test(plugins): review round for the shipped starter packs (#1873 SP2)

The SP1 listing test also requires a nonempty shipped listing, and a new SP2 case pins that installing a plug-in named after any shipped pack refuses core-name, so an installed pack cannot replace one.
feat(plugins): the five shipped starter packs (#1873 SP2)
2026-11-12 16:06:08 -06:00 · 2026-11-12 16:06:08 -06:00 · 2026-11-12 16:00:42 -06:00 · 2026-11-12 15:47:32 -06:00 · 2026-11-12 15:38:01 -06:00 · 2026-11-12 15:38:01 -06:00
376 changed files with 30299 additions and 2449 deletions
@@ -42,9 +42,15 @@ green at every step. Not production software — a proven foundation.
   rewritten, only pruned via `prune` with a receipt.
 6. **Fail closed**: missing or invalid config/policy refuses the operation.
   Never improvise around a refusal; diagnose it.
-7. **Policy**: missions govern tasks (least-privilege intersection — a task
-   narrows, never widens). Role authority is declared in `roles/` and changes
-   only via reviewed commits.
+7. **Policy**: missions govern tasks; a task narrows, never widens. The
+   rails, the core vocabulary of tools and actions, and the shipped role
+   templates in `roles/` change only by reviewed commit. An organization's
+   own roles are copies or compositions of known parts. One takes effect
+   only through a decision, resolved where the organization's owner-set
+   autonomy level sends it, by default a human with `org.hire`. The
+   decision lists every grant above the chief's own as a flagged line,
+   which only the owner approves. Only the chief raises hires, and a hired
+   agent cannot hire.
 8. **Git**: commit only after applicable suites are green. Work on the
   owner-authorized `refactor` branch; never force-push. Push remains an explicit
   act. Do not merge into `next` or `main` without separate authorization.
@@ -104,7 +110,8 @@ Finish all independent work first, then ask one focused question only when:

 Repository gates still apply. In particular, a successful implementation or a
 broad request to “finish” does not by itself authorize push, merge, deployment,
-release, production changes, policy/role expansion, or access to secrets. Perform
+release, production changes, policy/role expansion, or access to secrets. An approved
+hire decision is that authority for the one agent it names. Perform
 such an action only when the established plan explicitly includes it. If blocked,
 report the exact boundary, what is complete, the recommended resolution, and the
 specific action that will resume; do not use “waiting for confirmation” as a
@@ -206,7 +213,7 @@ Full reference — usage, fields, exit codes, safety notes:
 - `LAYERS.md` — implemented vs deferred layers
 - `docs/SESSIONS.md` — session registry
 - `adapters/README.md` — the harness adapter contract
- `roles/` — role contracts (conductor, future agent/coder/reviewer)
+- `roles/` — shipped role templates and the conductor policy

 ## Recovery rule

@@ -309,10 +309,19 @@ scripts/mosaic inbox | tasks | agents [--business <id>] [--json]
 scripts/mosaic inbox --read <id>... | --read-all [--business <id>]
 scripts/mosaic decide <decision> <option> [--note <text>] [--yes]
 scripts/mosaic trail <task|decision> [--json]
-scripts/mosaic bus start <business> [--pm | --no-launch] [--dev-local-owner] | stop | status [--json]
+scripts/mosaic bus start <business> [--pm | --no-launch] [--dev-local-owner] [--detach] | stop | restart | recover | status [--json]
 scripts/mosaic console start [--dev-local-owner [--dev-insecure-bind ADDR --dev-allow-host NAME[,NAME...]]] [--detach] [--port auto|N]
 scripts/mosaic console stop | status | restart
 scripts/mosaic org reload <org>
+scripts/mosaic org role-templates <org> [--json]
+scripts/mosaic org hire|change <org> --name <name> --template <template> --harness <harness> --model <model> [--thinking <level>] [--level org|project|root] [--project <project>] --reason <text> [--json]
+scripts/mosaic org fire <org> --name <name> [--level org|project|root] [--project <project>] --reason <text> [--json]
+scripts/mosaic org autonomy <org> [--json]
+scripts/mosaic org autonomy <org> set --revision <rev> [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours 1-168] [--authority-resolver <name>|""] [--json]
+scripts/mosaic org autonomy <org> review cross-role|merge|policy|authority [--json]
+scripts/mosaic tasks create --title <text> --requirement <REQ-X-N> [--project <name>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+scripts/mosaic tasks edit task:<n> --expect <digest> [--title ...] [--state ...] [--assignees ...] [--priority ...] [--due ...] --business <id> [--json]
+scripts/mosaic tasks archive task:<n> --expect <digest> --business <id> [--json]
 scripts/mosaic talk <role> <text> [--wait SECONDS] [--business <id>]
 scripts/mosaic project create <name> [--repo <repo>] | list [--json]
 scripts/mosaic threads [--project <project>] [--json] [--tester]
@@ -333,7 +342,11 @@ For local development on a named instance only, `mosaic bus start BUSINESS --dev

 `mosaic console start --dev-local-owner --dev-insecure-bind ADDR --dev-allow-host NAME[,NAME...]` opens that dev owner Console to other machines, for UI testing from another device on a trusted LAN. It has no sign-in: anyone who can reach ADDR:PORT acts as the owner. Start, and `mosaic console status` while that Console runs, print `WARNING: dev owner Console listens on ADDR:PORT with no sign-in; anyone who can reach it acts as the owner.` on stderr. ADDR is `0.0.0.0` or an IPv4 address, and a specific address must also be one of the names. NAME is a host name or IPv4 address without a port; give several as one comma-separated value. The Console answers only `NAME:<bound port>` and the loopback names, and takes a write only when Origin is `http://` plus that same Host. A browser on such an http origin sends no Fetch Metadata, so for an allowed NAME a write with that exact Origin and no `Sec-Fetch-Site` counts as same-origin; a `Sec-Fetch-Site` the browser did send is still checked. Both flags are refused without `--dev-local-owner`, and `--dev-insecure-bind` is refused without a `--dev-allow-host`. SSO, preview and tester Consoles stay on loopback. The Console state file records `bind` and `allowHosts`. `mosaic console status` prints the state as JSON (`bind` is `127.0.0.1` for a loopback Console) and never moves a stale state file.

-`mosaic console restart` and `mosaic org reload ORG` are the Console's Settings controls (F3) from a terminal (U1, #1873). Each sends one request to the running Console named in the instance's console state, as the page sends it (the Console's own Host and Origin, `Sec-Fetch-Site: same-origin`, a JSON `{}` body), so the Console applies the same owner, `--send` and origin checks and writes the same action trail, `<dataRoot>/console/actions.jsonl`. Both refuse inside an agent run (exit 3) before reading anything, and refuse with exit 3 when no Console runs. `console restart` works only for a Console started in the foreground by `mosaic console start` (otherwise the Console answers `not-supervised`); it waits up to 30 seconds for the relaunched Console to answer and prints `{"outcome":"restarted","from":OLD,"boot":NEW}`. `org reload ORG` restarts a running bus or starts a stopped one and prints the Console's done receipt. A request that left but got no answer is reported as outcome unknown (exit 1) and is never retried; check `mosaic console status`, `mosaic bus status ORG` and the trail. `mosaic bus restart ORG` remains the trail-less host verb.
+`mosaic console restart` and `mosaic org reload ORG` are the Console's Settings controls (F3) from a terminal (U1, #1873). Each sends one request to the running Console named in the instance's console state, as the page sends it (the Console's own Host and Origin, `Sec-Fetch-Site: same-origin`, a JSON `{}` body), so the Console applies the same owner, `--send` and origin checks and writes the same action trail, `<dataRoot>/console/actions.jsonl`. Both refuse inside an agent run (exit 3) before reading anything, and refuse with exit 3 when no Console runs. `console restart` works only for a Console started in the foreground by `mosaic console start`, or by `mosaic console start --dev-local-owner --detach`, which leaves a detached supervisor (`packages/cli/src/console-supervisor.mjs`, its own session) running the Console as the foreground start does; its receipt adds the supervisor's `supervisor` pid, and its later warnings go to `console/supervisor-*.log` under the data root. `mosaic console stop` stops that Console, and its supervisor then exits. `mosaic console start` refuses inside an agent run (exit 3), with or without `--dev-local-owner` or `--detach`, checking the starting process's own environment as well as the one given for the Console (agent-guard, #1873). A detached start whose supervisor does not reply within 60 seconds signals the supervisor's process group, then kills it, and clears `console/start.lock` only when the lock names that supervisor (pid and start time) and it is gone. Any other Console answers `not-supervised`. `console restart` waits up to 30 seconds for the relaunched Console to answer and prints `{"outcome":"restarted","from":OLD,"boot":NEW}`. `org reload ORG` restarts a running bus or starts a stopped one and prints the Console's done receipt. A request that left but got no answer is reported as outcome unknown (exit 1) and is never retried; check `mosaic console status`, `mosaic bus status ORG` and the trail. `mosaic bus restart ORG` remains the trail-less host verb.
+
+The hire form and the autonomy panel from a terminal (E2, #1873, P1-3). `mosaic org role-templates|hire|fire|change ORG` and `mosaic org autonomy ORG [set|review]` send the page's own request to the running Console's org route (`/api/orgs/ORG/decisions/hire/templates|start`, `/api/orgs/ORG/autonomy[/review]`), as `org reload` does, so the Console applies the same owner, `--send`, origin, body and live-session checks and the same bus verbs run (`hire.templates.console`, `hire.start.console`, `autonomy.get.console`, `autonomy.set.console`, `autonomy.review.console`). `hire` and `change` read the templates first and send the chosen template's name and sha256, as the form does. `autonomy set` needs the 64-hex `--revision` from `mosaic org autonomy ORG` and sends every setting the panel sends, with only the named ones changed; a stale revision is refused `revision-conflict`; an empty `--authority-resolver ""` clears the resolver, as emptying the panel's field does. These verbs need a named instance (`MOSAIC_CONFIG` set to `~/.config/mosaic-NAME/config.json`) whose Console runs with `--dev-local-owner`; the default instance is refused with exit 3. A Console refusal exits 3 with the Console's code and message; `outcome-unknown` exits 1; an unknown template exits 2. Every one of these verbs, reads included, refuses inside an agent run. `mosaic tasks create|edit|archive` are the task board's three writes: the arguments pass the board's own check (`workspace-tasks.mjs parseTaskWrite`) and go to the bus as the person (`tasks.create|edit|archive`, human transport), so the bus runs its human, field, digest and archive checks. A stale `--expect` is refused `task-conflict`; read the digest with `mosaic tasks --json`.
+
+The bus and Console lifecycle verbs refuse inside an agent run (agent-guard, #1873): `mosaic bus start`, `bus stop`, `bus restart` and `bus recover`, and `mosaic console start`, `console stop` and `console restart`, and `mosaic org archive` and `org delete`, which stop the organization's bus, and `mosaic org restore`, which starts it (`org restore --no-bus` starts nothing and is not refused), and `mosaic org role-templates`, `hire`, `fire`, `change` and `autonomy` (E2). Each exits 3 with `refused: this runs only from a human shell, outside any agent run (found MARKER in the environment)` before it reads anything. It checks the environment it is given and its own process environment, so a sanitized environment does not hide a marker. A usage error (a missing or extra argument, `--pm` with `--no-launch`, or a bad `--dev-insecure-bind`/`--dev-allow-host`) still comes first (exit 4). `mosaic bus status` and `mosaic console status` stay open to agents. The Console's Restart bus and Restart Console controls keep working: the Console starts its bus host with its own environment, which carries no marker, and Restart Console relaunches the Console under its supervisor without going through the CLI. The markers are the ones `packages/cli/src/transport.mjs` lists. The check is cooperative: a process that drops the markers from its environment is not stopped by it.

 The instance processing switch is separate from per-business launches off/on.
 `mosaic halt` durably stops managed processing across every business in the
@@ -807,13 +820,52 @@ the port and the backup's `SHA256SUMS`. Then it makes
  Roles come from the target copy's `roles/`, as the live bus reads them.
 - `steps.log` holds the same PASS and FAIL lines the run prints, with times;
  `host.log`, `console.log` and, after a migration, `migrate.log` sit beside it.
+- When the live config has `console.sso` (M3, #1873), the scratch copy keeps
+  its provider ids, client ids, algorithms and subjects and moves the public
+  origin to `rehearsal.invalid`, a name that never resolves. For a stamped
+  target each issuer becomes `ORIGIN/ID/` at the rehearsal provider below;
+  otherwise it moves to `rehearsal.invalid` too. Each client secret slot is a 0600 file under `config/secrets/mosaic-stack/`
+  holding `rehearsal-placeholder-secret`; the live secret is never read.
+
+A stamped target copy (one with `.stack-build.json`) serves only with `--sso`,
+so its rehearsal needs the live instance's human-made SSO steps. Without a live
+`console.sso` it refuses `sso-not-prepared`; without the live `accounts.json`
+beside the config it refuses `accounts-not-initialized`. Both name the run-sheet
+step. Otherwise it copies the live `accounts.json` into `config/`, writes
+`data/.deployed` with the target copy's own `writeDeployment`, prints
+`PASS deployment`, and starts the Console with `--sso`.
+
+Before that, a stamped run starts a rehearsal provider and prints
+`PASS provider-start`. It is a node process on `127.0.0.1` port 0 that serves
+HTTPS with a certificate made for this run, under `provider/` (mode 0700). For
+each live provider id it serves discovery and a JWKS whose public key it made
+in memory for the first algorithm it can make from that provider's list. Its
+authorize and token routes answer 403 to any method and query: it issues no
+code and no token, and
+it reads no live secret. It logs each request to `provider/requests.log`,
+deletes its TLS key file once it has read it, and exits on SIGTERM or when
+the rehearsal's process is gone. `provider-start` fails when it exits early,
+writes no origin within the timeout, writes an origin that is not
+`https://127.0.0.1:PORT`, or leaves its key file. Only the scratch Console gets
+`NODE_EXTRA_CA_CERTS` naming `provider/cert.pem`; the host does not.
+
+The scratch Console runs every startup check against that provider. The gate
+adds `sso-ready`: `/healthz` must report each provider `ready`. After the gate,
+`provider-discovery` requires a 200 discovery and JWKS request per provider and
+no authorize or token request. The end stops the provider with the Console and
+host and prints `provider-stopped`. The live `accounts.json` joins the end check
+`live-config-unchanged`. The rehearsal adds no subject and no account.

 A guard then loads the scratch config with the target's code and refuses
 with a named check: `data-root-live` when the scratch data root resolves to
 the live one, `sessions-live` when a `sessions.json` there names a running
 pid (the run never deletes the file), `data-root-scratch`, `notify-off`,
-`tracker-configured` when `bootConfig` still sets a tracker, and
-`credential-ref-live` for an env reference or a file outside `placeholders/`.
+`tracker-configured` when `bootConfig` still sets a tracker,
+`credential-ref-live` for an env reference or a file outside `placeholders/`,
+and `sso-isolated` when a `console.sso` origin is not on `rehearsal.invalid`,
+an issuer is not `ORIGIN/ID/` at the rehearsal provider (not on
+`rehearsal.invalid` for an unstamped target), or a slot is not its scratch
+placeholder.
 When the backup's schema differs from the target's, the run checks that the
 target refuses the store, migrates it, opens it, migrates it again as a
 no-op, and that the pointer's copy refuses the migrated store.
@@ -822,7 +874,8 @@ It starts `scripts/mosaic bus start BUSINESS --no-launch` and the Console's
 `serve --port N --business BUSINESS` from the target copy, without `--send`.
 The gate needs the host's `launches disabled` line, a live `bus status` host
 with this run's pid and a boot from this start, the Console's address line,
-`/healthz` 200, and both command lines on the target copy. Then it checks
+`/healthz` 200 (and `sso-ready` for a stamped target), and both command lines
+on the target copy. Then it checks
 that the host wrote no `sessions.json` and no `launches`, stops the Console
 and the host (SIGTERM, then SIGKILL and a FAIL after the timeout), checks that
 the host released `writer.lock`, and compares the backup and the live config
@@ -834,6 +887,21 @@ Usage exits 4. Nothing prunes rehearsal directories.
 starts no thread ticker, and leaves an earlier host's `sessions.json` and
 its runs alone. No unit passes it, and `--pm` with it is a usage error.

+An accounts instance runs system units (M3, #1873). Without `--units external`,
+`activate`, `rollback` and `pm-on` refuse `accounts-user-unit`, before
+anything stops and before `--plan` prints, when the target copy holds a
+`.stack-build.json` (a stamped copy), when `accounts.json` sits beside the
+config, when the config holds `console.sso`, or when `<dataRoot>/.deployed`
+exists. A config that cannot be read as JSON refuses as well. The message
+names the first sign found and says root renders the units with
+`case2-unit.sh`. For `activate` and `rollback` it adds that the run takes
+`--units external`. For `pm-on` it says the PM is a flag in root's bus unit.
+So a user-unit run never turns `--sso` on any more. The `--sso`, `sso-slot`
+and `--no-sso` text above describes the pointers that pre-M3 hosts left, and
+the Console's own start checks the slot (`readSlot` in
+`packages/webui/src/sso.mjs`). A rollback or `--no-sso` from such a pointer
+runs once `console.sso` is gone and no other sign is present.
+
 #### Root-owned units (`--units external`, row 232)

 On a host whose bus and Console are root's system units, the stack user runs
@@ -894,8 +962,9 @@ the target migrates the store and the run lacks `--migrate` (row 233). Under

 ```
 scripts/stack-upgrade.sh upgrade --instance dev --bundle FILE --sha SHA [--migrate] [--no-rehearsal]
-    [--rehearse-port N] [--timeout S]
-scripts/stack-upgrade.sh rollback --instance dev --to ID [--restore ACT [--events N]] [--timeout S]
+    [--rehearse-port N] [--next-args] [--timeout S]
+scripts/stack-upgrade.sh rollback --instance dev --to ID [--restore ACT [--events N]] [--next-args]
+    [--timeout S]
 ```

 Root runs it from a root-owned checkout of the reviewed commit, never from a
@@ -935,7 +1004,13 @@ user's clone `<home>/src/mosaic-stack`:
   (`args-differ`), and
   `activate SHA BUSINESS --units external --plan --expect-from OLD` exits 0
   (`plan-refused`, which covers `open-activation`, `migrate-required` and
-   `pointer-differs`).
+   `pointer-differs`). Then the render checks (#1873 M3):
+   `case2-unit.sh --check` renders OLD from the args file and compares the
+   installed units with it, so a rollback could render them, then checks
+   SHA's render the same way. Either refusal is `render-refused`. A re-pin
+   that changes the serve flags fails the second check, because an
+   installed unit must equal the render but for the copy id (row 195); it
+   takes `--next-args`, below.
 4. The rehearsal, `rehearse SHA BUSINESS --backup last --port 7339`
   (`--rehearse-port`). Exit 0 goes on. Exit 3 means no backup in the log
   and goes on only with `--no-rehearsal`, logging `rehearsal-skipped`;
@@ -950,6 +1025,22 @@ user's clone `<home>/src/mosaic-stack`:
   still names the old one, and root moves the new file (the result line
   names it) into place by hand.

+`--next-args` changes the serve flags, as the SSO migration does
+(`docs/guides/host-run-sheet.md` section 7). The run reads
+`/etc/mosaic-stack/dev.args.next` as it reads the args file
+(`args-unreadable`). It must equal the args file before `--` but for
+`--copy`'s value (`next-args-differ`) and differ from it after `--`
+(`next-args-same`). The target's check is `case2-unit.sh --check-new`, a
+first install's checks from the next args, without the installed units'.
+After A3, root moves the installed unit files into a new 0700 directory
+`/etc/mosaic-stack/dev.replaced.XXXXXX` (step `units-aside`), so A4 renders
+as a first install. A failure from there moves them back unchanged
+(`units-back`), runs `daemon-reload` and starts the old units with no render.
+After A5 the old args file is copied into the replaced directory, the next
+args file is removed (step `next-args`), and the new args file, made from
+the next args, moves into place. The result line names the replaced
+directory. Nothing removes it.
+
 A failure in A2 or a stage that exits 3 starts the old units again and gates
 them (A2f). A later failure stops both units, runs `revert`, renders the old
 copy and runs `confirm --rollback OLD --cause A3|A4|A5`. `rollback` is the
@@ -1267,6 +1358,23 @@ input; error on stderr, never a clean verdict).
 problem. Scripts print diagnostics on stderr; model responses (and only
 model responses) on stdout.

+## Model proxy setup (`scripts/mosaic proxy`, #1873)
+
+Human-shell verbs that match the Console's Proxy setup panel; each refuses
+`human-required` in an agent shell or with `--tester`, and prints no key or
+absolute path. `proxy fetch` (existing output unchanged) now prints the
+page's progress steps on stderr and writes the same fetch receipt to
+`<dataRoot>/state/proxy-admin.jsonl`. `proxy status [--json]` shows release, init, unit, fence, init
+lock, own proxy and the next step. `proxy init --generate-key [--port N]
+[--rotate-grace-minutes N] [--first-output-seconds N] --business ID` has the
+bus generate the management key (no prompt, no TTY). `proxy unit
+render|status|install|start|stop|restart` manages the proxy user unit.
+`proxy fence clear --restart --business ID` restarts the unit, requires a
+confirmed new process listening on the port, then clears the fence with that
+evidence (`proxy-restart-unconfirmed` otherwise). `proxy init-lock
+status|clear` clears a stale init lock only when every bus is stopped and no
+proxy state exists. Details: `packages/model-proxy/README.md`.
+
 ## Agent limits (`scripts/mosaic limits`)

 View: `scripts/mosaic limits --business ID --json`. Set: `scripts/mosaic limits
@@ -386,10 +386,15 @@ then the bus, then the proxy, re-render all three onto the selected copy, and st
 then the Console. Recovery after a failed upgrade restores all three to the old copy. A missing or
 disagreeing proxy unit, or an installed proxy without `--proxy` in the args file, refuses before anything stops.

-For the `library` profile, the serve argv after `--` keeps the proxy-preview trio and required proof pair
-but omits `--send`. That Console is read-only until Case 2 gains real OIDC in #412; `case2-unit.sh`
-explicitly refuses `--send`. Proxy preview and proof-protected reads remain available. The `factory`
-profile and its private tester socket are unchanged.
+A stamped copy, which is every copy `stack-copy.sh` makes, signs in through SSO accounts in both profiles
+(M3, #1873; Jason's ruling 2026-11-10). After `--`, the `factory` profile takes `--sso --send` with its
+private tester socket. The `library` profile takes a bare `--sso`, still without `--send`, so its Console
+stays read-only. A stamped library copy refuses the proxy-preview trio (`--public-host`, `--auth-header`,
+`--allow-user`) and the proof pair (`--proof-header`, `--proof-file`): proxy-preview admission does not
+apply to a stamped copy. Only an unstamped library copy, which no host install makes, keeps the old
+proxy-preview argv and refuses `--sso`. Before writing anything, `case2-unit.sh` refuses a stamped copy
+that lacks `--sso` or any prerequisite and names each missing step. The migration below lists them in
+order.

 A library host installed before #385 has `--send` in two places, because the earlier `case2-unit.sh`
 required it: a `--send` line after `--` in the args file, and `--send` in the installed Console unit's
@@ -418,10 +423,83 @@ grep -n '^ExecStart=' /etc/systemd/system/mosaic-webui.service | grep -c -- ' --
  lead with the command's output. Removing only the args line does not help: the run then refuses
  `console-unit-legacy`.

-The Console stays read-only after the upgrade, until #412 (#385).
+The library Console stays read-only after the upgrade (#385). From M3 it signs in through SSO
+accounts, as the migration below sets up.

