.fromSession(chief.cap, "bean"), { ok: false, error: "launch-failed" });
-  const [e] = log(f);
-  assert.deepEqual([e.event, e.code, log(f).length], ["refused", "launch-failed", 1]);
+  // Row 219: creative instances launch from their thread, not from a chief's standalone request.
+  // The mismatch occurs before bindLaunch, so only the host's thread-state snapshot is a fixture.
+  const thread = 'persona-thread';
+  const SESSION = 'persona-session';
+  const { f, launcher } = await setup(t, undefined, given, { wrap: host => ({
+    ...host,
+    op: message => message.op === 'threadsState'
+      ? Promise.resolve([{ thread, session: SESSION, instance: 'bean', holder: null, pending: 1 }])
+      : host.op(message),
+  }) });
+  // The thread path records row 270's run-start count before the bundle's persona refusal.
+  await launcher.tick();
+  const runs = readdirSync(join(f.dataRoot, "launches", "acme"));
+  const entries = log(f);
+  assert.equal(entries.length, 2);
+  const { at, ...compactions } = entries[0];
+  assert.deepEqual(compactions, { event: 'compactions', instance: 'bean', thread, session: SESSION, run: runs[0], count: 0, known: true, reason: null });
+  const e = entries[1];
+  assert.deepEqual([e.event, e.code], ["refused", "launch-failed"]);
+  assert.equal(e.thread, thread);
   assert.equal(e.why, `instance bean: persona file ${join(dir, "bean.md")} isn't the file persona.sha256 names`);
   assert.ok(!JSON.stringify(log(f)).includes("PERSONA-MARKER-d2"));
   assert.deepEqual(readSessions(f.dataRoot), []);
   // The run directory exists by then (BUILD.md residual); the persona is read before any bundle file.
-  const runs = readdirSync(join(f.dataRoot, "launches", "acme"));
   assert.equal(runs.length, 1);
-  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), ["session"]);
+  assert.deepEqual(readdirSync(join(f.dataRoot, "launches", "acme", runs[0])), []);
+  assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "sessions", SESSION, "session")), true);
+  assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "session")), false);
 });
 
 test("row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts", { timeout: 30000 }, async (t) => {

packages/cli/tests/thread-launch.test.mjs

@@ -396,6 +396,22 @@ test("REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a t
   assert.deepEqual(launchLog(f).map((e) => [e.event, e.instance, e.code]), [["refused", "assistant", "thread-required"]]);
 });
 