-Precheck line: none. `stack-upgrade.sh` refuses `args-unreadable` or `console-unit-legacy` on any of these
-rules, before it stops a unit.
+### Migrating a host to SSO accounts (M3, #1873)
+
+A host re-pinned onto an M3 copy migrates first, in this order. The order is the same for the `factory`
+(Case 1 and .53) and `library` (.54) profiles. Each step is a live step that needs Mos's go. Nothing in the
+stack picks or invents a subject: the subjects come from `console.sso`, which a human prepares, and
+`accounts.json` comes only from the human verb `mosaic accounts init`.
+
+1. Check or create `.deployed` through the installer. The stack's user's `case2-install.sh` (section 6)
+   writes `<dataRoot>/.deployed` naming the instance at its step 2. It never replaces an existing one, and
+   it refuses one that is invalid or names another instance. Check it read-only:
+   `stat -c '%U %a' <dataRoot>/.deployed` prints `mosaic 444`.
+2. Prepare SSO. A human adds `console.sso` to `/srv/mosaic/.config/mosaic-dev/config.json`, with its
+   providers, their subjects and its client-secret slots, per
+   `docs/plans/2026-11-10_accounts-design.md`. Jason places the client secrets (section 9).
+3. Run `mosaic accounts init --name <name>` as `mosaic`. This is a human verb, run from a human shell and
+   never by an agent. It creates the one operator account from the configured `console.sso` subjects and
+   refuses if `accounts.json` exists. It also refuses `accounts-unsafe` when any folder above the config
+   directory is not root's or `mosaic`'s, or is group or other writable without the sticky bit (#1919).
+   Check first, read-only: every line printed by
+   `p=/srv/mosaic/.config/mosaic-dev; while [ "$p" != / ]; do stat -c '%U %a %n' "$p"; p=$(dirname "$p"); done; stat -c '%U %a %n' /`
+   names `root` or `mosaic`, and its mode has no group or other write bit unless it starts with 1 (sticky).
+   The config directory itself is `mosaic`'s with no group or other write bit. A group-writable `.config`
+   refuses on purpose; fix the mode, never the check.
+4. Provision the dedicated uid. `mosaic` must keep section 1's shape: a non-login shell, the only member
+   of its primary group, and owner of its config directory and data root. An accounts instance never runs
+   under a human or development seat uid, and never under the `webui-service.sh` user units.
+5. Re-pin with `--next-args`. Leave `/etc/mosaic-stack/dev.args` as it is. Write the new flags to
+   `/etc/mosaic-stack/dev.args.next`, root's, mode 0640: the same lines before `--`, and after `--` the
+   serve flags with `--sso` added (`factory`: `--sso --send`). For `library`, also remove the
+   proxy-preview trio (`--public-host`, `--auth-header`, `--allow-user`) and the proof pair
+   (`--proof-header`, `--proof-file`). Then run
+   `stack-upgrade.sh upgrade --instance dev --bundle FILE --sha SHA --next-args`.
+
+   A plain re-pin refuses `render-refused` here, because an installed unit must equal the render but for
+   the copy id. With `--next-args`, before anything stops, the driver checks the installed copy against
+   `dev.args` and the target as a first install from `dev.args.next`. It refuses `next-args-differ` when
+   the files differ before `--` (other than `--copy`), and `next-args-same` when they do not differ after
+   it. After the stage it moves the installed unit files into a new 0700 directory
+   `/etc/mosaic-stack/dev.replaced.XXXXXX` and renders the target as a first install. A failure from
+   there moves them back unchanged and starts the old copy again. After `confirm` passes,
+   `dev.args.next` becomes `dev.args`, and the replaced directory keeps the old unit files and the old
+   `dev.args`. The result line names the directory. Nothing removes it; root removes it by hand once no
+   rollback needs it.
+
+   To roll back past the migration, put the replaced args back as the next args and roll back with
+   `--next-args`:
+
+   ```sh
+   install -m 0640 -o root -g root /etc/mosaic-stack/dev.replaced.XXXXXX/dev.args /etc/mosaic-stack/dev.args.next
+   stack-upgrade.sh rollback --instance dev --to <old copy id> --next-args
+   ```
+
+   For `library` this is the only rollback to a copy older than M3: `case2-unit.sh` refuses `--sso` for
+   an unstamped library copy (#416), so the old copy comes back with its old flags, proxy-preview
+   admission included, as before the migration. A `factory` rollback may instead keep `--sso --send`
+   with a plain `rollback`.
+
+If a step is missing, `case2-unit.sh` refuses before it writes a unit and prints the missing steps,
+numbered in this order, for example:
+
+```text
+case2-unit: refusing the units for <sha>: a stamped copy's Console starts only with SSO accounts; missing steps, in order:
+  1. check or create .deployed: mosaic runs case2-install.sh, whose deployment step writes <dataRoot>/.deployed
+  2. prepare SSO: console.sso in mosaic's system config /srv/mosaic/.config/mosaic-dev/config.json, with its client secret slots
+  3. run `mosaic accounts init` as mosaic, a human verb: no /srv/mosaic/.config/mosaic-dev/accounts.json
+  4. add --sso to the serve flags, then re-pin
+```
+
+Without `console.sso`, the render does not check `accounts.json`, because its subjects name providers SSO
+has not configured yet. The next render after step 2 checks it. A rollback never removes accounts.json,
+its receipts or `.deployed` (`docs/plans/2026-11-10_accounts-design.md`, section 7).
+
+Precheck line: none. `stack-upgrade.sh` refuses `args-unreadable`, `console-unit-legacy`, `render-refused`,
+`next-args-differ` or `next-args-same` on any of these rules, before it stops a unit.

 ## 8. Enrollment, once per host

@@ -450,7 +528,7 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
 | Path | File | Mode | Owner | Profile | Precheck line |
 |---|---|---|---|---|---|
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `ZAI_API_KEY=...` | 0600 | mosaic | library | `<path> sets ZAI_API_KEY` |
-| `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names: one base64url line, at least 32 `[A-Za-z0-9_-]` characters, with one optional trailing LF (`packages/webui/src/serve.mjs:263-264`) | 0600 or 0400 | mosaic | library | none. Render checks metadata only and never opens the file (`scripts/case2-unit.sh:397-408`). Bad bytes refuse at Console start with exit 2 (`packages/webui/src/serve.mjs:267`, `packages/webui/src/cli.mjs:138-140`). Precheck line missing. |
+| `/srv/mosaic/.config/mosaic-dev/secrets/` | before M3 only, and an unstamped copy only: the Console's proof file, the path the args file's `--proof-file` names. A stamped copy refuses `--proof-file` (section 7). The file is one base64url line, at least 32 `[A-Za-z0-9_-]` characters, with one optional trailing LF (`packages/webui/src/serve.mjs:263-264`) | 0600 or 0400 | mosaic | library | none. Render checks metadata only and never opens the file (`scripts/case2-unit.sh:397-408`). Bad bytes refuse at Console start with exit 2 (`packages/webui/src/serve.mjs:267`, `packages/webui/src/cli.mjs:138-140`). Precheck line missing. |
 | `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | After a unit start, wait for loopback `/healthz` with the bounded retry in section 10 before `case2-precheck.sh --business <business> --library-status`: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |

@@ -108,7 +108,10 @@ configured subject (`packages/cli/src/config.mjs:141`), and
  `packages/webui/src/cli.mjs serve` from that copy. Its flag set is
  `--port`, `--business`, `--board`, `--sso`, `--send` and the header
  preview set (`webui-service.sh:98`). It has no dev-owner flag.
-  `scripts/case2-unit.sh` renders Case 2 units the same way.
+  `scripts/case2-unit.sh` renders Case 2 units the same way. At BASE its
+  library profile takes the preview set and refuses `--sso`. Under the
+  owner ruling of 2026-11-10 a stamped library copy signs in through SSO
+  accounts instead (section 6, item 5).

 ### Organizations and who may read them

@@ -1231,7 +1234,13 @@ The executable boundary:
   this instance, and accounts.json loads. The Case 1 and Case 2 installers
   write `.deployed`.
 5. **The unit renderers have no dev flag.** `webui-service.sh` and
-   `case2-unit.sh` accept no dev flag today (`webui-service.sh:98`). M3 adds
+   `case2-unit.sh` accept no dev flag today (`webui-service.sh:98`). For a
+   stamped copy, `case2-unit.sh` renders either profile, factory or library,
+   only with `--sso`, `console.sso`, a loading accounts.json and a valid
+   `.deployed`, and refuses before any write, naming each missing step. A
+   stamped library unit refuses proxy-preview admission and its proof flags:
+   proxy-preview does not apply to a stamped copy. The dev and unstamped
+   paths keep the preview set. M3 adds
   a test that pins it.

 The instance boundary, which also covers a checkout started by mistake on a
@@ -1289,13 +1298,22 @@ business file.

 ### Rollback

-Rollback keeps OIDC. Nothing in it removes `--sso` or turns sign-in off.
+Rollback keeps OIDC. Nothing in it removes `--sso` or turns sign-in off,
+except the library rollback past the migration below.

 - The supported rollback is a pinned code and config rollback: install the
  earlier stack copy with the same unit flags, including `--sso`, through
-  `webui-service.sh install --copy <earlier id>`, as the unit script
-  already describes. Leave accounts.json, its receipts and `.deployed` in
+  `stack-upgrade.sh rollback --instance NAME --to <earlier id>` for the
+  dedicated system units. The accounts instance must not use the
+  `webui-service.sh` user-unit path. Leave accounts.json, its receipts and `.deployed` in
  place. BASE code ignores them, and the next roll-forward needs them.
+- A library host rolled back to a copy older than M3 is the exception.
+  `case2-unit.sh` refuses `--sso` for an unstamped library copy (#416), so
+  that rollback renders the old copy from the args file the migration
+  replaced, through `stack-upgrade.sh rollback ... --next-args`
+  (`docs/guides/host-run-sheet.md` section 7). The old copy comes back with
+  its old flags, proxy-preview admission included, as before the migration.
+  accounts.json and `.deployed` stay in place.
 - Before the first accounts org exists, that rollback restores today's
  behavior completely. `console.sso` owners sign in as before, and FED R6
  users keep their root grants. Account-only users and pending invites stop
@@ -1450,6 +1468,9 @@ Acceptance tests, against a fake OIDC provider on port 0:
 - `--dev-local-owner` from a checkout refuses with accounts.json present,
  with `console.sso`, and with `.deployed`.
 - `webui-service.sh render` and `case2-unit.sh` refuse a dev flag.
+- For a stamped copy, `case2-unit.sh` renders a library or factory unit
+  only with `--sso` and the prerequisites, names each missing step before
+  any write, and refuses the proxy-preview and proof flags.
 - `case2-unit.sh` accepts the host run sheet's `mosaic` account fixture only
  when its shell is non-login, its primary group has no other members, and
  it owns the config directory and data root. Fixtures for a human login and
@@ -1666,6 +1687,8 @@ and draft 3 applies them. No question from draft 2 remains open.
 | May an invite bind to an email domain? | "agreed" | No domain binding. Section 4 binding, test in M6. |
 | May members read the board and write tasks? | "Similar to 1. grantable right via RBAC. Default owner R/W, member R" | The `board.read` and `task.write` rights. `member` holds `board.read` only. Section 3, slices M1, M5 and M7. |

+The library Console signs in through SSO accounts like every deployed Console; proxy-preview admission does not apply to a stamped copy.
+
 ### Choices made under the rulings

 These are decided in this draft, not open. Each one is a single reviewed
@@ -1,5 +1,7 @@
 # System-type toolsets at launch