+// Admission refuses before bundle construction or a sandbox is needed.
+test('C2-09a: fromSession refuses a creative instance outside a thread without a sandbox', { timeout: 30000 }, async t => {
+  const prepared = prepare(t, { edit: doc => {
+    doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+    doc.launch.instances.push('bean');
+    return doc;
+  } });
+  const { f } = prepared;
+  const host = await start(t, prepared);
+  const chief = await host.host.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-bean-refusal', harness: 'pi', pid: process.pid, startTime: startTimeOf(process.pid) });
+  await new Client({ path: host.host.path, cap: chief.cap }).call('role.claim');
+  assert.deepEqual(await host.launcher.fromSession(chief.cap, 'bean'), { ok: false, error: 'thread-required' });
+  assert.deepEqual(readSessions(f.dataRoot), []);
+  assert.deepEqual(launchLog(f).map(e => [e.event, e.instance, e.code]), [['refused', 'bean', 'thread-required']]);
+});
+
 // Row 125 (#1619, REQ-LIMIT-3, REQ-LIMIT-4): the token-limit check switched on, with the
 // assistant's limit at 0, so it is at its limit before any turn. The real check runs through the
 // bus's plug-in loader.
@@ -443,3 +459,71 @@ test("REQ-LIMIT-4 a thread run at its token limit stops at the end of its turn:
   assert.deepEqual(threadRuns(f, A), []);
   assert.equal(host.runtime.threadsState("acme").find((x) => x.thread === A).holder, null);
 });
+
+test('C2-09a: creative thread messages start distinct runs and keep each instance history separate', { skip, timeout: 90000 }, async t => {
+  const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
+    const vars = { ...doc.roles.assistant.vars };
+    delete doc.roles.assistant;
+    doc.roles.bean = { definition: 'companion', vars: { ...vars } };
+    doc.roles.chet = { definition: 'continuity', vars: { ...vars } };
+    doc.launch.instances = ['coder', 'bean', 'chet'];
+    return doc;
+  } });
+  const host = await start(t, prepared), { f } = prepared;
+  const project = host.call('project.create', { name: 'Writing' }).id;
+  const bean = host.call('thread.create', { project, name: 'Bean', instance: 'bean' }).id;
+  const chet = host.call('thread.create', { project, name: 'Chet', instance: 'chet' }).id;
+  const send = async (thread, instance, body) => {
+    const message = host.call('thread.send', { thread, body });
+    const outcome = await until(() => host.call('thread.messages', { thread }).find(m => m.in_reply_to === message.id) ||
+      launchLog(f).find(row => row.thread === thread && row.event === 'refused'));
+    assert.notEqual(outcome.event, 'refused', `creative thread launch refused: ${outcome.code}`);
+    const reply = outcome;
+    assert.equal(reply.from_role, instance);
+    assert.equal(reply.to_role, 'human');
+    return JSON.parse(reply.body.match(/THREAD (\{.*\})/)[1]);
+  };
+  assert.deepEqual((await send(bean, 'bean', 'Bean input')).before, []);
+  assert.deepEqual((await send(chet, 'chet', 'Chet input')).before, []);
+  assert.deepEqual((await send(bean, 'bean', 'Bean again')).before, ['Bean input']);
+  assert.equal(readFileSync(join(f.dataRoot, 'threads', 'acme', bean, 'session', 'history'), 'utf8'), 'Bean input\nBean again\n');
+  assert.equal(readFileSync(join(f.dataRoot, 'threads', 'acme', chet, 'session', 'history'), 'utf8'), 'Chet input\n');
+  const launches = launchLog(f).filter(row => row.event === 'launch');
+  assert.ok(launches.some(row => row.instance === 'bean' && row.thread === bean));
+  assert.ok(launches.some(row => row.instance === 'chet' && row.thread === chet));
+  const chief = await host.host.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-creative-test', harness: 'pi', pid: process.pid, startTime: startTimeOf(process.pid) });
+  await new Client({ path: host.host.path, cap: chief.cap }).call('role.claim');
+  assert.deepEqual(await host.launcher.fromSession(chief.cap, 'bean'), { ok: false, error: 'thread-required' });
+});
+
+test('C2-09a: terminating one creative thread does not signal an unselected peer of the same instance', { skip, timeout: 90000 }, async t => {
+  const prepared = prepare(t, { sonnet: 2, idle: 60, edit: doc => {
+    doc.roles.bean = { ...doc.roles.assistant, definition: 'companion' };
+    delete doc.roles.assistant;
+    doc.launch.instances = ['coder', 'bean'];
+    return doc;
+  } });
+  let requests = [];
+  const host = await start(t, prepared, { ops: () => ({
+    lifecycleRequests: () => requests,
+    lifecycleTake: () => ({ ...requests[0], go: true }),
+    lifecycleDone: () => { requests = []; return {}; },
+  }) });
+  const { f } = prepared;
+  const project = host.call('project.create', { name: 'Writing' }).id;
+  const threads = ['one', 'two'].map(name => host.call('thread.create', { project, name, instance: 'bean' }).id);
+  for (const thread of threads) {
+    const message = host.call('thread.send', { thread, body: 'Stay in this thread' });
+    const outcome = await until(() => host.call('thread.messages', { thread }).find(row => row.in_reply_to === message.id) ||
+      launchLog(f).find(row => row.thread === thread && row.event === 'refused'));
+    assert.notEqual(outcome.event, 'refused', `creative thread launch refused: ${outcome.code}`);
+  }
+  const runs = threads.map(thread => launchLog(f).find(row => row.thread === thread && row.event === 'launch').run);
+  requests = [{ request: 'one-thread-end', state: 'open', business: 'acme', action: 'lifecycle.end',
+    instance: 'bean', runs: [runs[0]], by: f.doc.human, at: new Date(Date.now() + 1000).toISOString() }];
+  await host.launcher.tick();
+  await until(() => launchLog(f).some(row => row.event === 'lifecycle-end' && row.run === runs[0]));
+  assert.deepEqual(launchLog(f).filter(row => row.event === 'lifecycle-end').map(row => row.run), [runs[0]]);
+  await until(() => !readSessions(f.dataRoot).some(row => row.run === runs[0]));
+  assert.ok(readSessions(f.dataRoot).some(row => row.run === runs[1]));
+});

packages/webui/src/chat-http.mjs

@@ -78,7 +78,8 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
             (Object.hasOwn(v, 'repo') && (typeof v.repo !== 'string' || !KEY.test(v.repo)))) throw Error();
         action = 'createProject'; args = v;
       } else if (path === '/api/chat/threads') {
-        if (!exact(v, ['project', 'name']) || !id(v.project) || !name(v.name)) throw Error();
+        if (!exact(v, ['project', 'name', 'instance'], ['project', 'name']) || !id(v.project) || !name(v.name) ||
+            (Object.hasOwn(v, 'instance') && (typeof v.instance !== 'string' || !KEY.test(v.instance)))) throw Error();
         action = 'createThread'; args = v;
       } else if (match?.[2] === 'messages') {
         if (!exact(v, ['body']) || typeof v.body !== 'string' || !v.body.trim() || v.body.length > 32768) throw Error();

packages/webui/src/chat.mjs

@@ -20,7 +20,7 @@ export function createChat({ call }) {
     projects: () => channel('project.list', {}),
     createProject: ({ name, repo }) => channel('project.create', { name, ...(repo === undefined ? {} : { repo }) }),
     threads: ({ project } = {}) => channel('thread.list', project === undefined ? {} : { project }),
-    createThread: ({ project, name }) => channel('thread.create', { project, name }),
+    createThread: ({ project, name, instance }) => channel('thread.create', { project, name, ...(instance === undefined ? {} : { instance }) }),
     messages: ({ thread, after, limit }) => channel('thread.messages', { thread, ...(after ? { after } : {}), limit }),
     send: ({ thread, body }) => channel('thread.send', { thread, body, class: 'REQUEST' }),
     open: ({ thread }) => channel('thread.open', { thread }),