+Superseded 2026-11-12 by `docs/plans/2026-11-12_starter-packs-design.md` under Jason's starter-packs ruling; do not build this design.
+
 Status: design only. Nothing here is built and no `roles/` or contract file is
 changed. Prepared 2026-11-10 against `refactor` `8630b8dfc` for phase P2 of
 #1873 (unified workspace). PRD requirement: REQ-SYS-2, "An agent working in a
@@ -0,0 +1,450 @@
+# Credential binding for agent copies
+
+Date: 2026-11-11 UTC. Lane `org-cred-bind-design`, issue #1873.
+Status: proposed, for Jason's approval before implementation. Doc only.
+Baseline: `6415e81ee75a6783b889b67b985f61825f9a074e` (`origin/refactor`).
+All current-code citations below refer to that commit. References to other
+designs describe proposed policy, not a claim that it is implemented.
+
+## 1. Outcome and boundaries
+
+An owner can approve a credential binding for one root or project agent copy
+inside one organization. A launch uses only that copy's own secret slot,
+with verified service permissions bounded by its frozen role and the
+organization's narrower approval. No agent can bind credentials for itself
+or another agent. Missing, stale or uncertain authority refuses launch and
+credential use. Copies in other organizations remain independent.
+
+This proposes a writer, schema and enforcement changes for later slices. It
+changes no code, right, role, contract, secret or running instance. Host and
+model credentials remain on their existing grant and proxy paths. There is
+no migration of named-agent credentials, no root-wide secret binding, no
+shared token pool, and no new plugin service in the first build.
+
+Owner direction requires each non-assistant agent's credentials to stay
+inside its organization even when its definition comes from root
+(`docs/plans/2026-11-09_unified-workspace-owner-direction.md:124-131`). A3
+explicitly deferred binding and its two-org thread-copy test
+(`/mnt/storage/scratch/mosaic-lead/reports/org-a3-build.md:52,216-217`).
+
+## 2. Current behavior, traced before the proposal
+
+| Step | Current behavior and evidence |
+| --- | --- |
+| Declare requirements | `checkCredentials` accepts each known service once and validates its scope shape. Gitea uses category levels; Vikunja uses route-group verbs; host has no scopes (`packages/organization/src/role.mjs:100-143`). `admin` and `all` are outside the grantable Gitea categories (`packages/organization/src/vocabulary.mjs:187-191`). |
+| Declare a named instance | `roles.<instance>.credentials` must reference exactly the role's services, except host grants and the chief's Gitea exception when no library exists. Vikunja also requires a unique bot identity (`packages/organization/src/organization-config.mjs:50-59,124-167`). |
+| Locate the slot | `parseCredentialRef` accepts exactly one of `store`, `file` or `env`. `{store:true}` derives the file from config directory, business, agent and service; it does not accept another agent's store path. Named agents can still use external file and environment references (`packages/organization/src/credentials.mjs:23-59`). This lane proposes only the store form for copies. |
+| Resolve launch inputs | `resolveInstance` takes the entry from the validated organization, intersects tools/network/actions with limits, then returns its non-host credential references and tracker metadata (`packages/organization/src/resolve.mjs:34-69,81-95`). These limits do not compute a credential scope intersection. |
+| Load secrets | Runtime indexes references by `business/role` and sets the store root to the agents secret directory (`packages/bus/src/runtime.mjs:333-345,378-379`). `Credentials` loads those references into its private map (`packages/bus/src/credentials.mjs:130-165`). It derives its store filename from business, agent and service (`packages/bus/src/credentials.mjs:351-355`). File reads reject symlinks, wrong ownership/mode and repository/data-root placement (`packages/bus/src/credentials.mjs:357-415`). |
+| Use secrets | `Credentials.useFor` derives business and role from the session, rather than a caller-supplied target. Missing tokens refuse `credential-unavailable`; Vikunja expiry refuses `credential-expired` (`packages/bus/src/credentials.mjs:597-624`). The task adapter uses that session-bound path (`packages/tasks/src/adapter.mjs:84-88`). |
+| Issue and revoke | The broker requires a human, with an explicit tester-verb exception; it checks that the agent exists and prevents delete while ordinary or thread claims remain (`packages/bus/src/broker.mjs:6212-6225`). The credential writer reads only `document.roles[agent].credentials`; issue writes a store reference, revoke drops memory/file before writing or recording the receipt (`packages/bus/src/credential-verbs.mjs:16-51`). |
+| Record writes | The organization writer takes the shared registry lock, then the organization's history `write.lock`, validates the revision and document, records a prepared change and publishes the file (`packages/organization/src/organization.mjs:143-159,175-220,278-340`; `packages/organization/src/org-registry.mjs:73-101`). Its `pathsOnly` option records changed field paths and presence without values (`organization.mjs:276-278,324-327`). |
+| Materialize copies | Root and project entries explicitly refuse `credentials`, `tracker`, `identity`, `publish`, `holder` and `hosts` (`packages/organization/src/agent-levels.mjs:18-41,53-59,105-115`). Copy names preserve root names or append project names. Collisions refuse both claimants; org instances shadow copies. Every required non-host service makes a copy `unbound` (`packages/organization/src/agent-copies.mjs:36-53,73-104`). An unbound copy never joins the role map and launch refuses `credential-unbound`, naming missing services (`agent-copies.mjs:223-245,279-287`; `packages/cli/src/launcher.mjs:361-375`). |
+| Guard launch races | Launch checks against a fresh organization revision, then final `request.admission` compares it again after async preparation (`packages/cli/src/launcher.mjs:357-364,802-813`; `packages/bus/src/runtime.mjs:636-661`). This revision covers organization bytes, not role file bytes. A3 records that limitation explicitly (`/mnt/storage/scratch/mosaic-lead/reports/org-a3-build.md:215`). |
+
+Important limit: validating a slot reference does not prove the remote
+token's permissions. For non-host/non-model services, `Credentials.#format`
+checks token syntax and length, not remote scopes
+(`packages/bus/src/credentials.mjs:448-451`). Existing Gitea minting has a
+fixed seat scope list, not a per-copy intersection
+(`packages/bus/src/gitea-grant.mjs:27-30,262-269`). Vikunja startup has
+specific negative permission probes, not a complete per-composition scope
+proof (`packages/tasks/src/startup.mjs:30-55`). The new build must close
+these gaps for copies; a JSON field that asserts scopes is insufficient.
+
+## 3. Choice and storage
+
+Considered three approaches:
+
+1. Add credentials to root/project definitions. Rejected: a root definition
+   would carry a per-org concern and invite cross-org reuse.
+2. Write synthetic copies into `roles`. Rejected: this conflicts with org
+   shadowing and turns a boot copy into a persistent named instance.
+3. Add an org-local binding overlay and reuse the existing per-agent store.
+   Recommended. It keeps copy definitions secret-free, preserves shadowing,
+   and gives bindings the same revision fence as other org settings.
+
+The authoritative metadata lives in the existing organization file,
+`<configDir>/businesses/<org>.json`, under a proposed top-level
+`copyBindings` key. It is not written into `agents.json` or `roles/`.
+An absent key means no bindings. The writer stores one record per concrete
+copy instance; the example below is illustrative schema, not current JSON:
+
+```json
+"copyBindings": {
+  "writer.site": {
+    "copyId": "<random 128-bit lowercase hex>",
+    "orgIncarnation": "<registry incarnation>",
+    "source": { "level": "project", "name": "writer", "project": "site" },
+    "definition": { "ref": "org:release-writer", "rev": 3, "sha256": "<digest>" },
+    "generation": 1,
+    "state": "bound",
+    "services": {
+      "gitea": {
+        "slot": "self",
+        "scopes": ["read:repository"],
+        "resources": { "projects": ["site"] },
+        "rotateBy": "2026-12-01",
+        "grantId": "<opaque service grant id>",
+        "grantGeneration": 1
+      }
+    },
+    "decision": "<authority decision id>"
+  }
+}
+```
+
+`slot: "self"` means exactly `(org, concrete instance, service)`. It is a
+selector for today's derived slot, not an arbitrary string slot name. The
+record contains no path, environment name, token, token fragment or token
+hash. Grant ids identify authorization records, never encode token bytes.
+Secret values stay exclusively in the existing private credential store
+and trusted service-call memory, never in metadata, evidence, bundles,
+decision text or errors. The symbolic paths in this design describe source
+architecture; runtime responses never emit resolved host paths.
+
+`source` includes the level and original name/project, so dotted-name
+collisions cannot silently attach an old binding. `copyId` is created on
+first approval and retired on fire, shadowing, source removal or replacement.
+`generation` increases for every binding change or revocation and never
+resets while that copyId exists. An unbound tombstone remains after unbind.
+A new copyId never adopts an old slot file. Name reuse requires verified
+old-slot cleanup and newly verified credentials before activation.
+
+For a root copy, source.project is null and its definition is the frozen
+root definition identity. For a project copy it names the org definition
+or template identity. A definition hash includes composition and contract;
+the applicable instruction/personality revision is pinned too. Import
+provenance (`from.sha256`) is not the customized definition's current hash.
+
+Vikunja metadata additionally contains the existing bot identity shape
+(`tracker: {bot, botId}`) at the copy record level. It must pass the same
+org-wide uniqueness check as named instances, including other copies.
+No service binding implicitly grants identity, publication, host enrollment
+or project access. Existing identity/publish requirements remain separate.
+
+### Writer and lock order
+
+Extend `organizationWriter` with dedicated trusted methods
+`applyCopyBindingDecision` and `revokeCopyBinding`; names are proposed API.
+Only the authenticated broker/Console owner path invokes these methods.
+Generic document writes and root/project writers must reject changes to
+`copyBindings`, even if a submitted document validates. An actor string,
+decision id or hash supplied by an agent is never authorization.
+
+Reuse the shared registry lock `<configDir>/org-runtime.lock`, then the
+organization lock `<configDir>/businesses/.history/<org>/write.lock`.
+Do not introduce a second competing metadata file or lock. Reuse the
+writer's revision conflict, prepared/committed receipt and paths-only
+evidence machinery. Under the locks, establish fresh active org incarnation,
+owner identity, expected document revision and decision digest. Perform
+the final checks in the publication critical section, not only in HTTP.
+
+Do not hold filesystem locks across remote service calls or waits for runs
+to stop. Before such work, persist a non-active pending operation with a
+unique id and expected generations. Reacquire the locks, re-read and compare
+all identities before publishing. A competing write invalidates preparation.
+Use the same operation id for idempotent recovery; a prepared or uncertain
+operation cannot produce a usable binding or resurrect the prior token.
+
+## 4. Authority, decisions and deployed ownership
+
+Use the existing grantable `org.hire` right as the authority-change entry
+right. It already exists, defaults to owner yes/member no, and maps
+`hire.resolve.console` to `org.hire`
+(`packages/organization/src/org-rights.mjs:6-26,67-69`). Do not add an
+`org.credentials` right that would imply delegable token-grant authority.
+
+The right is necessary but not sufficient: any decision containing a
+credential line requires the current owner of the target org, even if a
+member holds `org.hire` or `decide`. Map credential resolution to an
+explicit owner check as well as the right check, rechecked at commit.
+The owner-only credential read stays owner-only; `board.read` gets at most
+the existing copy's missing-service status, never a binding record.
+
+Bind and unbind are **authority-change decisions**, represented by the
+hire model's `op: "change"`, with a binding-specific payload. The
+decision names source, copyId (or new-copy proposal), org incarnation,
+definition revision/hash, before/after service scopes and resources, and
+expected binding generation. The broker computes credential lines and
+the whole-decision digest. Approval consumes the decision once. Dropping,
+narrowing or replacing a line invalidates the old digest and requires
+confirmation of the new digest; widening always raises a new decision.
+
+This reuses hire-as-a-decision instead of creating a second approval
+model. It follows the roles-and-rails design's credential ruling,
+owner restriction, digest, seven-day expiry, one-step human-originated
+decision, and post-approval binding steps
+(`docs/plans/2026-11-10_roles-and-rails-design.md:35,232-310`). The chief
+may propose a binding only through that decision path, never by naming a
+slot, supplying a token or calling the writer. Other agents cannot raise
+this authority-change subtype. No agent resolves it, including the chief,
+an arbiter, its subject, or a different copy of the same definition.
+
+This is an authority change under system rails R1, R5, R7 and R8 and the
+role's credential rail. Default autonomy is **in the loop**. As required by
+the existing design, credential bindings do not move to near or out of the
+loop at all without a new owner ruling
+(`docs/plans/2026-11-10_roles-and-rails-design.md:90-119,416-425,445-463`).
+Unbind uses the same human decision record, including a one-step
+owner-originated decision. Emergency **revoke** remains an owner-only
+immediate verb: it only removes use, must not wait for a chief proposal,
+and records the authority reduction. Revoke never issues a token or changes
+an unbound binding to bound.
+
+A root-level definition change still needs the instance owner. Binding one
+root copy inside org O needs O's owner and grants nothing in another org.
+Being an instance operator or root-business owner alone does not make a
+person O's owner. Accounts design separates these principals explicitly
+(`docs/plans/2026-11-10_accounts-design.md:314-349`). No account-only session
+falls back to a human/root transport. All Console mutations retain Origin,
+session, fresh ownership and confirmation fences.
+
+The host remains the trust boundary. Host root and the instance uid can
+already change the instance and its secrets; this proposal does not claim
+protection from either, or from a sandbox escape to that uid. The deployed
+instance uid must remain separate from human/development seats
+(`docs/plans/2026-11-10_accounts-design.md:887-936`).
+
+## 5. Permission calculation and proof
+
+For every service V, compute:
+
+`effective(V) = role-declared(V) intersect org-approved-binding(V)`.
+
+The binding is the org's per-copy narrowing. Omitted services are unbound,
+not permission to use another source. Unknown services/scopes refuse; they
+are never ignored. The requested scopes must already be a subset of the
+role. Do not silently trim a broader request and report that it succeeded.
+Resources also intersect the org's current admitted project set and the
+copy's union. A project copy may access its project only. A root copy may
+access only the approved projects that still admit it. An empty intersection
+allows no service operations and leaves a required service unbound.
+
+Scope comparison is semantic: Gitea read is narrower than write in the same
+category, categories are independent, and neither admin nor all is allowed.
+Vikunja compares each route-group/verb pair. Missing categories/groups mean
+no permission; there is no wildcard. All adapters must apply their service's
+registered semantics, never compare scope strings lexicographically.
+
+### At proposal, approval and bind
+
+1. Resolve the concrete copy from the target org's boot snapshot and current
+   project union. Refuse missing, shadowed, colliding, excluded or fired
+   copies. Never create `roles[copyName]` to make the operation succeed.
+2. Validate the role through the core composition validator and current
+   enabled registry. Read T1's definition revision/hash, or the frozen root
+   role identity. Verify org active state and incarnation. Compute all
+   credential lines from these inputs, not from chief-supplied summaries.
+3. Check every requested service/scope/resource against that definition and
+   org. Verify the resolver is the fresh org owner. The owner cannot override
+   a system rail or widen a binding past the approved role; changing the role
+   requires its own approved change first.
+4. Obtain a dedicated service credential for this exact org/copy/service.
+   Trusted service adapters must establish both token scopes and remote
+   identity resource grants. Prove the allowed projects/repos at the service,
+   not just a local `resources` list. A root-wide or cross-org bot account is
+   unacceptable even if its token is stored in a per-org directory.
+5. Accept a token only after trusted live introspection verifies its scopes,
+   service account, permitted resources and expiry against this operation,
+   or after a reviewed managed mint path produces and verifies that exact
+   bounded grant. An owner-entered assertion, copied grant id, token format,
+   or a few successful/negative probes are not proof of complete permissions.
+   If the service/version cannot prove the bound, refuse
+   `credential-scope-unverified`. Ship that refusal rather than an unsafe
+   compatibility mode. This is a required service-adapter build item.
+6. Stage the secret privately in the existing store with the binding inactive.
+   Recheck decision digest, definition hash, org incarnation, document
+   revision and slot generation after remote work. Only then commit the
+   metadata/receipt. A grant record binds the opaque grant id, copyId,
+   incarnation and generation to the issued slot. It stores no secret or
+   token-derived digest. Ambiguous crash recovery keeps use closed and
+   requires a new verified issue if exact provenance cannot be established.
+
+Gitea's existing fixed `SEAT_SCOPES` must not be reused for a read-only role.
+Vikunja needs a reviewed verifier for the complete route-group scope set
+and bot/project access. Until each adapter exists, that service's copy
+binding refuses. Do not claim the existing named-agent path provides this
+proof. Extending remote minting beyond its current approved envelope is a
+separate protected change, identified in slice CB2 below.
+
+### At launch, restart and every use
+
+The first build uses the existing restart model for **new references**.
+Approval may record a binding, but it is not usable until the org bus
+restarts and verifies it. Surface `restart-required`, not a successful
+launch. Today reference/bot changes already require restart
+(`packages/bus/src/runtime.mjs:547-583`). Do not add live reference reload
+in the first slice. Revocations take effect immediately and never wait
+for this restart.
+
+On boot and every launch, re-resolve the effective role and binding,
+validate source/copyId/incarnation/generation, and obtain fresh trusted
+service scope/resource proof for the actual slot contents. If verification
+is unavailable, launch refuses. All required services must be bound and
+available. Bindings may be approved incrementally, but partial success
+cannot launch. A stale file alone never counts as a binding.
+
+Preserve A3's organization revision fence. Add a separate launch authority
+digest over frozen definition identity, copyId, org incarnation, binding
+generation and verified grant generation. Do not redefine the writer's
+document revision. Carry both into final admission and `bindLaunch`, and
+bind the admitted generations to the session. A pending revocation blocks
+admission, including the interval between final admission and spawn/bind.
+If a child was spawned before revocation won, deny its capability and stop
+it; it must perform no credential call. Do not release a launch fence on an
+uncertain outcome until that child is confirmed stopped.
+
+At every credential-bearing operation, check session org/instance, active
+incarnation, effective scopes/resources, binding/grant generation and slot
+liveness before any external request. Derive the slot from the session,
+never from request arguments or thread text. Raw tokens and credential file
+paths do not enter sandboxes. The trusted service adapter checks each
+method/resource as well as token permissions. Constrain outbound destinations
+to the approved service origin and reject redirects carrying authorization
+to another origin. Operation completion rechecks the generation before
+publishing its result. Unknown or stale state refuses closed.
+
+## 6. Lifecycle and running copies
+
+All transitions below close credential admission first, invalidate affected
+session generations, then stop **all** affected ordinary and thread runs.
+Serialize close versus new admission so a concurrent launch cannot escape
+the stop inventory. Abort cancellable service calls and wait for all held
+uses to settle before slot deletion or replacement. A completed external
+write cannot be undone; report that limit, never call local revoke a remote
+rollback. Existing non-host `Credentials.use` does not provide the host-key
+abort behavior, so generalizing the use fence is required, not assumed
+(`packages/bus/src/credentials.mjs:556-569,618-653`).
+
+| Event | Durable outcome and effect on a running copy | Next launch/use |
+| --- | --- | --- |
+| Unbind service | Owner-approved change bumps generation, records unbound tombstone, closes use, stops every run of that copy, revokes/removes its slot. Never retain a reusable token behind an inactive binding. | `credential-unbound`: `credentials.gitea needs an owner-approved binding.` |
+| Emergency revoke | Owner verb immediately closes use, bumps generation, stops all copy runs and performs local revoke. A managed remote grant is also revoked through its approved adapter. Keep tombstone; reissue needs a fresh decision and verification. | `credential-revoked`: `credentials.gitea was revoked; the owner must approve a new binding.` |
+| Slot removed or altered outside the writer | A slot liveness/identity check at use and launch refuses even if memory still holds the token. Mark binding unavailable, invalidate session use and stop its runs. Never fall back to cached memory, environment or another slot. Replacement is a newly verified issue. | `credential-unavailable`: `credentials.gitea is unavailable; the owner must verify the slot.` |
+| Expiry or upstream revocation | Local expiry checks and service authentication failure close the binding, invalidate use and stop runs. Rotation is a new verified slot generation and owner-approved change; no in-place replacement behind active uses. | `credential-expired`: `credentials.vikunja has expired; the owner must approve a replacement.` Upstream revoke uses `credential-revoked`. |
+| Role/definition changed | Any role identity/hash/revision mismatch closes use and stops affected copies. Do not inherit old credentials even for equal service names. A narrower role requires new bounded service proof; a wider role requires approval first and fresh binding. T1 blocks edits of an in-use definition until the change-decision path exists. | `credential-role-changed`: `credentials.gitea no longer matches the approved definition; the owner must review the binding.` |
+| Copy fired, source removed, excluded or shadowed | Close use, retire copyId, stop every run, revoke slots and delist the copy. Preserve run/trail evidence. A newly shadowing named instance must not load the old copy's file at the identical slot name. Require cleanup before it can use that name. | `copy-unavailable`: `copy is no longer active in this organization.` |
+| Copy-name collision | Refuse attaching either binding. If introduced while running, close affected use and stop both claimants. No first-wins fallback. | `copy-refused`: `copy identity is ambiguous; the owner must resolve the definition collision.` |
+| Organization archived | Close the org's admission, invalidate its running sessions and stop every org run before archive completes. Revoke all copy service slots and mark bindings unbound. Restore preserves definitions but requires fresh binding decisions. Never affect another org's runs or slots. | `org-archived`: `organization is archived.` After restore, `credential-unbound`. |
+| Organization deleted | Close all admission/use and stop every org run, revoke managed remote grants and local slots before the existing quarantine flow. Preserve evidence/tombstones in deletion evidence. A new org with the same id has a new incarnation and no inherited bindings. | `org-unavailable`: `organization is not active.` Recreated org starts unbound. |
+| Revoke/stop/cleanup uncertain | Persist a non-usable pending-revocation state and keep the affected copy or org fenced. Do not publish success or restore memory on write failure. Retry with the same operation id. Remote revocation uncertainty remains visible to the owner. | `credential-revoke-failed`: `credentials.gitea revocation is incomplete; the owner must retry cleanup.` |
+
+These archive/delete effects are proposed extensions. Current archive stops
+the bus and marks the registry archived; deletion quarantines org runtime,
+document/history and org secret trees, while its receipt says remote-side
+revocation is out of scope (`packages/organization/src/org-service.mjs:239-267,332,343-347`).
+The new build must explicitly test and add copy-run and copy-grant cleanup;
+it cannot infer it from a stopped bus.
+
+Refusal codes in this section are proposed public contracts where new.
+Use `human-required` with `Only the organization owner can approve credential
+binding.` for an agent/member mutation, `credential-not-yours` with
+`credentials.gitea must use this copy's own organization slot.` for a wrong
+slot, `credential-scope-exceeded` with `credentials.gitea.scopes exceeds the
+approved role.` for excess scopes, and `credential-scope-unverified` with
+`credentials.gitea permissions could not be verified.` for missing proof.
+`credential-binding-changed` says `credentials.gitea changed; read and approve
+again.` for stale generation; `organization-changed` retains the existing
+document-race code. Validation errors name field positions such as
+`copyBindings entry 1 services field`, not untrusted submitted keys.
+
+All new boundaries allow only registered service/field labels and fixed
+remediation text. Never interpolate a submitted value, resolved path, raw
+service error, URL, bot name, secret, token hash or token fragment into an
+error, receipt or trail. New metadata serializers use an allowlist and
+paths-only receipts. Scan human text with the existing secret scanner and
+fixed field-size limits; arbitrary unknown keys refuse with a fixed field
+label. Metadata holds only validated ids, known scope names and bounded
+dates/integers. The scope is every new copy-binding surface, consistent
+with the brief's #1916/#1920 requirement, without changing unrelated legacy
+diagnostics. Neither reviewer nor implementer needs live secrets to test it.
+
+## 7. Two organizations and identity reuse
+
+Example acceptance fixture: org A and org B both materialize root `writer`
+from the same creative template. A's binding selects `(A, writer, gitea)`;
+B's selects `(B, writer, gitea)`. Each uses a dedicated remote bot/token whose
+resources exclude the other org. B cannot select A's slot or reuse A's grant
+record. A path restriction alone would not prevent a token with both orgs'
+remote grants, so service proof must check those grants too.
+
+Enforce isolation at all of these independent boundaries:
+
+1. Console resolves the target org from the authorized route and fresh
+   ownership, not a body-supplied org or an instance-wide owner flag.
+2. The writer derives its org and slot from that context and binds the
+   metadata to the registry incarnation. A copied record from A has the
+   wrong incarnation in B and refuses before opening any slot.
+3. Copy source tuple, copyId and definition digest must match B's materialized
+   copy. A root definition carries no binding to propagate.
+4. Credential loader derives the slot, enforces private regular-file rules,
+   rejects alias/symlink/hardlink substitution for copy slots and verifies
+   remote grant ownership. Reject nlink other than one for these slots.
+5. Every use derives org/instance from the authenticated session and checks
+   the active binding generation. A thread, room or caller-supplied instance
+   cannot choose the key. Session and grant records cannot cross buses.
+6. Archive/delete touches only that incarnation's resources. A failed cleanup
+   never makes credentials valid for a later org or copy with the same name.
+
+Registry incarnation is a dependency of accounts design
+(`docs/plans/2026-11-10_accounts-design.md:501-514`). The binding build must
+use that stable value; if the target baseline lacks it, land an explicitly
+approved incarnation slice first. Do not substitute timestamps, a pathname
+or an org id alone. The dedicated store layout remains unchanged.
+
+## 8. T1 dependency and implementation slices
+
+T1 is in flight. Its brief is
+`/mnt/storage/scratch/mosaic-lead/uidev/org-release/T1-BRIEF.md`. This design
+depends on its org-local definitions, `org:` resolver, revision/hash read,
+composition validation and in-use definition guard, as specified in
+roles-and-rails sections 4 and 5
+(`docs/plans/2026-11-10_roles-and-rails-design.md:157-170,186-228`). Do not
+patch T1's files in this lane. Project copies use those org definitions;
+root copies keep a frozen root identity. Supporting root-local customized
+definitions waits for that resolver to exist, rather than inventing another
+definition format here. A4 supplies the authority-change decision engine;
+this build extends it, rather than shipping a temporary direct bind verb.
+
+Every slice below is a later proposal requiring Jason's approval before
+work. Each ends with focused tests plus affected organization, business,
+bus, CLI and Console suites. No slice edits `roles/` or `contracts/`.
+
+| Slice and dependencies | Build and acceptance evidence | Protected changes needing approval |
+| --- | --- | --- |
+| CB0: identity foundation, after T1/accounts | Reuse incarnation or add its approved missing support. Define copyId, source/hash pin and binding generation semantics. Pure resolver tests cover identical root copies across two orgs, project dotted-name collisions, org shadowing, removed/recreated org and source-name reuse. No secret read and no launch enabled. | Org schema; registry schema only if incarnation is absent. No new rights or role files. |
+| CB1: metadata and decisions, after CB0/A4 | Add `copyBindings`, guarded organization writer, owner-only credential subtype under `org.hire`, digest/expiry/single-consumption and paths-only receipts. Tests: owner binds/unbinds; member with org.hire/decide, chief, arbiter, subject agent, tester and reader all fail to resolve/write; agent may not call raw writer; only chief agent can propose; stale revision/digest/generation, expired approval, replay, wrong incarnation and generic write injection have no activation. Pending/partial binding never launches. | Organization and decision payload schema; `VERB_RIGHTS`/owner dispatch changes even though no new grantable right. Approval explicitly covers the reuse of org.hire with the owner restriction. |
+| CB2: verified service slots, after CB1 | Reuse self-only store and dedicated bot identity; add complete Gitea/Vikunja verification or exact bounded mint adapters. Tests use fake services for narrower/equal/broader scopes, read/write hierarchy, extra route verbs, unrelated repos/projects, reused foreign bot/grant, opaque/unverifiable token, wrong date, symlinks/hardlinks, stale file and token replacement. No request, path or token enters metadata/evidence; lost replies and crash points remain inactive. A live scratch-service acceptance must prove each service/version's permission verifier before that service enables copy launch. | Credential handling/security boundary; grant metadata schema and any remote mint/revoke envelope changes. No automatic reuse of existing fixed Gitea seat scopes. |
+| CB3: admission and use, after CB2 | Materialize only verified bound copies; new references visibly need restart. Check document revision plus separate authority digest at prepare, final admission and bindLaunch. Session-bound adapter checks every operation and slot liveness. Race tests mutate role hash, org bindings, token contents or admitted projects during async prepare and between admission/spawn/bind/use. Assert no admitted credential call, including an empty project manifest. Concurrent revoke denies new work; no cached-token fallback after unlink. | Launcher/broker credential enforcement boundary; session/launch authority fields and any store schema needed to persist fences. No live reference-reload policy. |
+| CB4: lifecycle and recovery, after CB3 | Test unbind, emergency revoke, slot removal, expiry, role change, fire, collision, shadowing, archive/restore, delete/recreate. Each closes admissions, invalidates ordinary and every thread run, aborts or drains uses, and denies later calls. Inject failures before/after metadata publication, secret staging, remote revoke, stop acknowledgement and receipt write; restart never resurrects authority. Include named-instance shadowing over a former copy's slot. Other org continues. | Credential/revocation and org lifecycle boundary; durable pending-operation schema. Existing deletion quarantine must not silently claim remote revoke. |
+| CB5: two-org thread acceptance and operator flow, after CB4 | Finish A3's deferred test with a shipped Gitea-requiring creative thread role in both orgs. Approve independent verified bindings; boot real buses and use fake harness/service, create one thread/session per org, launch both, write/read records, reopen each. Assert distinct session/run/trail/workspace and slot identities, no A record visible in B, no B request uses A's token, and B survives A revoke/archive/delete. Reject raw A binding/grant replay in B. Operator flow shows computed scope lines, confirmation, missing service, restart and remediation states, with sentinel redaction tests on every response/event/log. No screenshot gate for this doc lane. | Console mutation/decision flow; no further right or role changes. Any discovered schema delta returns to approval before build. |
+
+Existing regressions to retain include organization `credentials.test.mjs`,
+`role.test.mjs`, `agent-copies.test.mjs`, `instance-credential-transitions.test.mjs`,
+bus `credential-store.test.mjs`, `credential-verbs.test.mjs`,
+`agent-copies.test.mjs`, and CLI `thread-launch.test.mjs` and
+`launcher-final-race-probe.test.mjs`. Add meaningful new focused tests for
+the guarantees above; merely checking the proposed JSON shape is inadequate.
+
+Acceptance samples for this document are the seven brief requirements:
+storage/writer/locks in section 3; right/rail/decision in section 4;
+role ceiling and verification in section 5; lifecycle/code/text in section 6;
+two-org enforcement in section 7; tests/slices/protected changes in section 8;
+and at most three owner questions below. No visual samples apply.
+
+## 9. Questions for Jason, with recommendations
+
+1. Approve `org.hire` as the entry right while keeping every credential
+   binding/unbinding approval owner-only? Recommend yes: it matches the
+   existing hire decision model and does not grant members token authority.
+2. Approve the overlay schema and CB0-CB5 security changes, including complete
+   service scope/resource proof as a prerequisite and restart for new
+   references? Recommend yes. A service without a verifier stays refused;
+   implement Gitea first if its verifier is ready before Vikunja's.
+3. On archive/restore, discard copy credentials and require fresh bindings?
+   Recommend yes. It adds setup on restore, but avoids keeping dormant
+   usable grants and gives archive one clear revocation meaning.
+
+These are recommendations, not approvals. The Lead takes this design to
+Jason. No implementation or rollout is authorized by this document.
@@ -0,0 +1,91 @@
+// AU trusted host seam. No worker can choose a path, snapshot or inverse operation.
+import { mkdirSync, symlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { prepareRevert, finishLand, dropLand } from '../../seat/src/working.mjs';
+import { isMosaicStack, runGate, gateEnv } from '../../seat/src/landing.mjs';
+const refuse=code=>{throw Object.assign(new Error(code),{code});};
+// countsAccount(name) answers what the named harness module declares (runtime harnessLevels);
+// the broker's authority budget check reads it here instead of naming a harness.
+export function autonomyHost({writer,dataRoot,business,hires,reload,processing,countsAccount=()=>null,env=process.env,gate={classify:isMosaicStack,run:runGate}}) {
+  return {
+    countsAccount,
+    get:id=>{const r=writer.read(id);return {revision:r.revision,autonomy:r.document.autonomy??{}};},
+    set:(id,args,actor)=>{
+      const old=writer.read(id);if(old.revision!==args.revision)refuse('revision-conflict');
+      const result=writer.write(id,{...old.document,autonomy:args.autonomy},{revision:args.revision,actor,detail:{verb:'autonomy.set'}});
+      const live=reload(id);return {...result,restart:live===false};
+    },
+    reversible:cls=>['cross-role','merge'].includes(cls) || cls==='authority' && typeof hires?.reverse==='function',
+    async reverse({business:id,decision,decisionClass,raised,effects,actor,beforeWrite,beforePublish,fire,stop,complete,relaunch,record}) {
+      if(decisionClass==='authority') {
+        if(!hires?.reverse)refuse('reversal-unavailable');
+        let stopped;
+        const result=await hires.reverse(id,decision,{actor,beforeWrite,beforePublish,fire,stop:async p=>{const r=await stop(p);stopped=p;return r;},relaunch,record});
+        // The writer admitted publication within the window. Reload and relaunch
+        // complete that committed inverse; crossing the deadline here cannot undo it.
+        const receipt={committed:true,transaction:result.transaction??null,completion:stopped?'recorded':'not-needed',relaunch:result.relaunch?'pending':'not-needed'};
+        try {if(stopped)complete?.(stopped,result);} catch {receipt.completion='failed';receipt.restart=true;}
+        try {
+          if(reload(id)===false)receipt.restart=true;
+          if(result.relaunch && !receipt.restart){await relaunch(result.relaunch);receipt.relaunch='requested';}
+        } catch {receipt.restart=true;if(result.relaunch)receipt.relaunch='failed';}
+        return receipt;
+      }
+      const used=effects.filter(e=>e.operation!=='decision.raise' && !String(e.operation??'').startsWith('autonomy.'));
+      // An unused approval has changed no task or policy. Reversing it revokes that permission.
+      if(!used.length) {beforeWrite();return {permissionRevoked:true};}
+      if(decisionClass!=='merge')refuse('reversal-unavailable');
+      const landing=used.find(e=>e.action==='git.merge.protected' && typeof e.commit==='string');
+      if(!landing)refuse('reversal-unavailable');
+      const b=business(id),p=b.projects[landing.project];if(!p)refuse('project-not-found');
+      const name=`reverse-${randomBytes(6).toString('hex')}`,dir=join(dataRoot,'autonomy-reversals',decision,name);
+      mkdirSync(dir,{recursive:true,mode:0o700});
+      const where={dataRoot,business:id,project:landing.project,env};
+      let prepared;
+      return processing.work(async scope=>{
+        try {
+          if(!await gate.classify(p.root,env))refuse('gate-missing');
+          prepared=await prepareRevert({...where,commit:landing.commit,dir,name,decision});
+          symlinkSync(join(p.root,'node_modules'),join(prepared.worktree,'node_modules'));
+          const result=await gate.run({worktree:prepared.worktree,logs:dir,env:gateEnv(env),signal:scope.signal});
+          scope.guard();if(!result.ok)refuse('gate-failed');beforeWrite();
+          const receipt=await finishLand({...where,land:prepared,record:receipt=>{scope.guard();beforeWrite();record({...receipt,reverted:landing.commit});}});
+          return {...receipt,reverted:landing.commit};
+        } finally {if(prepared)await dropLand({...where,worktree:prepared.worktree});}
+      });
+    },
+  };
+}
+
+// The runtime adapter is shared with integration tests, including key revocation order.
+export function authorityHost(service,{modelKeys,reload,proxyOrganization}) {
+  return {
+    ...service,
+    reverse:async(id,decision,caller)=>{
+      const proposal=service.read(decision);
+      if(!modelKeys || (proposal.level==='org' && proposal.op==='hire'))return service.reverse(id,decision,caller);
+      const instance=`${id}/${proposal.level==='project'?`${proposal.name}.${proposal.project}`:proposal.name}`;
+      let prepared=false;
+      return service.reverse(id,decision,{
+        ...caller,
+        beforeWrite:()=>{caller.beforeWrite();if(prepared){modelKeys.completeRevoke(instance);prepared=false;}caller.beforeWrite();},
+        stop:async(p,guard)=>{await modelKeys.prepareRevoke(instance,guard);prepared=true;return caller.stop(p);},
+      });
+    },
+    apply:async(id,decision,caller)=>{
+      const proposal=service.read(decision);
+      const publish=async()=>{
+        let approved=caller;
+        if(modelKeys && proposal.op==='fire' && proposal.level!=='org') {
+          const instance=`${id}/${proposal.level==='project'?`${proposal.name}.${proposal.project}`:proposal.name}`;
+          await modelKeys.prepareRevoke(instance,()=>caller.beforeWrite?.());
+          approved={...caller,beforeWrite:()=>{caller.beforeWrite?.();modelKeys.completeRevoke(instance);caller.beforeWrite?.();}};
+        }
+        const result=await service.apply(id,decision,approved);reload(id);return result;
+      };
+      if(proxyOrganization && proposal.level==='org' && proposal.op==='hire')return proxyOrganization.hire(id,proposal.name,()=>service.check(id,decision,caller),publish);
+      return publish();
+    },
+  };
+}
@@ -0,0 +1,13 @@
+// AU reads only immutable evidence. These operations are reserved broker writes.
+export function autonomyEvent(q, business, decision, operations) {
+  const placeholders=operations.map(()=>'?').join(',');
+  const row=q.get(`SELECT * FROM events WHERE business=? AND kind='action.allowed' AND json_extract(body,'$.decision')=? AND json_extract(body,'$.operation') IN (${placeholders}) ORDER BY seq DESC LIMIT 1`,business,decision,...operations);
+  return row?{...row,body:JSON.parse(row.body)}:null;
+}
+export function decisionResolution(q, business, decision) {
+  const terminal=q.get("SELECT * FROM decision_events WHERE decision=? AND op IN ('withdrawn','expired') ORDER BY seq DESC LIMIT 1",decision);
+  if(terminal)return terminal;
+  const overlay=autonomyEvent(q,business,decision,['autonomy.resolved','autonomy.declined']);
+  if(overlay)return overlay.body.operation==='autonomy.declined'?null:{...overlay.body.resolution,seq:overlay.seq};
+  return q.get("SELECT * FROM decision_events WHERE decision=? AND op IN ('resolved','withdrawn','expired') ORDER BY seq DESC LIMIT 1",decision);
+}
@@ -0,0 +1,233 @@
+// #1873 CB2 (design section 5 steps 4 to 6): credentials.issue for an agent copy's bound service.
+// Gitea is the only service with a verifier in this slice. A copy token is accepted only after the
+// Gitea server it belongs to proves the whole grant live: the token's scopes, the account it belongs
+// to (the copy's own dedicated account, never an administrator or another copy's or agent's), every
+// repository that account can reach and the token's expiry, against the owner-approved binding. A
+// Vikunja binding refuses credential-scope-unverified: that is the shipped behaviour.
+//
+// Order (no lock is held across the remote work):
+//   1. checks that need nothing written: owner, service, date, token form, definition scan, the
+//      record and the boot snapshot, the bound projects' remotes and the approved scopes;
+//   2. stage: the writer deactivates the record (pending, the service's grant fields gone), then the
+//      token goes to the copy's slot in the self-only store;
+//   3. the slot is read back by the identity the stage wrote, and Gitea is asked;
+//   4. commit: the writer rechecks registry incarnation, document revision, binding generation,
+//      copyId, decision and definition pin under its locks; its beforeWrite reads the slot back by
+//      identity again and runs the caller's session recheck. Only then do the grant metadata and the
+//      receipt land.
+// Any refusal after the stage removes the slot it wrote and leaves the record pending. A lost reply
+// or a crash leaves the record pending too; nothing resolves a pending record, and recovery is a
+// new verified issue. A token a crash left staged goes at the next start (sweepCopySlots). Nothing here logs, and no result, receipt or refusal holds the token, the
+// slot's path, a request or anything derived from the token.
+import { lstatSync, readdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { BusError } from './broker.mjs';
+import { Credentials, assertNotHeld, day, privateDir } from './credentials.mjs';
+import { send, versionAtLeast, REPO_PAGE, REPO_PAGES } from './gitea-grant.mjs';
+import { scanOrganizations } from './definition-scan.mjs';
+import { parseGiteaUrl, GITEA_SCOPE_CATEGORIES, ID_PATTERN, SERVICES } from '../../organization/src/vocabulary.mjs';
+import { copyBotLogin, scopesWithin } from '../../organization/src/copy-bindings.mjs';
+
+const deny = (code, reason) => {
+  throw new BusError(code, reason);
+};
+const unverified = (reason) => deny('credential-scope-unverified', reason);
+const DAY_MS = 86400000;
+// A copy credential's rotation date is after today and at most this many days ahead.
+export const MAX_ROTATE_DAYS = 366;
+const object = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const positive = (n) => Number.isSafeInteger(n) && n > 0;
+const lower = (s) => (typeof s === 'string' ? s.toLowerCase() : null);
+
+// The scopes a Gitea token reports, as {category: level}. Gitea writes write:X as implying read:X and
+// may list both; the higher level wins. "all", any admin category, a category Gitea added that this
+// bus doesn't know, or anything that doesn't parse returns null: such a token is broader than any
+// binding can approve.
+export function tokenLevels(scopes) {
+  if (!Array.isArray(scopes) || scopes.length === 0) return null;
+  const out = {};
+  for (const scope of scopes) {
+    const m = typeof scope === 'string' ? /^(read|write):([a-z]+)$/.exec(scope) : null;
+    if (!m || !GITEA_SCOPE_CATEGORIES.includes(m[2])) return null;
+    if (out[m[2]] !== 'write') out[m[2]] = m[1];
+  }
+  return out;
+}
+const asList = (levels) => Object.entries(levels).map(([c, l]) => `${l}:${c}`).sort();
+
+// The approved Gitea repositories of a copy's binding: one https origin, lower-cased "owner/repo"
+// names, from each bound project's remote. A project with no Gitea remote, two remotes that disagree
+// or two servers cannot be proved.
+export function boundRepositories(doc, projects) {
+  let origin = null;
+  const repos = new Set();
+  for (const project of projects ?? []) {
+    const entry = doc.projects?.[project];
+    if (!object(entry)) unverified('remote');
+    const remotes = [entry.remote, entry.git?.mode === 'remote' ? entry.git.remote : undefined].filter((r) => r !== undefined);
+    if (remotes.length === 0 || remotes.some((r) => r !== remotes[0])) unverified('remote');
+    const parsed = parseGiteaUrl(remotes[0], { repo: true });
+    if (!parsed.url) unverified('remote');
+    if (origin !== null && parsed.url.origin !== origin) unverified('remote');
+    origin = parsed.url.origin;
+    repos.add(`${parsed.owner}/${parsed.repo}`.toLowerCase());
+  }
+  if (origin === null) unverified('remote');
+  return { origin, repos };
+}
+
+// Live introspection of one Gitea token against an approved binding. Returns { userId, tokenId,
+// login } or throws the refusal. `approved` is the binding's Gitea scopes; `repos` the lower-cased
+// names it may reach; `login` the account this copy's grant must belong to; `rotateBy` the date the
+// owner gave. Every call is GET with the token; a missing or ambiguous answer is unverified.
+export async function verifyGiteaToken({ transport = send, url, ca, timeoutMs, token, approved, repos, login, rotateBy }) {
+  const call = (path) => transport({ url, method: 'GET', path, auth: { token }, ca, timeoutMs });
+  const version = await call('/api/v1/version');
+  if (version.status !== 200 || !object(version.json) || !versionAtLeast(version.json.version)) unverified('version');
+  const info = await call('/api/v1/token');
+  if (info.status === 401 || info.status === 403 || info.status === 404) unverified('token');
+  if (info.status !== 200 || !object(info.json) || !positive(info.json.id) || !object(info.json.user) || !positive(info.json.user.id)
+    || typeof info.json.user.login !== 'string') unverified('token');
+  if (lower(info.json.user.login) !== lower(login)) deny('credential-identity-refused', login);
+  const levels = tokenLevels(info.json.scopes);
+  if (!levels || !scopesWithin('gitea', asList(levels), approved)) deny('credential-scope-exceeded');
+  if (!levels.user) unverified('scopes');
+  // An expiry Gitea reports must not come before the owner's rotation date ends.
+  if (info.json.expires_at !== undefined && info.json.expires_at !== null) {
+    const at = typeof info.json.expires_at === 'string' ? Date.parse(info.json.expires_at) : NaN;
+    if (Number.isNaN(at)) unverified('token');
+    if (at < Date.parse(rotateBy + 'T00:00:00Z') + DAY_MS) deny('credential-date');
+  }
+  const user = await call('/api/v1/user');
+  if (user.status !== 200 || !object(user.json) || typeof user.json.is_admin !== 'boolean') unverified('user');
+  if (user.json.id !== info.json.user.id || lower(user.json.login) !== lower(login) || user.json.is_admin !== false)
+    deny('credential-identity-refused', login);
+  // Every repository the account can reach: owned, collaborator and team access. One unrelated
+  // repository, an admin permission, or push where the binding approved read refuses. Push is the
+  // account's right, so it is held to what the binding approved, not to the token's own level.
+  const write = tokenLevels(approved)?.repository === 'write';
+  const seen = new Map();
+  let total = null;
+  for (let page = 1; ; page++) {
+    if (page > REPO_PAGES) unverified('repositories');
+    const r = await call(`/api/v1/user/repos?limit=${REPO_PAGE}&page=${page}`);
+    if (r.status !== 200 || !Array.isArray(r.json) || r.total === null || (total !== null && r.total !== total)) unverified('repositories');
+    total = r.total;
+    if (total > REPO_PAGE * REPO_PAGES) unverified('repositories');
+    for (const repo of r.json) {
+      if (!object(repo) || typeof repo.full_name !== 'string' || !object(repo.permissions)) unverified('repositories');
+      const name = repo.full_name.toLowerCase();
+      if (!repos.has(name)) deny('credential-scope-exceeded');
+      const p = repo.permissions;
+      if (p.admin !== false || typeof p.push !== 'boolean' || p.pull !== true || (p.push && !write)) deny('credential-scope-exceeded');
+      seen.set(name, true);
+    }
+    if (seen.size >= total || r.json.length === 0) break;
+  }
+  if (seen.size !== total) unverified('repositories');
+  for (const name of repos) if (!seen.has(name)) unverified('repositories');
+  // An organization scope reaches organizations' own settings: the account must belong to none.
+  if (levels.organization) {
+    const orgs = await call(`/api/v1/user/orgs?limit=${REPO_PAGE}&page=1`);
+    if (orgs.status !== 200 || !Array.isArray(orgs.json)) unverified('organizations');
+    if (orgs.json.length) deny('credential-scope-exceeded');
+  }
+  return { userId: info.json.user.id, tokenId: info.json.id, login };
+}
+
+// The issue for one copy's service. `copies` is the bus's boot snapshot ({ org, copies,
+// definitions }); `writer` the organization writer; `credentials` the bus's store. `hooks` are the
+// tests' crash points (afterStage, afterRemote, beforeCommit), never set at runtime.
+export function copyGrant({ credentials, writer, copies = null, organizations = null, transport = send, ca = undefined, timeoutMs = undefined, now = () => new Date(), hooks = {} }) {
+  return async (business, args, { actor, owner = false, recheck = () => {} } = {}) => {
+    const { agent: instance, service, token, date } = args;
+    if (owner !== true || actor === 'tester') deny('human-required');
+    if (service === 'vikunja') unverified('service');
+    if (service !== 'gitea') deny('credential-unknown');
+    const today = now().toISOString().slice(0, 10);
+    if (!day(date) || date <= today || Date.parse(date) - Date.parse(today) > MAX_ROTATE_DAYS * DAY_MS) deny('credential-date');
+    const value = Credentials.checkFormat(service, token);
+    const { document: doc, revision } = writer.read(business);
+    scanOrganizations({ organizations: organizations?.() ?? [business], own: { id: business, document: doc }, readRaw: (b) => writer.readRaw(b),
+      boot: copies?.definitions ? { org: copies.org, definitions: copies.definitions } : null }, (v) => assertNotHeld(v, [value]));
+    const record = doc.copyBindings?.[instance];
+    if (!object(record) || record.state === 'unbound' || !object(record.services?.[service])) deny('credential-unbound');
+    const copy = copies?.org === business && Object.hasOwn(copies.copies ?? {}, instance) ? copies.copies[instance] : null;
+    if (!copy || copy.state === 'refused' || Object.hasOwn(doc.roles ?? {}, instance)) deny('copy-unavailable');
+    if (copy.level !== record.source?.level || copy.name !== record.source?.name || (copy.project ?? null) !== (record.source?.project ?? null)
+      || copy.definition !== record.definition?.ref) deny('credential-binding-changed');
+    const approved = record.services[service];
+    if (!Array.isArray(approved.scopes) || !approved.scopes.some((s) => /^(read|write):user$/.test(s))) unverified('scopes');
+    const { origin, repos } = boundRepositories(doc, approved.resources?.projects);
+    const login = copyBotLogin(record.orgIncarnation, record.copyId, service);
+    if (!login) deny('credential-binding-changed');
+    const op = { instance, service, copyId: record.copyId, generation: record.generation, decision: record.decision, incarnation: record.orgIncarnation };
+    const definitions = copies?.org === business ? copies.definitions ?? {} : {};
+    const staged = writer.stageCopyGrant(business, op, { revision, actor, owner, definitions });
+    const slot = business + '/' + instance;
+    let identity = null;
+    try {
+      identity = credentials.stageCopy(slot, service, value.token);
+      await hooks.afterStage?.();
+      // An inode number can be reused after an unlink, so the read-back must also be the staged token.
+      const read = credentials.readCopy(slot, service, identity);
+      if (read.token !== value.token) deny('credential-file');
+      const grant = await verifyGiteaToken({ transport, url: origin, ca, timeoutMs, token: read.token, approved: approved.scopes, repos, login, rotateBy: date });
+      await hooks.afterRemote?.();
+      await recheck();
+      const grantId = `gitea:${grant.userId}:${grant.tokenId}`;
+      const after = { ...op, generation: staged.generation };
+      const committed = writer.commitCopyGrant(business, after, {
+        grantId, rotateBy: date, revision: staged.revision, actor, owner, definitions,
+        beforeWrite: () => {
+          hooks.beforeCommit?.();
+          const again = credentials.readCopy(slot, service, identity);
+          if (again.token !== read.token) deny('credential-file');
+          recheck();
+        },
+      });
+      return { agent: instance, service, verb: 'issue', date, state: committed.state, account: login, generation: committed.generation };
+    } catch (e) {
+      if (identity) {
+        try {
+          credentials.unlinkCopy(slot, service, identity);
+        } catch {}
+      }
+      throw e;
+    }
+  };
+}
+
+// Security review P2: at start, before Credentials loads and before any issue can run, each staged
+// file of a copy's service whose binding holds no grant for that service goes, and so does any
+// interrupted write's temp file. An issue killed after its stage leaves the record pending and the
+// token on disk; nothing resolves a pending record and no reference loads a copy slot, so the file
+// only keeps a secret nothing will use. `documents` is [business, validated organization document]
+// for each loaded business (null when unreadable: nothing of it is touched). Only names the document
+// binds as copies are looked at, never a name its own roles hold or a slot a loaded reference names.
+// A store dir that isn't private refuses credential-file, as Credentials would. Returns
+// [{ instance, service }], never a path.
+export function sweepCopySlots(storeRoot, documents, references = {}) {
+  const removed = [];
+  if (!storeRoot || !privateDir(storeRoot, { missing: true })) return removed;
+  for (const [business, doc] of documents) {
+    if (!object(doc) || !object(doc.copyBindings) || !ID_PATTERN.test(business)) continue;
+    const dir = join(storeRoot, business);
+    if (!privateDir(dir, { missing: true })) continue;
+    for (const [copy, record] of Object.entries(doc.copyBindings)) {
+      if (!ID_PATTERN.test(copy) || Object.hasOwn(doc.roles ?? {}, copy)) continue;
+      const copyDir = join(dir, copy);
+      if (!privateDir(copyDir, { missing: true })) continue;
+      const instance = business + '/' + copy;
+      for (const name of readdirSync(copyDir)) {
+        const service = name.endsWith('.tmp') ? name.slice(0, -4) : name;
+        if (!SERVICES.includes(service) || references[instance]?.[service] !== undefined) continue;
+        if (name === service && typeof record?.services?.[service]?.grantId === 'string') continue;
+        if (lstatSync(join(copyDir, name)).isDirectory()) continue;
+        unlinkSync(join(copyDir, name));
+        removed.push({ instance, service });
+      }
+    }
+  }
+  return removed;
+}
@@ -0,0 +1,320 @@
+// #1873 CB3: launch admission for an agent copy's bound service, and the one checked call a copy
+// session makes with it (design docs/plans/2026-11-11_copy-credential-binding-design.md section 5
+// steps 7 and 8). Gitea is the only service with a verifier.
+//
+// Boot: each copy the boot left unbound whose record is bound with every service granted is
+// re-resolved (role, definition pin, admitted projects, incarnation) and its slot's token is proved
+// live at the service again. Only a copy that passes all of it is materialized (promoteCopies). A
+// binding approved after boot is never launched: it answers restart-required until the next boot.
+//
+// Every launch (prepare, final admission and bindLaunch) recomputes the launch authority: a digest
+// of the organization, copy, definition pin, copyId, incarnation, binding generation, each grant's
+// id and generation, the services and projects the copy reaches now, and their repositories at the
+// one origin the boot proved the token at. Every check reads the registry entry again: an
+// organization no longer active, or with another incarnation, admits and sends nothing. Prepare
+// proves the slot live again; the digest before and after must agree. The
+// session keeps the digest bindLaunch admitted, and each call recomputes it before and after the
+// request: a revoke, a re-issue, a role change or a project change in between denies the call.
+//
+// A revoke of a copy's binding runs inside fence(): while one is in flight the copy admits nothing
+// and a call refuses credential-revoking. A revoke whose outcome is unknown keeps the fence until
+// the next boot. The token is never held: each call reads the slot by the identity the boot proved
+// and checks it against a keyed MAC of the token the boot proved. Nothing here logs, and no result
+// or refusal holds the token, the slot's path or anything derived from the token.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { BusError } from './broker.mjs';
+import { assertNotHeld } from './credentials.mjs';
+import { send } from './gitea-grant.mjs';
+import { boundRepositories, tokenLevels, verifyGiteaToken } from './copy-grant.mjs';
+import { readOrgEntrySync } from '../../organization/src/org-registry.mjs';
+import { allGranted, copyBotLogin, definitionPin, resolveCopyBinding } from '../../organization/src/copy-bindings.mjs';
+import { COPY_BINDABLE } from '../../organization/src/agent-copies.mjs';
+import { checkDefinitions, readTemplate } from '../../organization/src/definitions.mjs';
+import { loadRole } from '../../organization/src/role.mjs';
+import { resolveAgentLevels } from '../../organization/src/agent-levels.mjs';
+import { canonicalJson, sha256 } from '../../organization/src/util.mjs';
+
+const deny = (code) => {
+  throw new BusError(code);
+};
+const object = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+// The repository API a copy session may call: /api/v1/repos/<owner>/<repo>[/<rest>], ASCII names,
+// no dot segment, no encoded separator, no query beyond plain pairs.
+const REPO_PATH = /^\/api\/v1\/repos\/([A-Za-z0-9_.-]{1,100})\/([A-Za-z0-9_.-]{1,100})((?:\/[A-Za-z0-9_.-]{1,200}){0,8})(\?[A-Za-z0-9_=&.-]{0,200})?$/;
+const READ = ['GET', 'HEAD'];
+const WRITE = ['POST', 'PUT', 'PATCH', 'DELETE'];
+// Codes a boot check keeps for the copy; anything else (a thrown bug, a transport surprise) is
+// credential-unavailable.
+const KEPT = /^(credential-|copy-)/;
+
+// The launcher waits on its host channel for prepare, and the host stops on a reply later than its
+// request timeout (10 s); the boot runs inside the host's boot timeout (30 s). Each proof is held to
+// a budget well under those: a service slower than that answers no answer, so it is not proved.
+export const PREPARE_BUDGET_MS = 8000;
+export const BOOT_BUDGET_MS = 20000;
+
+export function copyLaunchGate({ credentials, writer, configDir, rolesDir, snapshot, transport = send, ca = undefined, timeoutMs = undefined, now = () => new Date(),
+  prepareMs = PREPARE_BUDGET_MS, bootMs = BOOT_BUDGET_MS }) {
+  const org = snapshot?.org ?? null;
+  const key = randomBytes(32);
+  const mac = (token) => createHmac('sha256', key).update(token).digest();
+  const verified = new Map();
+  const failed = new Map();
+  const fences = new Map();
+  const today = () => now().toISOString().slice(0, 10);
+  // The organization's registry incarnation as the registry stands now, or null when the entry is
+  // gone, carries none, or is not active (reserved, deleting, archived). Read on every check, never
+  // cached: an organization archived while the bus runs admits and sends nothing. An unreadable or
+  // unsafe registry refuses credential-unavailable.
+  const liveIncarnation = () => {
+    let entry;
+    try {
+      entry = readOrgEntrySync(configDir, org);
+    } catch {
+      return deny('credential-unavailable');
+    }
+    return entry?.state === 'active' ? entry.incarnation : null;
+  };
+  // The organization file is still the revision the launch resolved its bundle from (#1873 A3).
+  const sameRevision = (business, revision) => {
+    if (revision === undefined) return;
+    let now;
+    try {
+      now = writer.read(business);
+    } catch {
+      deny('organization-unreadable');
+    }
+    if (typeof revision !== 'string' || now?.revision !== revision) deny('organization-changed');
+  };
+  const read = (business) => {
+    try {
+      return writer.read(business).document;
+    } catch {
+      return deny('credential-unavailable');
+    }
+  };
+  // The copy, its pin, role and admitted projects as the file stands now (hire-decisions.mjs
+  // bindingFacts, without the refusals that function makes for a proposal).
+  const facts = (business, instance, doc) => {
+    const copy = snapshot?.org === business && Object.hasOwn(snapshot.copies ?? {}, instance) ? snapshot.copies[instance] : null;
+    if (!copy || copy.state === 'refused' || Object.hasOwn(doc.roles ?? {}, instance)) deny('copy-unavailable');
+    const definitions = { ...(snapshot.definitions ?? {}), ...(doc.definitions ?? {}) };
+    const pin = definitionPin(copy.definition, { definitions, rolesDir, readTemplate });
+    let role = null;
+    try {
+      role = copy.definition.startsWith('org:') ? checkDefinitions(definitions, 'copy definitions')[copy.definition] : loadRole(rolesDir, copy.definition);
+    } catch {
+      role = null;
+    }
+    if (!pin || !role) deny('credential-role-changed');
+    const code = Object.keys(doc.projects ?? {}).filter((p) => doc.projects[p]?.kind !== 'library');
+    let projects = code;
+    if (copy.level === 'root') {
+      let levels;
+      try {
+        levels = resolveAgentLevels({ orgId: business, doc: { ...doc, definitions }, root: { agents: snapshot.rootAgents ?? {} }, rolesDir });
+      } catch {
+        deny('copy-unavailable');
+      }
+      projects = code.filter((p) => levels.unions[p]?.ok && levels.unions[p].agents.some((a) => a.level === 'root' && a.name === copy.name));
+    }
+    return { copy, pin, role, projects };
+  };
+  const resolve = (business, instance, doc, record, inc) => {
+    const f = facts(business, instance, doc);
+    const res = resolveCopyBinding({ orgId: business, incarnation: inc, snapshot, instance, record, pin: f.pin, role: f.role, projects: f.projects });
+    if (!res.ok) deny(res.code);
+    if (Object.keys(res.services).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+    return { ...f, res };
+  };
+  const grantsOf = (record) => Object.fromEntries(Object.keys(record.services).sort()
+    .map((s) => [s, { grantId: record.services[s].grantId, grantGeneration: record.services[s].grantGeneration }]));
+  const slot = (instance) => org + '/' + instance;
+  // Live proof of one slot token against the record: the service's own answer, the grant id the
+  // verifier committed, and a rotation date not yet passed.
+  // The transport held to a deadline: each call gets what is left, and none starts after it.
+  const within = (deadline) => (req) => {
+    const left = deadline - Date.now();
+    if (left <= 0) return Promise.resolve({ status: 0, json: null, total: null });
+    return transport({ ...req, timeoutMs: Math.min(req.timeoutMs ?? left, left) });
+  };
+  const prove = async (doc, record, token, inc, deadline) => {
+    const approved = record.services.gitea;
+    if (approved.rotateBy < today()) deny('credential-expired');
+    const { origin, repos } = boundRepositories(doc, approved.resources.projects);
+    const login = copyBotLogin(inc, record.copyId, 'gitea');
+    if (!login) deny('credential-revoked');
+    const grant = await verifyGiteaToken({ transport: within(deadline), url: origin, ca, timeoutMs, token, approved: approved.scopes, repos, login, rotateBy: approved.rotateBy });
+    if (`gitea:${grant.userId}:${grant.tokenId}` !== approved.grantId) deny('credential-revoked');
+  };
+
+  async function boot(business) {
+    if (business !== org) return;
+    const deadline = Date.now() + bootMs;
+    // An inactive or unreadable registry entry leaves null: the resolver refuses every copy with its
+    // own code.
+    let incarnation = null;
+    try {
+      incarnation = liveIncarnation();
+    } catch {
+      incarnation = null;
+    }
+    let doc;
+    try {
+      doc = writer.read(business).document;
+    } catch {
+      return;
+    }
+    for (const [instance, copy] of Object.entries(snapshot.copies ?? {})) {
+      if (copy.state !== 'unbound') continue;
+      const record = doc.copyBindings?.[instance];
+      if (!object(record) || record.state !== 'bound' || !allGranted(record.services)) continue;
+      try {
+        if ((copy.missing ?? []).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+        const { pin, res } = resolve(business, instance, doc, record, incarnation);
+        const identity = credentials.copyIdentity(slot(instance), 'gitea');
+        if (!identity) deny('credential-unavailable');
+        const { token } = credentials.readCopy(slot(instance), 'gitea', identity);
+        await prove(doc, record, token, incarnation, deadline);
+        // The origin the token was proved at is the only one a call goes to.
+        const { origin } = boundRepositories(doc, res.services.gitea.projects);
+        verified.set(instance, Object.freeze({
+          copyId: record.copyId, incarnation, generation: record.generation, pin, grants: grantsOf(record),
+          identity, mac: mac(token), services: Object.keys(res.services), origin,
+        }));
+      } catch (e) {
+        failed.set(instance, e instanceof BusError && KEPT.test(e.code) ? e.code : 'credential-unavailable');
+      }
+    }
+  }
+
+  // The current authority of a copy, or the refusal. `withToken` also returns the slot's token,
+  // read now by the boot's identity and checked against the boot's MAC; only call() asks for it.
+  function current(business, instance, { withToken = false } = {}) {
+    if (business !== org || typeof instance !== 'string') deny('copy-unavailable');
+    if (fences.get(instance)) deny('credential-revoking');
+    const doc = read(business);
+    const record = doc.copyBindings?.[instance];
+    const v = verified.get(instance);
+    if (!v) {
+      if (object(record) && record.state === 'bound' && allGranted(record.services))
+        deny(failed.get(instance) ?? 'restart-required');
+      // Not bound: the resolver's own code (credential-unbound, a role change, a refused copy). This
+      // branch always refuses and holds no credential, so an unreadable registry is no incarnation.
+      let known = null;
+      try { known = liveIncarnation(); } catch { known = null; }
+      resolve(business, instance, doc, record, known);
+      deny('restart-required');
+    }
+    // A verified copy holds only while its organization is active under the incarnation boot proved.
+    const incarnation = liveIncarnation();
+    if (!object(record) || record.state !== 'bound' || record.copyId !== v.copyId || record.orgIncarnation !== v.incarnation
+      || incarnation !== v.incarnation) deny('credential-revoked');
+    if (record.generation !== v.generation || canonicalJson(grantsOf(record)) !== canonicalJson(v.grants)) deny('restart-required');
+    const { res } = resolve(business, instance, doc, record, incarnation);
+    if (canonicalJson(Object.keys(res.services)) !== canonicalJson(v.services)) deny('restart-required');
+    // A project's remote moved to another server is a new binding: the token never goes there.
+    const reach = boundRepositories(doc, res.services.gitea.projects);
+    if (reach.origin !== v.origin) deny('restart-required');
+    if (record.services.gitea.rotateBy < today()) deny('credential-expired');
+    const identity = credentials.copyIdentity(slot(instance), 'gitea');
+    if (!identity || identity.dev !== v.identity.dev || identity.ino !== v.identity.ino) deny('credential-unavailable');
+    let token;
+    try {
+      token = credentials.readCopy(slot(instance), 'gitea', v.identity).token;
+    } catch {
+      deny('credential-unavailable');
+    }
+    if (!timingSafeEqual(mac(token), v.mac)) deny('credential-unavailable');
+    const authority = sha256(canonicalJson({
+      org, instance, pin: v.pin, copyId: v.copyId, incarnation: v.incarnation, generation: v.generation, grants: v.grants, services: res.services,
+      origin: v.origin, repos: [...reach.repos].sort(),
+    }));
+    return { authority, services: v.services, record, res, reach, ...(withToken ? { doc, token } : {}) };
+  }
+
+  const gate = {
+    // { instance: [services] } of the copies the boot proved, for promoteCopies.
+    bound: () => Object.fromEntries([...verified].map(([instance, v]) => [instance, [...v.services]])),
+    verified: (business, instance) => business === org && verified.has(instance),
+    boot,
+    // Sync: the launch authority now, or the refusal.
+    authority(business, instance) {
+      const { authority, services } = current(business, instance);
+      return { authority, services: [...services] };
+    },
+    // The launcher's prepare: the authority, a live proof of the slot at the service, a fresh
+    // registry read, and the authority again; any change in between refuses.
+    // With `revision` (the launcher's, from the bundle it resolved) the organization file must still
+    // be that revision before and after the proof.
+    async prepare(business, instance, revision = undefined) {
+      sameRevision(business, revision);
+      const before = current(business, instance, { withToken: true });
+      await prove(before.doc, before.record, before.token, before.record.orgIncarnation, Date.now() + prepareMs);
+      const after = current(business, instance);
+      if (after.authority !== before.authority) deny('copy-authority-changed');
+      sameRevision(business, revision);
+      return { authority: after.authority, services: [...after.services] };
+    },
+    // Final admission and bindLaunch: the digest the launcher carries must still be the authority,
+    // and with `revision` the organization file still the one the launch resolved.
+    admit(business, instance, digest, revision = undefined) {
+      if (typeof digest !== 'string') deny('copy-authority-changed');
+      if (current(business, instance).authority !== digest) deny('copy-authority-changed');
+      sameRevision(business, revision);
+    },
+    revoking: (business, instance) => business === org && Boolean(fences.get(instance)),
+    // A write that can take a copy's grant away runs inside the fence. A definite answer (success,
+    // or a refusal the writer gave before any change) lifts it; an unknown outcome keeps it.
+    async fence(business, instance, fn) {
+      if (business !== org || typeof instance !== 'string') return fn();
+      fences.set(instance, (fences.get(instance) ?? 0) + 1);
+      let release = true;
+      try {
+        return await fn();
+      } catch (e) {
+        // A refusal code (lowercase, the bus's and the organization writer's) is a definite answer
+        // given before any change. outcome-unknown, a system error (ENOSPC, EIO) or an error with no
+        // code may have changed the binding or the slot, so the fence stays.
+        if (typeof e?.code !== 'string' || !/^[a-z][a-z0-9-]{1,80}$/.test(e.code) || e.code.startsWith('outcome-unknown')) release = false;
+        throw e;
+      } finally {
+        if (release) {
+          const n = fences.get(instance) - 1;
+          if (n > 0) fences.set(instance, n);
+          else fences.delete(instance);
+        }
+      }
+    },
+    // One checked Gitea request for a copy session: { business, role, copyAuthority } from the
+    // session the bus bound, never from the caller's arguments. Returns { status, json }.
+    async call(session, request) {
+      if (!object(session) || !object(request)) deny('copy-request-refused');
+      const { business, role: instance, copyAuthority } = session;
+      if (typeof copyAuthority !== 'string') deny('copy-authority-changed');
+      const { service = 'gitea', method, path, body } = request;
+      if (service !== 'gitea' || typeof method !== 'string' || typeof path !== 'string' || path.length > 1024) deny('copy-request-refused');
+      const m = REPO_PATH.exec(path);
+      if (!m || [m[1], m[2], ...m[3].split('/').slice(1)].some((x) => x === '.' || x === '..')) deny('copy-request-refused');
+      const before = current(business, instance, { withToken: true });
+      if (before.authority !== copyAuthority) deny('copy-authority-changed');
+      // Gitea's own semantics, enforced here: a read needs read:repository or write:repository, a
+      // write needs write:repository. A binding with neither sends no repository request.
+      const level = tokenLevels(before.res.services.gitea.scopes)?.repository;
+      if (READ.includes(method) ? !['read', 'write'].includes(level) : !(WRITE.includes(method) && level === 'write')) deny('copy-request-refused');
+      if (READ.includes(method) && body !== undefined) deny('copy-request-refused');
+      const { origin, repos } = before.reach;
+      if (!repos.has(`${m[1]}/${m[2]}`.toLowerCase())) deny('copy-request-refused');
+      const r = await transport({ url: origin, method, path, auth: { token: before.token }, ...(body === undefined ? {} : { body }), ca, timeoutMs });
+      // The answer is the session's only while the authority still holds.
+      const after = current(business, instance);
+      if (after.authority !== copyAuthority) deny('credential-revoked');
+      if (!object(r) || !Number.isSafeInteger(r.status) || r.status === 0) deny('credential-unavailable');
+      if (r.status >= 300 && r.status < 400) deny('copy-redirect-refused');
+      const out = { status: r.status, json: r.json ?? null };
+      assertNotHeld(out, [{ token: before.token }]);
+      return out;
+    },
+  };
+  return Object.freeze(gate);
+}
@@ -1,5 +1,6 @@
 import { BusError } from './broker.mjs';
 import { isHostKind } from '../../organization/src/vocabulary.mjs';
+import { scanOrganizations } from './definition-scan.mjs';
 // Row 199 (#1697, design section 6): issue, rotate, revoke and delete of one agent's credentials, for
 // the broker's human-only verbs. The broker checks the session, the keys and a running claim first.
 // Each verb leaves one receipt in the organization's changes.jsonl: the actor and a detail naming the
@@ -10,7 +11,10 @@ const dateKey = (service) => (isHostKind(service) ? 'rotateBy' : DATE_KEY[servic
 const deny = (code) => {
  throw new BusError(code);
 };
-export function credentialVerbs({ credentials, writer }) {
+// `organizations` lists every business this bus serves; issue checks each one's definitions. Without
+// it, only the issuing business's. `boot` is the bus's boot copy snapshot's definitions, { org,
+// definitions }, checked as well.
+export function credentialVerbs({ credentials, writer, organizations = null, boot = null }) {
  const state = (instance, service) =>
    credentials.status().find((e) => e.instance === instance && e.service === service)?.state;
  return (id, verb, args, actor) => {
@@ -27,8 +31,13 @@ export function credentialVerbs({ credentials, writer }) {
      const next = structuredClone(document);
      next.roles[agent].credentials[service] = { store: true, [dateKey(service)]: date };
      const detail = { verb: kind, agent, kind: [service], date };
-      const status = credentials.issue(instance, service, token, date, () =>
-        writer.write(id, next, { revision, actor, detail }),
+      // org-defscan (#1873): the value must not already sit in any organization's definitions. The
+      // check runs inside issue, before the store, the file or memory changes, on this bus loop, so
+      // no launch admission can run between the check and the value becoming held.
+      const status = credentials.issue(
+        instance, service, token, date,
+        () => writer.write(id, next, { revision, actor, detail }),
+        (clean) => scanOrganizations({ organizations: organizations?.() ?? [id], own: { id, document }, readRaw: (b) => writer.readRaw(b), boot }, clean),
      );
      // Row 210 (design D9): a host key's public line and fingerprint, for ops-01's authorized_keys.
      const host = status.fingerprint ? { publicKey: status.publicKey, fingerprint: status.fingerprint } : {};
@@ -6,7 +6,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { BusError } from './broker.mjs';
-import { credentialKind, isHostKind, ID_PATTERN } from '../../organization/src/vocabulary.mjs';
+import { credentialKind, isHostKind, ID_PATTERN, SERVICES } from '../../organization/src/vocabulary.mjs';
 const deny = (code) => {
  throw new BusError(code);
 };
@@ -87,6 +87,19 @@ export function parseHostKey(text) {
  }
  return { text: lines.join('\n') + '\n', publicLine, fingerprint, seed, needles };
 }
+// Credentials.assertClean's test: credential-leak when the value's JSON text holds an entry's token
+// or one of its retiring model keys. org-defscan (#1873): issue's check runs it on the value it is
+// about to hold.
+export function assertNotHeld(value, entries) {
+  let encoded;
+  try {
+    encoded = JSON.stringify(value);
+  } catch {
+    deny('invalid-request');
+  }
+  for (const { token, model } of entries)
+    if ([token, ...(model?.retiring ?? []).map(r => r.key)].some(k => encoded?.includes(k))) deny('credential-leak');
+}
 // D8: refuses credential-leak when the value's JSON text holds any part of the key.
 export function assertCleanKey(value, key) {
  let encoded;
@@ -458,11 +471,26 @@ export class Credentials {
  // Row 199 (design section 6): write the token to the agent's store path (tmp, fsync, rename), then
  // `commit` (the business file's reference becomes store), then memory. The token comes from the
  // caller's stdin and is never logged. Returns the entry's new status.
-  issue(instance, service, token, date, commit = () => {}) {
+  // org-defscan (#1873): `check` runs before anything changes. It gets an assertClean for this value
+  // alone, the test assertClean makes once the value is held; a throw leaves the store as it was.
+  issue(instance, service, token, date, commit = () => {}, check = () => {}) {
    this.#known(instance, service);
    if (!day(date)) deny('credential-date');
    const value = Credentials.#format(service, token);
+    check((v) => assertNotHeld(v, [value]));
    this.#invalidateModelProof(instance, service);
+    this.#writeSlot(instance, service, service === 'model' ? JSON.stringify(value.model) + '\n' : value.key ? value.token : value.token + '\n');
+    const file = this.#storePath(instance, service);
+    commit();
+    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
+    this.#tokens.set(instance + ':' + service, { ...value, date });
+    this.#revoked.delete(instance + ':' + service);
+    this.#held.delete(instance + ':' + service);
+    return this.status().find((e) => e.instance === instance && e.service === service);
+  }
+  // The store slot write issue and stageCopy share: tmp (O_EXCL, O_NOFOLLOW, 0600), fsync, rename
+  // over the slot, fsync the dir. Returns the identity of the file it wrote.
+  #writeSlot(instance, service, text, { undo = false } = {}) {
    const file = this.#storePath(instance, service);
    const agentDir = dirname(file);
    mkdirSync(this.#storeRoot, { recursive: true, mode: 0o700 });
@@ -477,27 +505,118 @@ export class Credentials {
    } catch (e) {
      if (e.code !== 'ENOENT') deny('credential-file');
    }
-    let fd;
+    // A write that fails leaves no token behind: the temp file this call made goes, and with `undo`
+    // (stageCopy) so does the slot it renamed into place.
+    let fd, identity;
    try {
-      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-      writeSync(fd, service === 'model' ? JSON.stringify(value.model) + '\n' : value.key ? value.token : value.token + '\n');
-      fsyncSync(fd);
+      try {
+        fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        const st = fstatSync(fd);
+        identity = { dev: st.dev, ino: st.ino };
+        writeSync(fd, text);
+        fsyncSync(fd);
+      } finally {
+        if (fd !== undefined) closeSync(fd);
+      }
+      renameSync(tmp, file);
+    } catch (e) {
+      if (identity) {
+        try {
+          const st = lstatSync(tmp);
+          if (st.isFile() && st.dev === identity.dev && st.ino === identity.ino) unlinkSync(tmp);
+        } catch {}
+      }
+      throw e;
+    }
+    try {
+      const dirFd = openSync(agentDir, constants.O_RDONLY);
+      try {
+        fsyncSync(dirFd);
+      } finally {
+        closeSync(dirFd);
+      }
+    } catch (e) {
+      if (undo) {
+        try {
+          this.unlinkCopy(instance, service, identity);
+        } catch {}
+      }
+      throw e;
+    }
+    return identity;
+  }
+  // #1873 CB2 (design section 5 step 4): a copy's service slot, <store>/<business>/<copy>/<service>.
+  // The bus stages it while the copy's binding is inactive, and afterwards reads back or removes only
+  // the file with the identity (dev, ino) it wrote. Memory and references never hold a copy's token
+  // in this slice; launch admission (CB3) reads the slot. A name a loaded reference uses refuses.
+  static checkFormat(service, token) {
+    return Credentials.#format(service, token);
+  }
+  stageCopy(instance, service, token) {
+    if (this.#refs.has(instance + ':' + service) || !SERVICES.includes(service)) deny('credential-reference');
+    const value = Credentials.#format(service, token);
+    return this.#writeSlot(instance, service, value.token + '\n', { undo: true });
+  }
+  // The staged token, read back with the store's checks plus one link only and the exact identity the
+  // stage wrote: a symlink, a hard link, a replaced or a stale file refuses credential-file.
+  readCopy(instance, service, identity) {
+    const file = this.#storePath(instance, service);
+    privateDir(this.#storeRoot);
+    privateDir(dirname(dirname(file)));
+    privateDir(dirname(file));
+    const same = (st) => st.dev === identity?.dev && st.ino === identity?.ino;
+    let original;
+    try {
+      original = lstatSync(file);
+    } catch {
+      deny('credential-file');
+    }
+    if (original.isSymbolicLink() || !original.isFile() || original.nlink !== 1 || !same(original)) deny('credential-file');
+    let fd, text;
+    try {
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+      const st = fstatSync(fd);
+      if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600 || st.size > 16384 || st.nlink !== 1 || !same(st))
+        deny('credential-file');
+      text = readFileSync(fd, 'utf8');
+    } catch (e) {
+      if (e instanceof BusError) throw e;
+      deny('credential-file');
    } finally {
      if (fd !== undefined) closeSync(fd);
    }
-    renameSync(tmp, file);
-    const dirFd = openSync(agentDir, constants.O_RDONLY);
+    return Credentials.#format(service, text);
+  }
+  // #1873 CB3: the identity (dev, ino) of a copy's slot as it is now, for the launch gate's boot check,
+  // or null when there is no single-link, self-owned 0600 regular file under private directories.
+  // The gate then reads the token by this identity (readCopy) and proves it at the service.
+  copyIdentity(instance, service) {
+    if (this.#refs.has(instance + ':' + service) || !SERVICES.includes(service)) return null;
    try {
-      fsyncSync(dirFd);
-    } finally {
-      closeSync(dirFd);
+      const file = this.#storePath(instance, service);
+      privateDir(this.#storeRoot);
+      privateDir(dirname(dirname(file)));
+      privateDir(dirname(file));
+      const st = lstatSync(file);
+      if (st.isSymbolicLink() || !st.isFile() || st.nlink !== 1 || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) return null;
+      return { dev: st.dev, ino: st.ino };
+    } catch {
+      return null;
    }
-    commit();
-    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
-    this.#tokens.set(instance + ':' + service, { ...value, date });
-    this.#revoked.delete(instance + ':' + service);
-    this.#held.delete(instance + ':' + service);
-    return this.status().find((e) => e.instance === instance && e.service === service);
+  }
+  // Removes the slot only while it is still the file the stage wrote; another file is left alone.
+  unlinkCopy(instance, service, identity) {
+    const file = this.#storePath(instance, service);
+    let st;
+    try {
+      st = lstatSync(file);
+    } catch (e) {
+      if (e.code === 'ENOENT') return false;
+      deny('credential-file');
+    }
+    if (!st.isFile() || st.dev !== identity?.dev || st.ino !== identity?.ino) return false;
+    unlinkSync(file);
+    return true;
  }
  // Row 236 (#436b section 5, settle forward): memory takes the store file as it is now, with the
  // constructor's checks, and `date` becomes the entry's date. A held entry refuses.
@@ -600,14 +719,7 @@ export class Credentials {
    return this.use(session.business + '/' + session.role, service, operation, options);
  }
  assertClean(value) {
-    let encoded;
-    try {
-      encoded = JSON.stringify(value);
-    } catch {
-      deny('invalid-request');
-    }
-    for (const { token, model } of this.#tokens.values())
-      if ([token, ...(model?.retiring ?? []).map(r => r.key)].some(k => encoded?.includes(k))) deny('credential-leak');
+    assertNotHeld(value, this.#tokens.values());
  }
  // Row 210 (design D5): whether a host.run for this agent and host is in flight.
  busy(instance, service) {
@@ -0,0 +1,114 @@
+// #1873 T1 follow-up (org-defscan): the live credential store's held-secret check on an org
+// definition's text. A definition is role text written into the organization file; launch hands its
+// instructions to an agent as the contract. A file edited by hand, or while the bus was down, never
+// went through the writer's check, so bus start and every launch run this one.
+//
+// The answer names where a held credential sits, never the text there. A key that itself holds a
+// credential is named by its parent ("personality key"). Not imported by broker.mjs (the sandbox
+// loads that file); runtime.mjs and credential-verbs.mjs are its callers.
+import { BusError } from './broker.mjs';
+
+export const DEFINITION_HOLDS_CREDENTIAL = 'definition-holds-credential';
+// An organization file credentials.issue could not read to check: the issue refuses.
+export const DEFINITION_SCAN_UNREADABLE = 'definition-scan-unreadable';
+// A definition name the scan quotes: the organization loader's id pattern. Anything else is "*".
+const NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+// A path segment the scan quotes; anything else becomes "*" (the hit is still reported).
+const SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+const MAX_DEPTH = 32;
+
+const isClean = (assertClean, value) => {
+  try {
+    assertClean(value);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// The first place in `entry` whose text the store holds, as a path ("instructions",
+// "personality.traits[1]", "role key"), or null when the entry is clean. A hit the walk can't place
+// (a value JSON.stringify sees and the walk doesn't) is "(entry)": the check fails closed.
+export function heldPath(entry, assertClean) {
+  if (isClean(assertClean, entry)) return null;
+  const join = (path, key) => {
+    const segment = SEGMENT.test(key) && isClean(assertClean, key) ? key : '*';
+    return path ? `${path}.${segment}` : segment;
+  };
+  const walk = (value, path, depth) => {
+    if (typeof value === 'string') return isClean(assertClean, value) ? null : path || '(entry)';
+    if (value === null || typeof value !== 'object' || depth > MAX_DEPTH) return null;
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        const hit = walk(value[i], `${path}[${i}]`, depth + 1);
+        if (hit) return hit;
+      }
+      return null;
+    }
+    for (const [key, child] of Object.entries(value)) {
+      if (!isClean(assertClean, key)) return path ? `${path} key` : 'key';
+      const hit = walk(child, join(path, key), depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  return walk(entry, '', 0) ?? '(entry)';
+}
+
+// The refusal for one definition. `name` is the definition's name without "org:". At issue time
+// (`organization` given) it names the organization too, and the value is the one being issued.
+export function definitionRefusal(name, path, { organization, boot = false } = {}) {
+  const quoted = typeof name === 'string' && NAME.test(name) ? name : '*';
+  const where = `${boot ? 'boot copy ' : ''}${name === null ? 'definitions' : `definitions.${quoted} ${path}`}`;
+  if (organization === undefined) return new BusError(DEFINITION_HOLDS_CREDENTIAL, `${where} holds a credential this bus holds`);
+  const org = typeof organization === 'string' && NAME.test(organization) ? organization : '*';
+  return new BusError(DEFINITION_HOLDS_CREDENTIAL, `organization ${org} ${where} holds the credential being issued`);
+}
+
+// The first entry of a `definitions` map that holds a credential, as { name, path }, or null.
+// `prefix` is stripped from each name ("org:" for a business's resolved definitions). A map that is
+// not an object is { name: null } when its text holds one.
+export function heldDefinition(definitions, assertClean, { prefix = '' } = {}) {
+  if (definitions === undefined) return null; // an organization with no definitions key
+  if (definitions === null || typeof definitions !== 'object' || Array.isArray(definitions))
+    return isClean(assertClean, definitions) ? null : { name: null, path: null };
+  for (const [key, entry] of Object.entries(definitions)) {
+    if (prefix && !key.startsWith(prefix)) continue;
+    if (!isClean(assertClean, key)) return { name: '*', path: 'key' };
+    const path = heldPath(entry, assertClean);
+    if (path !== null) return { name: key.slice(prefix.length), path };
+  }
+  return null;
+}
+
+// Every entry of a `definitions` map; throws the refusal for the first that holds a credential.
+export function scanDefinitions(definitions, assertClean, options = {}) {
+  const hit = heldDefinition(definitions, assertClean, options);
+  if (hit) throw definitionRefusal(hit.name, hit.path, options);
+}
+
+// org-defscan (#1873, Lead ruling on the re-check P2): credentials.issue and rotate refuse a value
+// that already sits in any organization's definitions, so no definition text becomes a held value
+// after its launch checks passed. `organizations` is every business this bus serves; `own` is the
+// issuing one's document, already read. Any other file is read raw, as bus start reads it, so a
+// definition no instance names is covered; a file that can't be read refuses. `boot` is the bus's boot
+// copy snapshot ({ org, definitions }, #1873 A3/A4): the root agents file's definitions merged with the
+// organization's at boot. Every reload re-applies it, so its text is live for the bus's lifetime.
+export function scanOrganizations({ organizations, own, readRaw, boot = null }, assertClean) {
+  for (const organization of organizations) {
+    let definitions;
+    if (organization === own.id) definitions = own.document.definitions;
+    else {
+      let raw;
+      try {
+        raw = readRaw(organization);
+      } catch {
+        raw = { readable: false };
+      }
+      if (raw?.readable !== true) throw new BusError(DEFINITION_SCAN_UNREADABLE);
+      definitions = raw.document.definitions;
+    }
+    scanDefinitions(definitions, assertClean, { organization });
+  }
+  if (boot?.definitions !== undefined) scanDefinitions(boot.definitions, assertClean, { organization: boot.org, boot: true });
+}
@@ -1,3 +1,6 @@
+import { decisionAutonomy, resolverSubject } from '../../organization/src/autonomy.mjs';
+import { autonomyEvent } from './autonomy-state.mjs';
+import { decisionResolution } from './autonomy-state.mjs';
 // The checks a landing makes on its merge decision and the task's review
 // (row 137, #1631). Two callers: scripts/land-work/read.mjs, which lands on
 // canonical refactor from a read-only copy of the bus, and the broker's
@@ -96,7 +99,8 @@ export function readLanding(q, business, id, { into, arbiter = false }) {
  const raise = json(raises[0].body) ?? {};
  if (d.action !== MERGE || raise.action !== MERGE) refuse('not-a-merge', `action ${d.action}`);

-  const closes = queries.closes(q, id);
+  const resolved=decisionResolution(q,b,id);
+  const closes=resolved?[resolved]:[];
  if (closes.length !== 1 || closes[0].op !== 'resolved')
    refuse('not-resolved', closes.length ? closes.map((r) => r.op).join(',') : 'open');
  const res = closes[0];
@@ -112,6 +116,13 @@ export function readLanding(q, business, id, { into, arbiter = false }) {
  // A cross-role decision routed to an agent closes only by decision.resolve, which takes it from
  // the routed role alone (s.role === route_to), so res.by here is the arbiter's run.
  const arbitrated = arbiter && d.class === 'cross-role' && d.route_to !== 'human' && res.via === 'broker' && !answers.length;
+  if(arbitrated && !business.roles?.[d.route_to]?.authority?.withinRole?.includes('decision.resolve.technical'))refuse('not-resolver','The technical resolver lost decision.resolve.technical; resolve afresh under current policy.');
+  if(arbitrated) {
+    if(d.route_to===d.raised_by_role || resolverSubject(business,d.route_to,raise.target))refuse('not-resolver','A person decides a resolver subject.');
+    const confirmed=autonomyEvent(q,b,id,['autonomy.confirmed']);
+    if((decisionAutonomy('merge',business.autonomy)==='in the loop' || raise.autonomyLevel==='in the loop') && (!confirmed || confirmed.body.resolution.at!==res.at || confirmed.body.resolution.by!==res.by))refuse('confirmation-required','A person must confirm the arbiter resolution.');
+    if(autonomyEvent(q,b,id,['autonomy.reverse.consume']))refuse('decision-reversed','This decision was reversed.');
+  }
  if (!human && !arbitrated)
    refuse('not-human', `resolved by ${res.by} via ${res.via}, ${answers.length} human answer(s)`);
  const options = json(d.options) ?? [];
@@ -67,7 +67,7 @@ class Failure extends Error {
 // lineages, each the current, retiring and earlier ids of one agent. A daily key quota follows
 // the lineage that holds its id, so it outlives rotation and re-issue. Both run only while a
 // daily key quota is set and a check is switched on. Without keyLineages they refuse.
-export function createLimits({ store, read, log, makeLoader = createLoader, keyForSubject = () => null,
+export function createLimits({ store, read, pluginDataRoot = null, log, makeLoader = createLoader, keyForSubject = () => null,
  keyLineages = () => { throw new Failure('proxy-key-refused'); } }) {
  if (typeof read !== 'function' || typeof log !== 'function') throw new TypeError('createLimits needs read and log');
  const loaders = new Map();
@@ -103,7 +103,7 @@ export function createLimits({ store, read, log, makeLoader = createLoader, keyF
    return validLineages(value) ? value : null;
  }
  const loaderFor = business => {
-    if (!loaders.has(business)) loaders.set(business, makeLoader({ log }));
+    if (!loaders.has(business)) loaders.set(business, makeLoader({ log, dataRoot:pluginDataRoot }));
    return loaders.get(business);
  };