packages/webui/src/public/chat.js

@@ -14,7 +14,7 @@
     return states.get(id);
   };
   const form = key => {
-    if (!forms.has(key)) forms.set(key, { name: '', repo: '', receipt: '', pending: false });
+    if (!forms.has(key)) forms.set(key, { name: '', repo: '', instance: '', instanceChosen: false, receipt: '', pending: false });
     return forms.get(key);
   };
   class ChatError extends Error {
@@ -58,7 +58,11 @@
   function creation(kind, key) {
     const f = form(key), project = kind === 'project';
     const repo = project && current.repos.length ? `<label>Repository (optional)<select id="chat-repo" data-chat-field="repo"><option value="">No repository link</option>${current.repos.map(r => `<option value="${esc(r)}"${r === f.repo ? ' selected' : ''}>${txt(r)}</option>`).join('')}</select></label>` : '';
-    return `<form id="chat-${kind}-form" class="chat-create" data-key="${esc(key)}"><h2>New ${kind}</h2><label>Name<input id="chat-${kind}-name" data-chat-field="name" value="${esc(f.name)}" maxlength="200" required${disabled(f.pending)}></label>${repo}<button class="btn" type="submit"${disabled(f.pending)}>${f.pending ? 'Creating…' : `Create ${kind}`}</button><p role="status">${txt(f.receipt)}</p></form>`;
+    const choices = current.instances ?? [];
+    const picker = project ? '' : `<label>Thread with<select id="chat-instance" data-chat-field="instance" required${disabled(f.pending || !!current.instanceError || !choices.length)}><option value="">Choose who this thread is with</option>${choices.map(row => `<option value="${esc(row.instance)}"${row.instance === f.instance ? ' selected' : ''}>${txt(row.name === row.instance ? row.instance : `${row.name} (${row.instance})`)}</option>`).join('')}</select></label>`;
+    const unavailable = !project && (!!current.instanceError || !choices.some(row => row.instance === f.instance));
+    const status = !project && current.instanceError ? current.instanceError : f.receipt || (!project && !choices.length ? 'No thread instances are configured.' : '');
+    return `<form id="chat-${kind}-form" class="chat-create" data-key="${esc(key)}"><h2>New ${kind}</h2><label>Name<input id="chat-${kind}-name" data-chat-field="name" value="${esc(f.name)}" maxlength="200" required${disabled(f.pending)}></label>${repo}${picker}<button class="btn" type="submit"${disabled(f.pending || unavailable)}>${f.pending ? 'Creating…' : `Create ${kind}`}</button><p role="status">${txt(status)}</p></form>`;
   }
   function threads(rows) {
     return rows.length ? `<ul class="chat-thread-list">${rows.map(t => `<li>${link('threads', t.id, t.name)} <span class="muted">${txt(t.instance)}</span></li>`).join('')}</ul>` : '<p>No threads yet.</p>';
@@ -106,7 +110,7 @@
       const f = document.getElementById(keep.field.id);
       if (f && !f.disabled) {
         f.focus({ preventScroll: true });
-        if (keep.field.start !== null) f.setSelectionRange(keep.field.start, keep.field.end);
+        if (keep.field.start != null && typeof f.setSelectionRange === 'function') f.setSelectionRange(keep.field.start, keep.field.end);
       }
     } else if (navigated) c.container.querySelector('h1')?.focus({ preventScroll: true });
   }
@@ -126,7 +130,7 @@
       paint(); return;
     }
     const old = current;
-    current = { container, kind, id, canSend, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], error: '', refused: false };
+    current = { container, kind, id, canSend, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], instances: old?.instances ?? [], instanceError: kind === 'project' ? 'Reading thread instances…' : '', error: '', refused: false };
     if (navigated || !old) container.innerHTML = '<p class="chat-loading" role="status">Reading chat…</p>';
     try {
       const s = kind === 'thread' ? state(id) : null;
@@ -147,6 +151,25 @@
           s.receipt = 'Message shown in this conversation.'; s.receiptId = null;
         }
       }
+      if (kind === 'project') {
+        try {
+          const listed = await request('instances', undefined, signal);
+          if (g !== generation || out()) return;
+          if (!listed.rows.every(row => typeof row?.instance === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(row.instance) && typeof row.name === 'string'))
+            throw new ChatError('invalid-response');
+          current.instances = listed.rows; current.instanceError = '';
+          const f = form(id);
+          if (f.instance && !listed.rows.some(row => row.instance === f.instance)) {
+            f.instance = ''; f.instanceChosen = true;
+            f.receipt = 'The selected instance is no longer available. Choose who this thread is with.';
+          }
+          if (!f.instanceChosen && !f.instance && listed.rows.length === 1) f.instance = listed.rows[0].instance;
+        } catch (err) {
+          if (err.name === 'AbortError' || out() || g !== generation) return;
+          current.instances = [];
+          current.instanceError = "Couldn't read the thread instances; reload to try again";
+        }
+      }
       // Repository choices are optional metadata; an unavailable read must not block unlinked chat.
       if (kind === 'list') {
         try {
@@ -179,7 +202,11 @@
     if (!current || out()) return;
     if (event.target.id === 'chat-body') state(current.id).draft = event.target.value;
     const f = event.target.closest('.chat-create');
-    if (f && event.target.dataset.chatField) form(f.dataset.key)[event.target.dataset.chatField] = event.target.value;
+    if (f && event.target.dataset.chatField) {
+      const draft = form(f.dataset.key), field = event.target.dataset.chatField;
+      draft[field] = event.target.value;
+      if (field === 'instance') { draft.instanceChosen = true; draft.receipt = ''; paint(); }
+    }
   });
   document.addEventListener('scroll', event => {
     if (event.target.matches?.('.chat-log') && current?.kind === 'thread') {
@@ -232,7 +259,8 @@
       void write('send', id, { body: state(id).draft }, `threads/${id}/messages`);
     } else if (event.target.classList.contains('chat-create')) {
       const key = event.target.dataset.key, f = form(key), project = key === 'projects';
-      const value = project ? { name: f.name, ...(f.repo ? { repo: f.repo } : {}) } : { project: key, name: f.name };
+      if (!project && (current.instanceError || !(current.instances ?? []).some(row => row.instance === f.instance))) return;
+      const value = project ? { name: f.name, ...(f.repo ? { repo: f.repo } : {}) } : { project: key, name: f.name, instance: f.instance };
       void write(project ? 'createProject' : 'createThread', key, value, project ? 'projects' : 'threads');
     }
   });