@@ -4,7 +4,7 @@ import { createLoader } from '../../plugins/src/loader.mjs';
 const validId = s => typeof s === 'string' && /^[a-z0-9][a-z0-9._-]{0,63}$/.test(s);
 const validModel = s => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(s);
 const disabled = () => ({ status: 'disabled', observedAt: null, models: [], notices: [] });
-export function createModelCatalogue({ client, settings, now = Date.now, makeLoader = createLoader, proxyLock = null }) {
+export function createModelCatalogue({ client, settings, pluginDataRoot = null, now = Date.now, makeLoader = createLoader, proxyLock = null }) {
  const cache = new Map(), flights = new Map(); let generation = 0, writing = 0;
  function invalidate() { generation++; cache.clear(); }
  function begin() { writing++; invalidate(); }
@@ -19,12 +19,15 @@ export function createModelCatalogue({ client, settings, now = Date.now, makeLoa
    try {
      if (off(id)) return disabled();
      const names = [...settings(id)['model-provider']];
-      const loader = makeLoader({ log: () => {} });
+      const loader = makeLoader({ log: () => {}, dataRoot:pluginDataRoot });
      const result = await loader.load({ 'model-provider': names });
      if (result.refused.length || loader.snapshot('model-provider').length !== names.length) throw Error();
-      const c = client(); if (!c) throw Error();
+      // A module that needs no model proxy (fixture) answers without one; a module
+      // that asks the proxy while none is configured gets a refusal and reads unavailable.
+      const c = client();
+      const proxy = method => async (...args) => { if (!c) throw Error('model proxy not configured'); return c[method](...args); };
      const answers = await Promise.all(loader.snapshot('model-provider').map(async ({ name, module }) => {
-        const answer = await module.catalogue({ listAccounts: () => c.getCredentials(), listModels: name => c.getCredentialModels(name), listGroups: () => c.getUpstreamGroups(), now: () => new Date(now()).toISOString() });
+        const answer = await module.catalogue({ listAccounts: proxy('getCredentials'), listModels: proxy('getCredentialModels'), listGroups: proxy('getUpstreamGroups'), now: () => new Date(now()).toISOString() });
        if (answer?.status === 'unavailable' && answer.reason === 'model-key-collision') throw Object.assign(Error(), { code: 'model-key-collision' });
        if (answer?.status !== 'ready' || !Array.isArray(answer.models) || answer.models.length > 10000 || !Array.isArray(answer.notices) || answer.notices.length > 100) throw Error();
        for (const m of answer.models) {
@@ -198,12 +198,12 @@ export class ModelKeys {
  // Host-only callbacks are the existing synchronous organization path.
  hire(instance, check, publish) {
    return this.#exclusive(async () => {
-      check(); // Fresh validation and captured revision AFTER controller queue.
+      await check(); // Fresh validation and captured revision AFTER controller queue.
      const existed = this.hasRecord(instance);
      try {
        await this.#issue(instance);
-        check(); // Recheck captured revision AFTER HTTP, before publication.
-        return publish();
+        await check(); // Recheck captured revision AFTER HTTP, before publication.
+        return await publish();
      } catch (error) {
        // A newly issued generation has not escaped to queued admission yet.
        if (!existed && this.hasRecord(instance)) {
@@ -244,7 +244,7 @@ export class ModelKeys {
      this.#receipt({ action: 'proxy.key.revoked', keyIds: [record.keyId, ...record.retiring.map(r => r.keyId)], remoteState: 'revoked', localState: 'kept' });
    } catch (error) { if (error.code === 'proxy-uncertain' || (this.#lock && this.#uncertain())) fail('proxy-uncertain'); fail('credential-revoke-failed'); }
  }
-  prepareRevoke(instance) { return this.#exclusive(() => this.#prepareRevoke(instance)); }
+  prepareRevoke(instance, beforeRevoke = () => {}) { return this.#exclusive(() => { beforeRevoke(); return this.#prepareRevoke(instance); }); }
  completeRevoke(instance) {
    try { this.#lock?.assertCertain(); } catch { fail('proxy-uncertain'); }
    try {
@@ -347,7 +347,7 @@ export function modelOrganization({ modelKeys, writer }) {
  };
  const wrap = invoke => (business, verb, args, actor, context) => {
    const isRevoke = verb === 'instance.fire' || (verb === 'instances.set' && args.op === 'delete');
-    if (!isRevoke && verb !== 'instance.hire') return invoke(business, verb, args, actor, context);
+    if (!isRevoke) return invoke(business, verb, args, actor, context);
    return (async () => {
      if (pending.has(business)) fail('organization-busy');
      const agent = args.name ?? args.instance, instance = business + '/' + agent;
@@ -355,19 +355,11 @@ export function modelOrganization({ modelKeys, writer }) {
      if (verb === 'instances.set') invoke(business, 'instances.check', { instance: agent }, actor, context);
      const { revision } = writer.read(business);
      if (args.revision !== undefined && args.revision !== revision) fail('revision-conflict');
-      const checkHire = () => {
-        if (writer.read(business).revision !== revision) fail('revision-conflict');
-        const checked = invoke(business, 'instance.hireCheck', args, actor, context);
-        if (checked.revision !== revision) fail('revision-conflict');
-        return checked;
-      };
-      if (!isRevoke) checkHire(); // No registration or proxy I/O before shared checks.
      const prepare = { instance, revision, remoteRevoked: false };
      pending.set(business, prepare);
      const existed = modelKeys.hasRecord(instance);
      try {
-        if (isRevoke) { await modelKeys.prepareRevoke(instance); prepare.remoteRevoked = existed; }
-        else return await modelKeys.hire(instance, checkHire, () => invoke(business, verb, args, actor, context));
+        if (isRevoke) { await modelKeys.prepareRevoke(instance, () => context?.beforeWrite?.()); prepare.remoteRevoked = existed; }
        return invoke(business, verb, args, actor, context);
      } catch (error) {
        if (isRevoke && prepare.remoteRevoked && (error.code === 'revision-conflict' || error.code === 'revision-conflict-revoked')) modelKeys.revisionConflict(instance);
@@ -375,5 +367,12 @@ export function modelOrganization({ modelKeys, writer }) {
      } finally { pending.delete(business); }
    })();
  };
-  return { writer: adapter, revoke, wrap };
+  const hire = async (business, agent, check, publish) => {
+    if (pending.has(business)) fail('organization-busy');
+    const prepare = { instance: `${business}/${agent}`, revision: writer.read(business).revision, remoteRevoked: false };
+    pending.set(business, prepare);
+    try { return await modelKeys.hire(prepare.instance, check, publish); }
+    finally { pending.delete(business); }
+  };
+  return { writer: adapter, revoke, wrap, hire };
 }
@@ -19,6 +19,7 @@ export function busOrganization(business, resolved) {
    out.roles[role].network = r.limits.network;
    out.roles[role].authority = structuredClone(r.limits.authority);
    // REQ-HARN-2: "web" in the resolved tool limit is the grant for the broker's web verbs.
+    out.roles[role].tools = [...(r.limits.tools ?? [])];
    out.roles[role].web = (r.limits.tools ?? []).includes('web');
    // Row 210 (#1707, design D5): resolveInstance leaves host.<id> keys out of the session's
    // credentials. The bus child uses them, so they come back here from the business entry.
@@ -2,6 +2,7 @@
 // never command arguments, stdout or service-token-bearing environment variables.
 import { startBroker } from './runtime.mjs';
 import { BusError } from './broker.mjs';
+import { DEFINITION_HOLDS_CREDENTIAL } from './definition-scan.mjs';
 const LAUNCH_OPS = new Set([
  'identity',
  'authorizeLaunch',
@@ -9,6 +10,7 @@ const LAUNCH_OPS = new Set([
  'endLaunch',
  'recoverLaunch',
  'credentialStatus',
+  'definitionScan',
  'modelPreflight',
  'modelAdmission',
  'modelStall',
@@ -38,6 +40,7 @@ const LAUNCH_OPS = new Set([
  'sessionClearUncertain',
  'sessionClearRetire',
  'sessionClearStart',
+  'copyLaunch',
  'request.admission', 'request.launches', 'request.launchResult', 'request.release', 'request.chief', 'request.manifest',
 ]);
 function launchOp(m) {
@@ -88,8 +91,12 @@ function launchOp(m) {
  if (m.op === 'request.release') return runtime.requestRelease(m.cap, m.record);
  if (m.op === 'request.manifest') return runtime.requestManifest(m.record);
  if (m.op === 'request.chief') return runtime.requestChief(m.business);
-  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, thread: m.thread, session: m.session });
+  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, instance: m.instance, revision: m.revision, thread: m.thread, session: m.session, authority: m.authority });
+  // #1873 CB3: a copy's launch prepare: the launch authority after a live proof at the service.
+  if (m.op === 'copyLaunch') return runtime.copyLaunch({ business: m.business, instance: m.instance, revision: m.revision });
  if (m.op === 'credentialStatus') return runtime.credentialStatus(m.business, m.role);
+  // #1873 T1 follow-up (org-defscan): the launcher's held-secret check of an org: definition.
+  if (m.op === 'definitionScan') return runtime.definitionScan({ business: m.business, definition: m.definition, entry: m.entry });
  if (m.op === 'modelAdmission') return runtime.modelAdmission(m);
  if (m.op === 'modelPreflight') return runtime.modelPreflight(m);
  if (m.op === 'modelStall') return runtime.modelStall(m);
@@ -161,9 +168,11 @@ if (!process.send) {
        await runtime.close();
        return;
      }
-      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers });
+      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers, copyBound: runtime.copyBound });
    } catch (e) {
-      process.send?.(tag(message, { ok: false, error: e instanceof BusError ? e.code : 'startup-refused' }), () =>
+      // org-defscan: a held credential in a definition says which definition and key, never the text.
+      const reason = e instanceof BusError && e.code === DEFINITION_HOLDS_CREDENTIAL && typeof e.reason === 'string' ? { reason: e.reason } : {};
+      process.send?.(tag(message, { ok: false, error: e instanceof BusError ? e.code : 'startup-refused', ...reason }), () =>
        close(2),
      );
    }
@@ -98,16 +98,19 @@ export function createProxyLock({ stateDir, identity, waitMs = 5000 }) {
    fs.renameSync(temp, generationFile); syncDir(stateDir);
    fs.unlinkSync(fenceFile); syncDir(stateDir);
  }
-  async function clear({ restarted, read }) {
+  // `verify(previous)` (optional) re-proves a restart against the fence it would clear, inside
+  // the lock, and returns the evidence the receipt records.
+  async function clear({ restarted, read, verify }) {
    if (restarted !== true) fail('proxy-restart-required');
    return run(async () => {
      const previous = status();
+      const evidence = verify ? await verify(previous) : undefined;
      await read();
      const fd = fs.openSync(receiptFile, 'a', 0o600);
-      try { fs.writeFileSync(fd, JSON.stringify({ op: 'fence.clear', time: new Date().toISOString(), previous }) + '\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+      try { fs.writeFileSync(fd, JSON.stringify({ op: 'fence.clear', time: new Date().toISOString(), previous, ...(evidence === undefined ? {} : { evidence }) }) + '\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
      syncDir(stateDir);
      if (previous) confirm();
-      return { cleared: Boolean(previous) };
+      return { cleared: Boolean(previous), ...(evidence === undefined ? {} : { evidence }) };
    }, { allowUncertain: true });
  }
  async function run(operation, { allowUncertain = false } = {}) {
@@ -8,8 +8,8 @@ const KINDS = ['input', 'output', 'cacheWrite', 'cacheRead'];
 const ID = /^[a-f0-9]{12}$/;
 const plain = n => n <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(n) : String(n);
 // makeLoader is the plug-in loader's factory; a test wraps it to see what a module is handed.
-export function createProxyUsage({ store, read, client, records, log, now = Date.now, makeLoader = createLoader, enableDrain = false }) {
-  const loader = makeLoader({ log });
+export function createProxyUsage({ store, read, pluginDataRoot = null, client, records, log, now = Date.now, makeLoader = createLoader, enableDrain = false }) {
+  const loader = makeLoader({ log, dataRoot:pluginDataRoot });
  let due = 0, previous = '', pending = null, closed = false;
  const states = new Map();
  // #778: per enabled business, the batches taken off the proxy queue and then not written, since
@@ -1,6 +1,7 @@
 // Static refusal table: each listed code maps to one rail and next step. These strings
 // never interpolate caller arguments, credential references, policy values or file bytes.
 const entries = [];
+
 const group = (codes, rail, nextStep) => {
  const guidance = Object.freeze({ rail, nextStep });
  for (const code of codes.split(' ')) {
@@ -8,6 +9,39 @@ const group = (codes, rail, nextStep) => {
    entries.push([code, guidance]);
  }
 };
+group("authority-limits-unavailable", "R3/R12: future authority spend coverage", "Use authority near the loop with an enforced organization budget. Out of the loop waits for enforceable per-agent limits in every approvable definition; current-instance limits do not cover future hires.");
+group("policy-reverse-unavailable", "R3/R12: policy inverse unavailable", "Choose policy in the loop or out of the loop. Near the loop waits for a policy effect executor and a tested reverse.");
+group("invalid-autonomy autonomy-precondition reversal-unavailable", "R3/R12: validated owner autonomy and reversible effects", "Use only the four decision classes and three levels. Keep work in the loop until the class has a distinct resolver, tested inverse, notices, review and spend prerequisites; an unsupported effect needs an ordinary new decision. Authority near needs enabled limit checks and aggregate coverage of new agents. Moving out needs a near-loop resolution followed by the owner’s trail review. A failed inverse may have stopped an agent; inspect its writer receipt and use the normal launch or decision path.");
+group("confirmation-required", "R5/R12: person confirms the arbiter resolution", "The arbiter remains the resolver. Confirm its pending resolution in the owner Console, or return it with a reason for a fresh resolution.");
+group("decision-reversed reverse-window-closed", "R2/R12: one-use reverse within the owner's window", "Inspect the reversal trail. After the window, raise an ordinary new decision through the normal approval path; never replay the old approval.");
+group("definition-shared hire-resolution-required hire-owner-required decision-expired right-required", "R5/R8/R9: digest-bound hire approval by a permitted person", "Use the hire Console path with org.hire. Flagged, credential and root decisions need their owner; expired decisions need a fresh proposal.");
+group("root-fire-shared", "R3/R8: root fire must revoke every copy's grants", "Other organizations may retain running copies and grants. Ask the owner to coordinate revocation across those organizations before removing the root agent.");
+// #1873 CB1: copy credential bindings (design sections 4 and 6). Approval is owner-only; nothing here
+// names a token, a slot path or a file path.
+group("organization-bindings-protected", "R1/R8: copy bindings change only through an owner-approved decision", "Ask the chief to raise a binding decision for the copy; only the organization owner approves it. No other write path changes copyBindings.");
+group("credential-binding-changed credential-role-changed credential-definition-unpinned", "R1/R8: binding approval pinned to the current copy, definition and generation", "Read the copy's current binding and definition, then ask the chief to raise a fresh binding decision for the owner; an old approval never carries over.");
+group("credential-scope-exceeded", "R1/R8: effective access is the role intersected with the approval", "Narrow the requested scopes and projects to what the copy's role and admitted projects allow, or change the role through its own decision first.");
+group("credential-unbound", "R1/R8: launch needs an approved, verified binding", "Ask the chief to raise a binding decision for the missing service; the owner approves it. A pending binding is not usable until verification exists.");
+// #1873 CB2: a copy's service credential is accepted only after live verification at the service.
+group("credential-scope-unverified", "R1/R8: a copy credential is accepted only when the service proves its whole grant", "Gitea: approve read:user in the copy's binding (its role must declare it) so the account's repositories can be listed, give every bound project a Gitea remote on one server, and retry when the server answers. Vikunja has no verifier yet; its copy bindings stay unusable.");
+group("credential-identity-refused", "R1/R8: one dedicated service account per organization, copy and service", "Create the account the refusal names on the copy's Gitea server, not an administrator, with access to the bound projects' repositories only, and issue a token from that account. Never reuse another copy's or agent's account or token.");
+group("credential-date credential-format", "R1/R8: well-formed credentials with a future rotation date", "Supply the token on standard input alone, and a rotation date after today in YYYY-MM-DD form, no more than a year ahead for a copy credential.");
+// #1873 CB3: a copy launches only on a binding this bus verified at boot, and each use rechecks it.
+group("restart-required", "R1/R3/R8: a copy's binding is materialized only at boot, after live verification", "Ask the instance owner to restart the organization bus so it verifies the copy's newly approved or re-issued binding, then launch the copy again.");
+group("credential-revoked", "R1/R8: a revoked or replaced binding grants nothing, with no cached token", "Read the copy's binding. Ask the chief to raise a fresh binding decision for the owner, have the credential issued again, then restart the organization bus.");
+group("credential-revoking", "R1/R8: a revoke in flight blocks every new launch and call", "Wait for the revoke to finish and read its receipt. If its outcome stays unknown, ask the instance owner to restart the organization bus before launching the copy again.");
+group("credential-unavailable", "R1/R8: a copy credential is used only while the service and the stored slot prove it", "Check that the copy's Gitea server answers, then ask the owner to issue the copy's credential again and restart the organization bus. A slot changed outside the bus is never trusted.");
+group("credential-expired", "R1/R8: a copy credential stops at its rotation date", "Ask the owner to issue a fresh credential for the copy with a new rotation date, then restart the organization bus.");
+group("copy-authority-changed", "R1/R3/R8: the launch authority admitted at prepare must hold through bind and every use", "The copy's role, projects or binding changed during the launch. Read the copy's current binding and launch it again; a running session from the old authority must be stopped and relaunched.");
+group("copy-request-refused", "R1/R8: a copy calls only its bound repositories with the methods its approved scopes allow", "Call a repository of a project the copy is bound to, with GET or HEAD when the binding approved read:repository or write:repository, or a write method only when it approved write:repository. Ask the chief for a binding decision to widen it.");
+group("organization-changed organization-unreadable", "R3/R8: a launch holds to the organization file revision it resolved", "The organization file changed, or could not be read, while the launch was in progress. Launch the agent again so it resolves the file as it stands now.");
+group("copy-redirect-refused", "R1/R8: a copy credential goes only to the approved Gitea origin", "The Gitea server answered with a redirect. Fix the bound project's remote to name the server's final address, then ask the owner to issue the credential again; redirects are never followed.");
+group("project-repo-bound", "R1/R8: a binding grants the repository its projects name when the owner approved it", "Revoke the copy binding that names the project first: the chief raises an unbind decision and the owner approves it. Then set the project repository, then ask the chief to raise a new binding decision for the owner.");
+group("copy-unavailable copy-refused", "R3/R8: one active, unambiguous copy identity", "Read the organization's copies. Ask the owner to resolve the definition collision or restore the copy's source before raising a binding decision.");
+group("copy-stale", "R3: root policy changed since this bus booted", "Ask the owner to restart the organization bus to load the approved root policy, then launch a fresh copy.");
+group("root-policy-unreadable", "R3: root policy evidence must be readable", "Ask the owner to inspect root agent receipt metadata and restart the bus after repairing the read failure.");
+group("plugin-disabled", "R3/R6/R10: installed, pinned and enabled plugin capabilities", "Ask the instance owner to verify the installed plugin and the organization owner to enable it. A replacement of an already loaded package needs a host restart; then relaunch the agent.");
+group("plugin-restart-required", "R3/R10: one imported package pin per host process", "Ask the instance owner to restart the host after replacing an already loaded package, then retry through the supported path.");
 group(
  "access-refused access-revoked share-exists share-not-covered share-not-found tester-dev-only tester-off tester-refused tester-required tester-target-not-running thread-not-allowed thread-not-owned",
  "R7: caller access and scoped session boundary",
@@ -38,6 +72,18 @@ group(
  "R1/R3: owner-managed model and provider configuration",
  "Ask the owner to inspect the provider configuration through its supported controls; never put keys or callback contents in messages."
 );
+// #1873: proxy setup from the Console page and `mosaic proxy`. Each code has one owner next step.
+group("proxy-install-missing proxy-fetch-url proxy-fetch-failed proxy-fetch-redirect", "R1: pinned model proxy release", "Fetch the pinned release from the Proxy page or with mosaic proxy fetch. A download or redirect failure is retried as it stands; the release URL is fixed by the pin.");
+group("proxy-install-invalid proxy-fetch-hash proxy-fetch-archive proxy-fetch-existing", "R1: pinned release hashes must match", "A file does not match the pinned hash. Do not run it. Ask the owner to remove the pinned release directory named in the README and fetch again.");
+group("proxy-already-initialized proxy-port-in-use proxy-management-key-invalid", "R1/R4: proxy init is exclusive creation", "Init never rewrites proxy.json. Read the Proxy page status; pick a free port, or keep the existing setup and continue from the status's next step.");
+group("proxy-init-busy proxy-init-lock-held proxy-init-lock-absent", "R4: init lock clears only when provably stale", "Wait for a running init to finish. A stale lock clears from the Proxy page or with mosaic proxy init-lock clear only when the bus is stopped and no proxy.json, key file or proxy dir exists; the refusal lists what is still there.");
+group("proxy-key-transport", "R1/R6: a pasted key travels only over loopback or HTTPS", "Use the generated key, which never leaves the host, or open the Console over HTTPS or on this machine to paste one.");
+group("proxy-restart-required proxy-restart-unconfirmed proxy-lock-uncertain", "R4/R6: fence clears only after a confirmed proxy restart", "Restart the proxy from the Proxy page or with mosaic proxy fence clear --restart, so the new process is confirmed on the proxy port, then clear the fence. A fence file with no readable time cannot be proven against: restart the proxy service yourself and run mosaic proxy fence clear --proxy-restarted.");
+group("proxy-admin-busy", "R4: one proxy setup action at a time", "Wait for the running fetch, init or unit action to finish (the Proxy page status shows it), then retry.");
+group("proxy-key-mismatch", "R1: a pasted management key is confirmed before init", "Type the same key in both fields, or leave them empty to have the bus generate the key.");
+group("proxy-lock-busy proxy-lock-invalid", "R4: one proxy key write at a time", "Wait for the running proxy write to finish and retry. An invalid lock file needs the owner to inspect the proxy state directory.");
+group("proxy-not-configured proxy-unit-usage proxy-unit-exists proxy-unit-dropin proxy-unit-copy proxy-unit-path proxy-unit-missing proxy-unit-unhealthy proxy-unit-failed", "R1/R4: proxy user unit is explicit creation", "Initialize the proxy first, then install the unit from the Proxy page or with mosaic proxy unit install. An existing unit or drop-in is never replaced; remove it by hand. An unhealthy unit: read its journal by unit name and restart it.");
+group("proxy-client-invalid proxy-client-refused proxy-client-response", "R1: proxy management answers", "Check the proxy unit is running and its port answers on the Proxy page, then retry. Upstream bodies are never shown.");
 group(
  "block-recipient block-reply-required block-sender message-recipient-refused message-sender-refused tester-reply-required tester-thread-human user-reply-required user-thread-human",
  "Role messaging: permitted sender, recipient and reply context",
@@ -83,6 +129,16 @@ group(
  "Role configuration and protected instance controls",
  "Read the permitted configuration/status and ask the owner or configured chief to repair it through the supported path. Do not edit policy to bypass the refusal."
 );
+group(
+  "definition-holds-credential",
+  "R1: no held credential in an organization definition's role text",
+  "Ask the organization owner to remove the credential from the named definition and key, then restart the bus, relaunch the agent or issue the credential again. For a hire, deny it and have the chief raise it again without that text. Do not copy the text anywhere to inspect it."
+);
+group(
+  "definition-scan-unreadable",
+  "R1/R3: a credential is issued only after every organization's definitions are checked",
+  "Ask the instance owner to repair the organization file the bus cannot read, then issue the credential again. Nothing was stored."
+);
 group(
  "field-writer task-already-archived task-archived task-conflict task-create-conflict task-create-uncertain task-not-archived task-not-found task-position-full task-project-refused task-scope-required task-subject-required",
  "Role task ownership, allowed fields and current task state",
@@ -128,6 +184,23 @@ group(
  "R3/role scope: configured project and service state",
  "Read the supported project/service status and ask its owner to repair missing configuration or state before retrying."
 );
+// #1873 SP1: starter packs. A pack copies items into an organization and grants nothing; a refusal
+// names positions and checked names only, never a pack's text or a file path.
+group(
+  "starter-pack-invalid",
+  "R8/R10: a pack copies no grant above the shipped templates",
+  "Read the refusal's position in the pack and correct it there. A role must narrow the template its from names; a pack never carries credentials, members, plugins, launch settings or a root hire. A shipped or installed pack needs a reviewed fix or its plug-in owner."
+);
+group(
+  "starter-pack-not-found",
+  "R10: only the caller's own saved templates",
+  "List your saved templates and use one of those names. A saved template is visible only to the owner who saved it."
+);
+group(
+  "starter-pack-template-changed",
+  "R8: a pack's hash pin must match the current template",
+  "The template the pack pins has changed since the pack was written. Review the current template, then re-pin the pack to its new hash, or use a pack that already matches."
+);
 group(
  "not-resolver",
  "Role resolve right and decision route",
@@ -1,3 +1,8 @@
+import { autonomyHost, authorityHost } from './autonomy-host.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationPlugins } from '../../plugins/src/organization.mjs';
+import { pluginService } from '../../plugins/src/tools.mjs';
+import { readPluginLock } from '../../plugins/src/pinned.mjs';
 import { createRequirementsHost } from '../../tasks/src/builtin.mjs';
 import { createRequirementCatalog } from './requirement-catalog.mjs';
 import { readPrdMaterial } from '../../project/src/prd.mjs';
@@ -30,12 +35,19 @@ import { createModelCatalogue } from './model-catalogue.mjs';
 import { sha256 } from '../../model-proxy/src/common.mjs';
 import { initializeProxy } from '../../model-proxy/src/settings.mjs';
 import { createProxyLock } from './proxy-lock.mjs';
+import { verifyRestart } from '../../model-proxy/src/admin.mjs';
 import { ModelKeys, modelOrganization, stopModelRuns, MODEL_STOP_TIMEOUT_MS } from './model-keys.mjs';
 import { instanceSettings } from '../../organization/src/instance-settings.mjs';
 import { organizationWriter, OrganizationError, setReplyLimits } from '../../organization/src/organization.mjs';
+import { definitionVerbs, DEFINITION_BUS_VERBS } from '../../organization/src/definition-verbs.mjs';
+import { ORG_PREFIX, orgDefinitionName } from '../../organization/src/definitions.mjs';
+import { DEFINITION_HOLDS_CREDENTIAL, heldPath, scanDefinitions } from './definition-scan.mjs';
+import { ROLE_RIGHTS } from '../../organization/src/org-rights.mjs';
 import { getProjectRemote } from '../../organization/src/project-remotes.mjs';
 import { credentialVerbs } from './credential-verbs.mjs';
-import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { loadWithCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { copyGrant, sweepCopySlots } from './copy-grant.mjs';
+import { copyLaunchGate } from './copy-launch.mjs';
 import { loadRole } from '../../organization/src/role.mjs';
 import { resolveInstance } from '../../organization/src/resolve.mjs';
 import { canonicalJson } from '../../organization/src/util.mjs';
@@ -57,7 +69,7 @@ import { discordProcessingHooks } from '../../discord/src/processing.mjs';
 import { createContainerStopper } from '../../processing-control/src/containers.mjs';

 // Row 194 (D3): the verbs the instance writer commits, whose answers carry restart.
-const INSTANCE_VERBS = new Set(['instances.set', 'veto.set', 'instance.hire', 'instance.fire']);
+const INSTANCE_VERBS = new Set(['instances.set', 'veto.set', 'instance.fire']);
 // FED R4 (#1801, design 3.7): the revocation timer's period.
 export const ACCESS_SWEEP_MS = 30_000;
 // Trusted host API. S1 supplies resolved definitions, S6 supplies launch records and ends them.
@@ -71,10 +83,10 @@ export const ACCESS_SWEEP_MS = 30_000;
 // web.fetch still works. A plug-in that refuses to load is logged and leaves search off; it never
 // stops the broker. Under harness-builtin the harness serves web itself, so the broker gets no
 // service and refuses the web verbs.
-export async function webServices(businesses, { log = (e) => process.stderr.write(`plugins: ${JSON.stringify(e)}\n`), deps } = {}) {
+export async function webServices(businesses, { log = (e) => process.stderr.write(`plugins: ${JSON.stringify(e)}\n`), deps, dataRoot = null } = {}) {
  const services = new Map();
  for (const [name, b] of Object.entries(businesses)) {
-    const loader = createLoader({ log });
+    const loader = createLoader({ log, dataRoot });
    await loader.load(b.plugins ?? {});
    const [source] = loader.modules('search-source');
    // "harness-builtin" is served by the harness itself, not the broker: no broker web verbs.
@@ -90,7 +102,10 @@ export async function webServices(businesses, { log = (e) => process.stderr.writ
 // checks a write runs, which are synchronous. A module that doesn't load, or answers anything but a
 // list of names, answers null, which refuses the write. The tree is pinned, so a module changes only
 // with a re-pin, and a re-pin restarts the bus.
-export async function harnessLevels({ log = (e) => process.stderr.write(`plugins: ${JSON.stringify(e)}\n`) } = {}) {
+// AU (#1873): the same pass records each module's countsAccount() answer, which decides whether an
+// account quota covers authority hires. It is read once here; an installed harness whose lock pin
+// has changed since answers null (not covered) until the bus restarts and reads the new module.
+export async function harnessLevels({ log = (e) => process.stderr.write(`plugins: ${JSON.stringify(e)}\n`), dataRoot = null } = {}) {
  const levels = new Map();
  let names = [];
  try {
@@ -98,18 +113,37 @@ export async function harnessLevels({ log = (e) => process.stderr.write(`plugins
  } catch (e) {
    log({ event: 'harness-levels-unread', message: e.message });
  }
+  let pins = {};
+  if (dataRoot !== null) {
+    try { pins = readPluginLock(dataRoot).plugins; names = [...new Set([...names,...Object.keys(pins).filter(name=>hasModule('harness',name,dataRoot))])]; }
+    catch { log({event:'harness-levels-unread',message:'installed harness discovery refused'}); }
+  }
+  const accounts = new Map();
  for (const name of names) {
-    const loader = createLoader({ log });
+    const loader = createLoader({ log, dataRoot });
    if ((await loader.load({ harness: [name] })).refused.length) continue;
+    const [module] = loader.modules('harness');
    try {
-      const list = loader.modules('harness')[0].levels();
+      const list = module.levels();
      if (Array.isArray(list) && list.every((level) => typeof level === 'string')) levels.set(name, Object.freeze([...list]));
    } catch (e) {
      log({ event: 'harness-levels-failed', name, message: e.message });
    }
+    // AU (#1873): whether this harness's launches spend launch.account, as its module declares.
+    try {
+      const counts = module.countsAccount();
+      if (typeof counts === 'boolean') accounts.set(name, counts);
+    } catch (e) {
+      log({ event: 'harness-account-failed', name, message: e.message });
+    }
  }
  const lookup = (name) => levels.get(name) ?? null;
  lookup.names = [...levels.keys()].sort();
+  const pinned = (name) => {
+    if (!Object.hasOwn(pins, name)) return true;
+    try { return readPluginLock(dataRoot).plugins[name]?.sha256 === pins[name].sha256; } catch { return false; }
+  };
+  lookup.countsAccount = (name) => (accounts.has(name) && pinned(name) ? accounts.get(name) : null);
  return lookup;
 }
 // Row 224 C2-05b: a host-only adapter. A failed fetch keeps serving immutable old
@@ -284,7 +318,17 @@ export async function startBroker({
  builtinBinding = null,
  modelCatalogue = null, // in-process fixture seam; boot JSON cannot supply a service
  makeProviderLoader = createLoader, // in-process fixture seam; boot JSON cannot supply a function
+  // #1873 A3: the boot's root and project agent copies (cli config.mjs copiesAtBoot), plain data. Every
+  // reload of the organization file below re-applies this snapshot, never the root file.
+  copies = null,
+  // #1873 CB3: the tests' Gitea transport and CA for the copy launch gate and copyGrant, { send, ca }.
+  // In-process only, like librarySync; production passes none.
+  copyTransport = null,
 }) {
+  if (copies !== null && (typeof copies !== 'object' || Array.isArray(copies) || typeof copies.org !== 'string'
+      || !Object.hasOwn(businesses ?? {}, copies.org) || copies.copies === null || typeof copies.copies !== 'object' || Array.isArray(copies.copies)))
+    throw new BusError('invalid-host-request');
+  const loadOrg = id => loadWithCopies(id, { dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot, snapshot: copies?.org === id ? copies : null });
  if (!Array.isArray(consoleOwners) || consoleOwners.length > 512 || consoleOwners.some((o) => o === null || typeof o !== 'object' || Array.isArray(o) ||
      Object.keys(o).length !== 3 || ['provider', 'iss', 'sub'].some((k) => typeof o[k] !== 'string' || !o[k] || o[k].length > 512)))
    throw new BusError('invalid-host-request');
@@ -296,10 +340,10 @@ export async function startBroker({
      || (Object.hasOwn(librarySync, 'intervalMs') && !(Number.isSafeInteger(librarySync.intervalMs) && librarySync.intervalMs > 0))
      || (Object.hasOwn(librarySync, 'configDir') && typeof librarySync.configDir !== 'string')))
    throw new BusError('invalid-host-request');
-  let modelProxyClient = null, proxyPage = null, proxyUsage = null, usageTimer = null, proxyLock = null;
+  let modelProxyClient = null, proxyPage = null, proxyUsage = null, usageTimer = null, proxyLock = null, proxyPort = null;
  let modelKeys = null, modelTimer = null, modelSweep = null, modelCatalogues = null;
  const modelRuns = new Map();
-  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null;
+  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null, copyLaunch = null;
  try {
    // Lifecycle Task 2 (#797): a product whose mapping is published but not yet activated is not part of
    // this process. A managed product is part of it only with both a committed activate receipt in the
@@ -345,6 +389,7 @@ export async function startBroker({
        proxyLock = createProxyLock({ stateDir: join(instanceDataRoot, 'proxy'), identity: `${instanceConfigDir}:${proxy.port}` });
      }
      modelProxyClient = await loadManagementClient({ configDir: org ? instanceConfigDir : organization.dir, proxy, receipt: proxyReceipt });
+      proxyPort = proxy.port;
    }