packages/webui/src/serve.mjs

@@ -8,6 +8,7 @@ import { BusReadError, busStatus as coreBusStatus, subjectOk, sendOutcome } from
 // Row 176, sage-1111: HTTP-only tester refusals; the row-164 transport pin stays untouched.
 const busStatus = code => ['tester-off', 'tester-required'].includes(code) ? 403 : coreBusStatus(code);
 import { ReadError, readStatus, fieldTable } from './reads.mjs';
+import { THREAD_DEFINITIONS } from '../../business/src/vocabulary.mjs';
 import { chatHTTP } from './chat-http.mjs';
 import { processingHTTP } from './processing-http.mjs';
 
@@ -705,6 +706,25 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
       if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
       return busSend(req, res, { send, preview: signer, log });
     }
+    // Row 219: labels only, from this listener's own human or tester bus, after auth above.
+    if (path === '/api/chat/instances') {
+      if (req.method !== 'GET') return json(res, 405, { error: 'method-not-allowed' });
+      if (search) return json(res, 400, { error: 'invalid-request' });
+      if (!bus?.instances) return json(res, 503, { error: 'not-configured' });
+      try {
+        const value = await bus.instances();
+        if (!value || !value.instances || typeof value.instances !== 'object' || Array.isArray(value.instances))
+          throw new BusReadError('invalid-response');
+        const rows = Object.entries(value.instances)
+          .filter(([, entry]) => THREAD_DEFINITIONS.includes(entry?.definition))
+          .map(([instance, entry]) => ({ instance, name: entry.vars?.['persona.name'] || instance }));
+        if (rows.some(row => typeof row.name !== 'string')) throw new BusReadError('invalid-response');
+        return json(res, 200, { rows, at: new Date().toISOString() });
+      } catch (err) {
+        const code = err instanceof BusReadError ? err.code : 'invalid-response';
+        return json(res, busStatus(code), { error: code });
+      }
+    }
     if (path === '/api/chat' || path.startsWith('/api/chat/')) {
       return chatHTTP(req, res, { path, search, chat, named, send, preview: writer, log });
     }