    // Row 234 (#1740, r6 X4 third bullet): each host grant record gives its agent a store reference to
@@ -363,6 +408,20 @@ export async function startBroker({
    // Row 236 (#1742, #436b r5 section 5): each gitea grant record gives its agent a store reference to
    // gitea, and `held` names the files memory must not load until reconcile or a revoke.
    const { held } = storeRoot ? giteaStart(store, storeRoot, businesses, references) : { held: [] };
+    // #1873 CB2 (security review P2): a copy slot an issue staged before a crash, whose binding holds
+    // no grant for it, goes before Credentials loads and before any issue can run.
+    if (storeRoot) {
+      const reader = organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot });
+      const documents = Object.keys(businesses).map((id) => {
+        try {
+          return [id, reader.read(id).document];
+        } catch {
+          return [id, null];
+        }
+      });
+      for (const entry of sweepCopySlots(storeRoot, documents, references))
+        process.stderr.write(`copies: ${JSON.stringify({ event: 'copy-slot-swept', ...entry })}\n`);
+    }
    // #1886 (F3 defect l): a store reference with no file yet reads as no key (design D3a), but Credentials
    // refuses a missing store root, and only issue() made it. Start makes it the same way issue() does when
    // any reference names the store. A root that exists with loose modes or as a symlink still refuses.
@@ -370,6 +429,37 @@ export async function startBroker({
      mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
    credentials = new Credentials({ references, repoRoots: protectedRoots, dataRoot, storeRoot, held,
      modelAgents: proxy ? Object.entries(businesses).flatMap(([id, b]) => Object.keys(b.roles).map(role => id + '/' + role)) : [] });
+    // #1873 T1 follow-up (org-defscan): no organization definition's text holds a credential this store
+    // holds. The boot copy's org: definitions first, then every entry of the file itself, named or not.
+    // A hit refuses the start; the refusal names the definition and key, never the text.
+    const clean = value => credentials.assertClean(value);
+    for (const [id, b] of Object.entries(businesses)) {
+      scanDefinitions(b.definitions, clean, { prefix: ORG_PREFIX });
+      if (!organization) continue;
+      const raw = organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }).readRaw(id);
+      if (raw.readable) scanDefinitions(raw.document.definitions, clean);
+    }
+    // The boot copy snapshot's definitions (the root agents file's, A4): every reload re-applies them.
+    if (copies?.definitions !== undefined) scanDefinitions(copies.definitions, clean, { boot: true });
+    // #1873 CB3: each unbound copy whose binding is bound is re-resolved and its slot proved live at
+    // the service; only those that pass join the organization, now, before anything takes a copy of
+    // `businesses`. A binding approved later answers restart-required. copyGrant keeps the boot's own
+    // snapshot (bootCopies), and so does the gate: what it promotes is decided at boot only.
+    const bootCopies = copies;
+    if (organization && storeRoot && copies) {
+      copyLaunch = copyLaunchGate({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
+        configDir: organization.dir, rolesDir: organization.rolesDir, snapshot: copies, ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) });
+      await copyLaunch.boot(copies.org);
+      const verified = copyLaunch.bound();
+      if (Object.keys(verified).length) {
+        copies = promoteCopies(copies, verified);
+        const b = loadOrg(copies.org);
+        const resolved = {};
+        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
+        businesses[copies.org] = withoutPending(copies.org, busOrganization(b, resolved));
+        if (proxy) for (const instance of Object.keys(verified)) if (Object.hasOwn(businesses[copies.org].roles, instance)) credentials.registerModel(copies.org + '/' + instance);
+      }
+    }
    if (proxy) {
      const inventory = modelRunInventory(dataRoot, modelRuns, credentials);
      modelKeys = new ModelKeys({ credentials, client: modelProxyClient, configDir: org ? instanceConfigDir : organization.dir, org: org?.id ?? null, lock: proxyLock,
@@ -399,20 +489,20 @@ export async function startBroker({