packages/webui/tests/chat-browser.test.mjs

@@ -12,6 +12,7 @@ const HOSTILE = '<img src=x onerror="window.injected=1">\u001b[31m\u202eevil';
 const stub = `(() => {
   const real = fetch.bind(window);
   window.__writes=[];window.__reads=[];window.__answers=[];window.__pages=[];
+  window.__instances=[{instance:'assistant',name:'assistant'}];
   window.__projects=[{id:'${P}', name:${JSON.stringify(HOSTILE)}, repo:null},{id:'\"><img src=x>',name:'Invalid record'}];
   window.__threads=[{id:'${A}',project:'${P}',name:'alpha',instance:'assistant'}, {id:'${B}',project:'${P}',name:'beta',instance:'assistant'}];
   window.fetch=async (url,init={})=>{
@@ -33,6 +34,7 @@ const stub = `(() => {
     window.__reads.push(path);
     if(window.__holdRead && path.includes(window.__holdRead)){window.__heldSignal=init.signal;await new Promise(r=>window.__releaseRead=r);}
     if(window.__readFailure)return new Response(JSON.stringify({error:window.__readFailure}),{status:window.__readFailure==='thread-not-owned'?403:503});
+    if(path==='/api/chat/instances')return window.__instanceFailure ? new Response(JSON.stringify({error:'not-configured'}),{status:503}) : data({rows:window.__instances});
     if(path==='/api/chat/projects')return data({rows:window.__projects});
     if(path.startsWith('/api/chat/threads')&&!path.includes('/messages'))return data({rows:window.__threads});
     if(window.__pages.length)return data(window.__pages.shift());
@@ -82,7 +84,7 @@ test('chat browser: list/create named projects and threads, hostile labels inert
   await b.evaluate(`window.__answers.push({body:{id:'${A}',instance:'assistant'}}),true`);
   await click('#chat-thread-form button[type=submit]');
   await wait('document.querySelector("#chat-send-form")');
-  assert.deepEqual(await b.evaluate('window.__writes[1].body'), { project: P, name: 'named thread' });
+  assert.deepEqual(await b.evaluate('window.__writes[1].body'), { project: P, name: 'named thread', instance: 'assistant' });
   assert.equal(await b.evaluate('window.__writes[1].path'), '/api/chat/threads');
   assert.equal(await b.evaluate('window.__writes.length'), 2);
 });
@@ -264,3 +266,65 @@ test('chat browser: a late project creation receipt cannot navigate away from an
   assert.equal(await b.evaluate('location.hash'), '#/chat/threads/' + A);
   assert.equal(await b.evaluate('document.querySelector("#chat-body").value'), 'stay in alpha');
 });
+
+test('C2-09a picker: no silent choice, duplicate hostile labels stay inert, selection survives refresh and reaches POST', async t => {
+  const { b, wait, set, click, refresh } = await setup(t);
+  await b.evaluate(`window.__instances=[{instance:'bean',name:${JSON.stringify(HOSTILE)}},{instance:'chet',name:${JSON.stringify(HOSTILE)}}];location.hash='#/chat/projects/${P}';true`);
+  await wait('document.querySelectorAll("#chat-instance option").length===3');
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '');
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").required'), true);
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
+  const labels = await b.evaluate('[...document.querySelectorAll("#chat-instance option")].map(o=>o.textContent)');
+  assert.match(labels[1], /\(bean\)/);
+  assert.match(labels[2], /\(chet\)/);
+  assert.doesNotMatch(labels.join(''), /[\u202a-\u202e\u2066-\u2069]/u);
+  assert.equal(await b.evaluate('!!document.querySelector("#chat-thread-form img")'), false);
+  assert.equal(await b.evaluate('window.injected'), undefined);
+  await set('#chat-thread-name', 'Bean discussion');
+  await click('#chat-thread-form button');
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+  await set('#chat-instance', 'bean');
+  await refresh();
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), 'bean');
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-name").value'), 'Bean discussion');
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), false);
+  await b.evaluate(`window.__answers.push({body:{id:'${A}',instance:'bean'}});true`);
+  await click('#chat-thread-form button');
+  await wait('window.__writes.length===1');
+  assert.deepEqual(await b.evaluate('window.__writes[0]'), { path: '/api/chat/threads', body: { project: P, name: 'Bean discussion', instance: 'bean' }, redirect: 'manual' });
+});
+
+test('C2-09a picker: metadata failure, empty set and removed pick explain disabled state and recover without switching', async t => {
+  const { b, wait, set, refresh } = await setup(t);
+  await b.evaluate(`window.__instanceFailure=true;location.hash='#/chat/projects/${P}';true`);
+  await wait('document.querySelector("#chat-thread-form") && !document.querySelector(".chat-loading")');
+  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /read the thread instances/);
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
+  await b.evaluate('window.__instanceFailure=false;window.__instances=[];true');
+  await refresh();
+  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /No thread instances/);
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
+  await b.evaluate("window.__instances=[{instance:'bean',name:'Bean'},{instance:'chet',name:'Chet'}];true");
+  await refresh();
+  await set('#chat-instance', 'bean');
+  await b.evaluate("window.__instances=[{instance:'chet',name:'Chet'}];true");
+  await refresh();
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '');
+  assert.match(await b.evaluate('document.querySelector("#chat-thread-form [role=status]").textContent'), /no longer available/);
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
+  await refresh();
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), '', 'another refresh must not silently select the one remaining instance');
+  await set('#chat-instance', 'chet');
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), false);
+});
+
+test('C2-09a picker: a single instance is chosen explicitly but read-only mode cannot create a thread', async t => {
+  const { b, wait } = await setup(t, '?readonly');
+  await b.evaluate(`location.hash='#/chat/projects/${P}';true`);
+  await wait('document.querySelectorAll("#chat-instance option").length===2');
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").value'), 'assistant');
+  assert.equal(await b.evaluate('document.querySelector("#chat-instance").disabled'), true);
+  assert.equal(await b.evaluate('document.querySelector("#chat-thread-form button").disabled'), true);
+  assert.match(await b.evaluate('document.querySelector(".chat-area").textContent'), /only reads/);
+  assert.equal(await b.evaluate('window.__writes.length'), 0);
+});

packages/webui/tests/chat-instances.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { request } from 'node:http';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { startServer } from '../src/serve.mjs';
+import { startTesterSocket, TESTER_ORIGIN } from '../src/tester-socket.mjs';
+import { close } from './fixture.mjs';
+
+const path = '/api/chat/instances';
+const preview = { host: 'chat.example', header: 'x-user', user: 'jason' };
+const snapshot = {
+  revision: 'a'.repeat(64), plugins: { private: 'do-not-project' },
+  instances: {
+    assistant: { definition: 'assistant', vars: { model: 'private-model' } },
+    bean: { definition: 'companion', vars: { 'persona.name': 'Bean', 'persona.sha256': 'private-hash' } },
+    chet: { definition: 'continuity', vars: { 'persona.name': 'Bean', file: '/private/path' } },
+    pm: { definition: 'pm', vars: { 'persona.name': 'Hidden PM' } },
+  },
+};
+function get(server, { route = path, method = 'GET', headers = {} } = {}) {
+  const address = server.address(), unix = typeof address === 'string';
+  return new Promise((resolve, reject) => {
+    const req = request({ ...(unix ? { socketPath: address } : { host: '127.0.0.1', port: address.port }),
+      path: route, method, headers: { host: unix ? new URL(TESTER_ORIGIN).host : preview.host, ...headers } }, res => {
+      let text = '';
+      res.on('data', chunk => text += chunk);
+      res.on('end', () => resolve({ status: res.statusCode, text, value: JSON.parse(text) }));
+    });
+    req.on('error', reject); req.end();
+  });
+}
+test('C2-09a metadata uses the human listener bus, projects labels only and refuses unauthenticated reads', async t => {
+  let calls = 0;
+  const server = await startServer({ port: 0, preview, bus: { instances: async () => { calls++; return snapshot; } } });
+  t.after(() => close(server));
+  const refused = await get(server);
+  assert.equal(refused.status, 401);
+  assert.equal(calls, 0);
+  const answer = await get(server, { headers: { 'x-user': 'jason' } });
+  assert.equal(answer.status, 200);
+  assert.deepEqual(answer.value.rows, [{ instance: 'assistant', name: 'assistant' }, { instance: 'bean', name: 'Bean' }, { instance: 'chet', name: 'Bean' }]);
+  for (const row of answer.value.rows) assert.deepEqual(Object.keys(row).sort(), ['instance', 'name']);
+  assert.doesNotMatch(answer.text, /private|Hidden PM/);
+  assert.equal(calls, 1);
+  for (const options of [{ route: path + '?extra=1' }, { method: 'POST' }]) {
+    const result = await get(server, { ...options, headers: { 'x-user': 'jason' } });
+    assert.ok([400, 405].includes(result.status));
+  }
+  assert.equal(calls, 1, 'invalid metadata requests never call a bus');
+});
+test('C2-09a metadata uses the private tester listener own bus and no human transport', async t => {
+  const root = mkdtempSync(join(tmpdir(), 'chat219-')); t.after(() => rmSync(root, { recursive: true, force: true }));
+  let reads = 0;
+  const server = await startTesterSocket({ dataRoot: root, board: 'http://127.0.0.1:9',
+    bus: { instances: async () => { reads++; return { instances: { quill: { definition: 'proofreader', vars: { 'persona.name': 'Quill' } } } }; } } });
+  t.after(() => close(server));
+  const answer = await get(server);
+  assert.equal(answer.status, 200);
+  assert.deepEqual(answer.value.rows, [{ instance: 'quill', name: 'Quill' }]);
+  assert.equal(reads, 1);
+});
+test('C2-09a metadata refuses missing or malformed reads and never echoes untrusted fields', async t => {
+  for (const bus of [null, { instances: async () => ({ instances: [] }) }, { instances: async () => { throw new Error('private-path'); } }]) {
+    const server = await startServer({ port: 0, preview, bus }); t.after(() => close(server));
+    const answer = await get(server, { headers: { 'x-user': 'jason' } });
+    assert.ok(answer.status >= 400);
+    assert.doesNotMatch(answer.text, /private-path/);
+  }
+});
+
+test('C2-09a metadata stays behind the SSO session check and a GET never refreshes session activity', async t => {
+  let session = null, reads = 0;
+  const touches = [];
+  const sso = { publicHost: 'sso-chat.example', publicOrigin: 'https://sso-chat.example', formTargets: () => [],
+    session: (_req, { touch }) => { touches.push(touch); return session; } };
+  const server = await startServer({ port: 0, sso, bus: { instances: async () => { reads++; return snapshot; } } });
+  t.after(() => close(server));
+  const headers = { host: sso.publicHost };
+  assert.equal((await get(server, { headers })).status, 401);
+  assert.equal(reads, 0);
+  session = { name: 'jason' };
+  assert.equal((await get(server, { headers })).status, 200);
+  assert.equal(reads, 1);
+  assert.deepEqual(touches, [false, false]);
+});

packages/webui/tests/chat.test.mjs

@@ -335,3 +335,21 @@ test('the chat seam names the transport it is given: the human one and the teste
   assert.throws(() => createChat({}), { name: 'TypeError', message: 'chat needs a bus transport function' });
   assert.equal(typeof createChat({ call: async () => ({}) }).projects, 'function');
 });
+
+test('C2-09a createThread forwards an explicit instance through the existing channel', async t => {
+  const c = await setup(t);
+  c.state.answer = { id: T, instance: 'bean' };
+  const answer = await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'Bean work', instance: 'bean' } });
+  assert.equal(answer.status, 200);
+  assert.deepEqual(c.calls, [['thread.create', { project: P, name: 'Bean work', instance: 'bean' }]]);
+  assert.equal(answer.data.instance, 'bean');
+});
+test('C2-09a malformed instance and extra thread fields refuse before the channel write', async t => {
+  const c = await setup(t);
+  for (const value of [null, 7, {}, [], '', 'bad name', 'bean/../../other']) {
+    const answer = await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'work', instance: value } });
+    assert.equal(answer.status, 400, JSON.stringify(value));
+  }
+  assert.equal((await c.get('/api/chat/threads', { method: 'POST', value: { project: P, name: 'work', instance: 'bean', extra: true } })).status, 400);
+  assert.deepEqual(c.calls, []);
+});