    // vikunja:19/305: the plug-in switch through the same human-only path as the limits: the verbs
    // plugins and plugins.set, logged in changes.jsonl with the actor, a missing module refused.
-    const plugins=organization?pluginSettings({dir:organization.dir,rolesDir:organization.rolesDir,exists:hasModule}):null;
-    const levels=organization?await harnessLevels():()=>null;
+    const plugins=organization?pluginSettings({dir:organization.dir,rolesDir:organization.rolesDir,dataRoot:instanceRoot ?? dataRoot,exists:(kind,name)=>hasModule(kind,name,instanceRoot ?? dataRoot)}):null;
+    const levels=organization?await harnessLevels({dataRoot:instanceRoot ?? dataRoot}):()=>null;
    // Row 333 R4 (#1831): the writer's key lineage lookup, ids only, from this bus's own credential
    // records. A daily key quota moved within one agent's lineage keeps its since and its count.
    const keyLineage=(business,keyId)=>modelKeyLineage(credentials.status(),business,keyId);
    const settings=organization?launchSettings({...organization,sessions:()=>readSessions(dataRoot),levels,keyLineage}):null;
-    modelCatalogues = modelCatalogue ?? (settings ? createModelCatalogue({ client: () => modelProxyClient, settings: id => settings.current(id).plugins ?? {}, proxyLock }) : null);
+    modelCatalogues = modelCatalogue ?? (settings ? createModelCatalogue({ pluginDataRoot:instanceRoot ?? dataRoot, client: () => modelProxyClient, settings: id => settings.current(id).plugins ?? {}, proxyLock }) : null);
    // Resolve legacy table entries with the enabled modules' declarations. A
    // missing or ambiguous mapping never becomes an available route.
    async function catalogueFor(id, options = {}) {
      const snapshot = settings.writer.read(id);
      const current = settings.current(id);
      const names = current.plugins?.['model-provider'] ?? [];
-      const loader = makeProviderLoader({log:()=>{}});
+      const loader = makeProviderLoader({dataRoot:instanceRoot ?? dataRoot,log:()=>{}});
      const loaded = await loader.load({'model-provider': names});
      const catalogue = await modelCatalogues.read(id, options);
      if (loaded.refused.length || settings.writer.read(id).revision !== snapshot.revision) return {...catalogue, status:'unavailable', legacy:{}};
@@ -472,16 +562,16 @@ export async function startBroker({
      return { revoked: services, outsideStore: how === 'fire' ? outside : [] };
    }
    // Row 165 (#1662): the human adds and changes role instances through instances and instances.set.
-    const proxyOrganization = modelKeys ? modelOrganization({ modelKeys, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir }) }) : null;
+    const proxyOrganization = modelKeys ? modelOrganization({ modelKeys, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot }) }) : null;
    const instances=organization?instanceSettings({dir:organization.dir,rolesDir:organization.rolesDir,system:organization.system,levels,revoke,
      ...(proxyOrganization ? { writer: proxyOrganization.writer, revoke: proxyOrganization.revoke(revoke) } : {})}):null;
    const usageLog = entry => process.stderr.write(`usage: ${JSON.stringify(entry)}\n`);
    const keyForRun = (business, run) => modelRuns.get(business + ':' + run)?.keyId ?? null;
    // Row 333 R3 (#1831): the usage view marks key quotas that match no hired agent; limits answers.
    let orphanedKeys = () => null;
-    const usage = await createUsage({ store, dataRoot, businesses, log: usageLog, keyForRun,
+    const usage = await createUsage({ store, dataRoot, pluginDataRoot:instanceRoot ?? dataRoot, businesses, log: usageLog, keyForRun,
      proxyView: business => proxyUsage?.view(business) ?? null, keyOrphans: business => orphanedKeys(business) });
-    proxyUsage = createProxyUsage({ store, log: usageLog, client: async () => {
+    proxyUsage = createProxyUsage({ store, pluginDataRoot:instanceRoot ?? dataRoot, log: usageLog, client: async () => {
      if (!modelKeys) return null;
      await modelKeys.verifyIdentity();
      return modelProxyClient;
@@ -491,7 +581,7 @@ export async function startBroker({
    // Row 125 (#1619, REQ-LIMIT-3, REQ-LIMIT-4): the limit checks read the organization file at
    // each ask, so a limit, a reset or a switched-on check takes effect without a restart.
    const limitLog = entry => process.stderr.write(`limits: ${JSON.stringify(entry)}\n`);
-    const limits = createLimits({ store, read: id => settings ? settings.current(id) : businesses[id], log: limitLog,
+    const limits = createLimits({ store, pluginDataRoot:instanceRoot ?? dataRoot, read: id => settings ? settings.current(id) : businesses[id], log: limitLog,
      keyForSubject: (business, subject) => modelUsageKey(credentials.status(), modelRuns, business, subject),
      keyLineages: business => modelKeyLineages(credentials.status(), business) });
    orphanedKeys = business => limits.orphanedKeys(business);
@@ -561,10 +651,13 @@ export async function startBroker({
      && fixedAtStart(b).libraries === boot.libraries
      && Object.entries(fixedAtStart(b).roles).every(([role, f]) => f === (boot.roles[role] ?? fixedRole(null)));
    const booted = new Map(Object.entries(businesses).map(([id, b]) => [id, fixedAtStart(b)]));
+    // #1873 CB3: a copy the boot snapshot had unbound (whether the gate promoted it or not).
+    const copyNeedsAuthority = (id, instance) => copyLaunch !== null && bootCopies?.org === id
+      && Object.hasOwn(bootCopies.copies, instance) && bootCopies.copies[instance].state === 'unbound';
    const reloadLog = entry => process.stderr.write(`organization: ${JSON.stringify(entry)}\n`);
    function reload(id) {
      try {
-        const b = loadBusiness(id, { dir: organization.dir, rolesDir: organization.rolesDir });
+        const b = loadOrg(id);
        const resolved = {};
        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
        const next = withoutPending(id, busOrganization(b, resolved));
@@ -584,7 +677,7 @@ export async function startBroker({
    // receipt-backed addition under the organization lock: the file must still be this business plus that entry,
    // with the credentials, bots, libraries, roles and prior mappings the bus booted with. Anything else leaves
    // the product pending. Both readiness records must exist before even the broker's reload begins.
-    const writer = organization ? organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir }) : null;
+    const writer = organization ? organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot }) : null;
    const known = new Map(Object.entries(businesses).map(([id, b]) => [id, canonicalJson(b.projects ?? {})]));
    function activateManagedProject({ business: id, project, receipt, organization_revision }) {
      if (!writer || !booted.has(id) || !Object.hasOwn(businesses, id)) throw new BusError('unknown-business');
@@ -595,7 +688,7 @@ export async function startBroker({
        if (!found || found.after !== organization_revision) refuse('bootstrap-receipt-mismatch');
        // Only this bootstrap's own post-add revision may be admitted: any later organization write means the confirmed world moved (#800).
        if (revision !== found.after) refuse('bootstrap-revision-stale');
-        const b = loadBusiness(id, { dir: organization.dir, rolesDir: organization.rolesDir });
+        const b = loadOrg(id);
        const resolved = {};
        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
        const full = busOrganization(b, resolved);
@@ -622,7 +715,14 @@ export async function startBroker({
    // product the broker holds is ready only while it has a complete marker and a committed activate receipt: the
    // answer is read from both on every call, so a marker removed after the activation closes it again, and the
    // broker's reload now follows both readiness records (#802).
-    function admission({ business: id, project, projects, thread, session }) {
+    // With `instance` (#1873 A3), the launch boundary also asks whether that instance may work in each
+    // project as the business stands now: a project that excludes it, or whose union refuses, is not ready.
+    // `instance` comes with `revision`, the organization file revision the launch resolved its bundle
+    // from; a file that has changed since (a narrow, a project define's vars, an exclude) is not ready.
+    // #1873 CB3: with `instance`, a copy the boot left needing a binding is admitted only on
+    // `authority`, the launch authority digest its prepare returned, still current now. Checked
+    // before the projects, so a launch with no project is held to it as well.
+    function admission({ business: id, project, projects, instance, revision: launched, thread, session, authority }) {
      if (projects !== undefined) {
        const no = code => ({ ready: false, revision: null, code });
        if (typeof id !== 'string' || !Object.hasOwn(businesses, id) || !Array.isArray(projects) || projects.some(p => typeof p !== 'string')) return no('project-unknown');
@@ -631,9 +731,34 @@ export async function startBroker({
          if (!row) return no('session-not-found');
          if (row.archived) return no('project-archived');
        }
+        if (instance !== undefined && (typeof instance !== 'string' || typeof launched !== 'string')) return no('project-unknown');
+        if (instance !== undefined) {
+          let now;
+          try { now = writer?.read(id); } catch { return no('organization-unreadable'); }
+          if (now?.revision === undefined) return no('organization-unreadable');
+          if (now.revision !== launched) return no('organization-changed');
+          // org-defscan (#1873): the launch boundary. A credential issued since the launcher's scan
+          // runs on this same loop, so the org: definition the instance names is checked again here,
+          // in the reply the launcher spawns after with no further wait.
+          const name = orgDefinitionName(now.document.roles?.[instance]?.definition);
+          if (name !== null) {
+            const clean = value => credentials.assertClean(value);
+            let held;
+            try { clean(name); held = heldPath(now.document.definitions?.[name], clean); } catch { held = 'name'; }
+            if (held !== null) return no(DEFINITION_HOLDS_CREDENTIAL);
+          }
+          if (copyNeedsAuthority(id, instance)) {
+            try { copyLaunch.admit(id, instance, authority); } catch (e) { return no(e?.code ?? 'copy-authority-changed'); }
+          }
+        }
        for (const p of projects) {
          const result = admission({ business: id, project: p });
          if (!result.ready) return result;
+          if (instance !== undefined) {
+            // The broker holds the document the last writer reload swapped in; `businesses` is the boot one.
+            const barred = broker.projectBarred(id, instance, p);
+            if (barred) return no(barred);
+          }
        }
        return { ready: true, revision: null, code: null };
      }
@@ -669,6 +794,7 @@ export async function startBroker({
      trackerOf.set(id, named ?? ((trackers ? tracked : tasks !== null) ? 'vikunja' : 'store'));
    }
    broker = new Broker({
+      pluginService: pluginService({dataRoot:instanceRoot ?? dataRoot,read:id=>organization ? loadOrg(id) : businesses[id]}),
      taskTracker: (id) => trackerOf.get(id),
      workspaceRead: state => requestWorkspace({ dataRoot, state, events: store.all("SELECT kind,actor_role,subject,body FROM events WHERE business=? AND kind IN ('task.created','task.assigned','session.launched') ORDER BY seq LIMIT 10001", state.business) }),
      requirementsHost,
@@ -713,6 +839,12 @@ export async function startBroker({
      // Row 236 (#1742): the Gitea grant path. The admin slot is <configDir>/secrets/grants/<business>/gitea.
      giteaGrant: organization ? giteaGrant({ configDir: organization.dir }) : null,
      giteaKeys: storeRoot ? giteaKeys({ credentials, storeRoot }) : null,
+      // #1873 CB2: credentials.issue for an agent copy's bound Gitea service, verified live at the server.
+      copyGrant: organization && storeRoot
+        ? copyGrant({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
+          copies: bootCopies, organizations: () => Object.keys(businesses), ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) })
+        : null,
+      copyLaunch,
      usage,
      limits,
      store,
@@ -737,7 +869,7 @@ export async function startBroker({
        // configured reads as unreadable, so requireCitation is true), and thread.messages' `last`.
        guard: (context, body, options) => libraryModule.guardReply({ ...context, dataRoot }, body, options),
        replyLimits: id => libraryModule.resolveReplyLimits(organization
-          ? organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir }).readRaw(id) : { readable: false }),
+          ? organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot }).readRaw(id) : { readable: false }),
        last: (context, paths) => libraryModule.lastCommits({ ...context, dataRoot }, paths),
        GuardError: libraryModule.GuardError,
      },
@@ -753,7 +885,7 @@ export async function startBroker({
      // plugins.set reloads the business's limit checks in the background.
      organization:settings?(proxyOrganization?.wrap ?? (operation => operation))((id,verb,args,actor,context)=>{
        if (verb === 'project.remote.get.console' || verb === 'project.remote.set.console') {
-          const current = loadBusiness(id, { dir: organization.dir, rolesDir: organization.rolesDir });
+          const current = loadOrg(id);
          const resolved = {};
          for (const instance of Object.keys(current.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: current, instance });
          const live = withoutPending(id, busOrganization(current, resolved));
@@ -768,7 +900,7 @@ export async function startBroker({
          known.set(id, canonicalJson(next.projects));
          return getProjectRemote(writer, id, args.project);
        }
-        if (verb === 'system-types.installed') return installedSystemTypes();
+        if (verb === 'system-types.installed') return installedSystemTypes({dataRoot:instanceRoot ?? dataRoot});
        if (verb === 'system-types.current') return settings.current(id).plugins?.['system-type'] ?? [];
        if(verb==='limits')return withTokens(id,settings.read(id));
        if(verb==='plugins')return {...plugins.read(id), available:{harness:levels.names ?? []}};
@@ -786,8 +918,6 @@ export async function startBroker({
        if(verb==='instances.check')return instances.checkDelete(id,args.instance,actor);
        // Row 194 b6 (webby-0094 B1): a fire's checks against the file, before step A.
        if(verb==='instance.fireCheck')return instances.checkFire(id,args.name);
-        // Internal read-only path: no reload, journal, credential or publication.
-        if(verb==='instance.hireCheck')return instances.checkHire(id,args);
        let result;
        if (['limits.set', 'instances.set'].includes(verb) && settings.current(id).plugins?.['model-provider']?.length) {
          return catalogueFor(id, { fresh: true }).then(catalogue => {
@@ -809,16 +939,21 @@ export async function startBroker({
          });
          result=settings.setRoutes(id,args,actor);
        }
-        else if(verb==='plugins.set'){result=plugins.set(id,args,actor);modelCatalogues?.invalidate();}
+        else if(verb==='plugins.set') {
+          if(actor==='tester' && Object.entries(args.plugins ?? {}).some(([kind,value])=>(Array.isArray(value)?value:[value]).some(name=>name!==null && !hasModule(kind,name)))) throw new BusError('human-required');
+          result=plugins.set(id,args,actor);modelCatalogues?.invalidate();
+        }
        // Row 194 (#1692, V6): the human's keep and noHire lists, through the instance writer.
        else if(verb==='veto.set')result=instances.veto(id,args,actor);
        // Row 298: the human's grant scope, through the instance writer.
        else if(verb==='grants.scope.set')result=instances.grantScope(id,args,actor);
        // C2-06 M11: the human's replyLimits, through the organization writer's fence.
        else if(verb==='library.limits.set')result=setReplyLimits(organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir}),id,args,actor);
+        // #1873 T1: the human's definition writes. The broker passes only the business's human (the
+        // owner, so ROLE_RIGHTS.owner); the store's assertClean is the held-secret check each write needs.
+        else if(Object.hasOwn(DEFINITION_BUS_VERBS,verb))result=definitionVerbs({writer:organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir}),rolesDir:organization.rolesDir,assertClean:value=>credentials.assertClean(value)})[DEFINITION_BUS_VERBS[verb]](id,args,{actor,rights:[...ROLE_RIGHTS.owner],agent:false});
        // Row 194 (D2.1, D2.2): the chief's hire and fire, with the reason in the change context.
-        else if(verb==='instance.hire')result=instances.hire(id,args,{actor,context});
-        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name},{actor,context});
+        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name,revision:args.revision},{actor,context});
        else throw new BusError('invalid-request');
        // Row 194 (D3 item 2): one reload, after every verb that committed, then the limit checks.
        const live=reload(id);
@@ -829,6 +964,14 @@ export async function startBroker({
        return INSTANCE_VERBS.has(verb)?{...result,restart:!live}:result;
      }):null,
      // Row 194 (D2.3): the role files as they stand, for the hire checks.
+      autonomy: organization ? autonomyHost({writer:organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir,dataRoot:instanceRoot??dataRoot}),dataRoot,business:id=>businesses[id],countsAccount:levels.countsAccount,hires:{reverse:(...args)=>broker.hireReverse(...args)},reload,processing}) : null,
+      hires: organization ? (()=>{
+        const service=hireDecisions({writer:organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir,dataRoot:instanceRoot??dataRoot}),rolesDir:organization.rolesDir,configDir:organization.dir,dataRoot,
+          system:organization.system,levels,catalogueFor:async(id,doc)=>doc.plugins?.['model-provider']?.length?catalogueFor(id,{fresh:true}):null,assertClean:value=>credentials.assertClean(value),scanDefinition:(name,entry)=>scanDefinitions({[name]:entry},value=>credentials.assertClean(value)),registryFor:doc=>organizationPlugins(instanceRoot??dataRoot,doc.plugins).registry,
+          // #1873 CB1: a copy binding names a copy this bus booted with; no snapshot, no binding.
+          copies:id=>copies?.org===id?copies:null});
+        return authorityHost(service,{modelKeys,reload,proxyOrganization});
+      })() : null,
      roleFile: organization ? (name) => loadRole(organization.rolesDir, name) : null,
      secretCheck: (value) => credentials.assertClean(value),
      credentialStatus: () => credentials.status(),
@@ -841,11 +984,21 @@ export async function startBroker({
      proxyInit: organization ? async args => {
        const settings = await initializeProxy({ configDir: organization.dir, dataRoot: instanceRoot ?? dataRoot, ...args });
        modelProxyClient = await loadManagementClient({ configDir: organization.dir, proxy: settings, receipt: proxyReceipt });
+        proxyPort = settings.port;
+        // #1873: an org bus that initializes the shared proxy also holds its write lock from now on.
+        if (org && !proxyLock) proxyLock = createProxyLock({ stateDir: join(instanceDataRoot, 'proxy'), identity: `${instanceConfigDir}:${settings.port}` });
        configureProxyPage();
        return settings;
      } : null,
+      // #1873: clear the uncertain-write fence only on restart evidence this host re-proves: the
+      // process on the proxy port is new, alive and started after the fence was set.
+      proxyFenceClear: organization ? async ({ evidence }) => {
+        if (!proxyLock || !modelProxyClient) throw new BusError('not-configured');
+        return proxyLock.clear({ restarted: true, read: () => modelProxyClient.getKeys(), verify: previous => verifyRestart(evidence, { fence: previous, port: proxyPort }) });
+      } : null,
      credentialVerbs: organization
-        ? credentialVerbs({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir }) })
+        ? credentialVerbs({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot }),
+          organizations: () => Object.keys(businesses), boot: copies?.definitions ? { org: copies.org, definitions: copies.definitions } : null })
        : null,
      // Row 65: a new launch binds only on a harness its business switches on, read from the file
      // as it stands now; an unreadable file switches none on.
@@ -918,7 +1071,7 @@ export async function startBroker({
      let factory = null;
      if (name === 'vikunja' && tasks) factory = tasks;
      else if (name !== 'vikunja' || [...Object.values(businesses)].some((b) => b?.plugins?.['task-tracker'] === 'vikunja')) {
-        const loader = createLoader({ log: pluginLog });
+        const loader = createLoader({ dataRoot:instanceRoot ?? dataRoot, log: pluginLog });
        const { refused } = await loader.load({ 'task-tracker': name });
        const [module] = loader.modules('task-tracker');
        if (!refused.length && module) factory = module.adapter({ trackers: trackers ?? {} });
@@ -940,7 +1093,7 @@ export async function startBroker({
        return one.handle(cap, verb, args);
      };
    }
-    const web = await webServices(businesses);
+    const web = await webServices(businesses,{dataRoot:instanceRoot ?? dataRoot});
    // Row 210 (#1707, design D7 step 6): clear what a killed bus child left, before anyone can call.
    if (runRoot) sweepRunDir(runRoot);
    // Row 234 (r6 X3): end the enrollments a killed bus child left, before anyone can call.
@@ -1093,6 +1246,20 @@ export async function startBroker({
        .filter((c) => c.instance === business + '/' + role)
        .map(({ service, date, state, keyId, issuedAt }) => ({ service, date, state, ...(service === 'model' ? { keyId, issuedAt } : {}) }));
    }
+    // #1873 T1 follow-up (org-defscan): the launcher's check of the org: definition it is about to
+    // launch, as it read it from the organization file. Answers where a held credential sits, or null;
+    // never the text. A malformed ask refuses, so the launch refuses.
+    function definitionScan({ business, definition, entry } = {}) {
+      if (typeof business !== 'string' || !Object.hasOwn(businesses, business) || typeof definition !== 'string'
+          || !definition.startsWith(ORG_PREFIX) || definition.length > 128 || entry === null || typeof entry !== 'object' || Array.isArray(entry))
+        throw new BusError('invalid-request');
+      let size;
+      try { size = JSON.stringify(entry).length; } catch { throw new BusError('invalid-request'); }
+      if (size > 4 * 1024 * 1024) throw new BusError('invalid-request');
+      const clean = value => credentials.assertClean(value);
+      try { clean(definition); } catch { return { held: 'name' }; }
+      return { held: heldPath(entry, clean) };
+    }
    // C2-03a: each library entry with a sync user fetches once at start, then every 60 s. A pass
    // still running skips the tick. Only codes are logged, never git's output.
    const timed = Object.values(businesses).flatMap(business => Object.entries(business.projects ?? {})
@@ -1174,8 +1341,27 @@ export async function startBroker({
      credentials,
      // P2 consumes this inside the bus only. No process IPC/verb returns it.
      get modelProxy() { return modelProxyClient; },
+      // #1873 CB3: the copies the boot proved live, { instance: [service] }; names only.
+      copyBound: Object.freeze(copyLaunch ? copyLaunch.bound() : {}),
      path,
      bindLaunch,
+      // #1873 CB3: the launcher's prepare for a copy the boot left needing a binding: the launch
+      // authority { authority, services } after a live proof at the service, or the refusal. Any
+      // other instance needs none and gets { authority: null }.
+      // `revision` is the organization file revision the launch resolved its bundle from (A3); a
+      // copy's prepare holds the file to it.
+      copyLaunch: async ({ business, instance, revision }) => {
+        if (typeof business !== 'string' || typeof instance !== 'string') throw new BusError('invalid-request');
+        if (!copyNeedsAuthority(business, instance)) return { authority: null, services: [] };
+        if (typeof revision !== 'string') throw new BusError('invalid-request');
+        return copyLaunch.prepare(business, instance, revision);
+      },
+      // #1873 CB3: one checked Gitea request for a bound copy's run. Who it is for comes from the
+      // capability's session, never from the request. Returns { status, json }; nothing holds the token.
+      copyCall: async (cap, request) => {
+        if (!copyLaunch) throw new BusError('credential-unavailable');
+        return copyLaunch.call(broker.copySession(cap), request);
+      },
      recoverLaunch: ({ modelKeyId, ...record }) => broker.recoverLaunch(record),
      endLaunch: (r) => { const out = broker.endLaunch(r); modelRuns.delete(r.business + ':' + r.run); return out; },
      modelAdmission: async ({ business, instance, modelKey, harness, revision, entry: expected, provider, model, account, route, transport }) => {
@@ -1193,13 +1379,13 @@ export async function startBroker({
        if (vars[prefix + 'model'] !== modelKey || vars[prefix + 'harness'] !== harness) return refused('model-provider-unavailable');
        const entry = current.launch?.models?.[modelKey];
        if (!entry || canonicalJson(entry) !== canonicalJson(expected ?? null) || entry.provider !== provider || entry.model !== model) return refused('model-provider-unavailable');
-        const harnessLoader = createLoader({log:()=>{}});
+        const harnessLoader = createLoader({dataRoot:instanceRoot ?? dataRoot,log:()=>{}});
        if ((await harnessLoader.load({harness:[harness]})).refused.length) return refused('model-provider-unavailable');
        const countsAccount = harnessLoader.modules('harness')[0].countsAccount();
        if (typeof countsAccount !== 'boolean' || account !== (countsAccount ? current.launch?.account?.name ?? null : null)) return refused('model-provider-unavailable');
        const names = current.plugins?.['model-provider'];
        if (!Array.isArray(names) || !names.length || (entry.module && !names.includes(entry.module))) return refused('model-provider-unavailable');
-        const loader = makeProviderLoader({log:()=>{}}), loaded = await loader.load({'model-provider':entry.module ? [entry.module] : names});
+        const loader = makeProviderLoader({dataRoot:instanceRoot ?? dataRoot,log:()=>{}}), loaded = await loader.load({'model-provider':entry.module ? [entry.module] : names});
        if (loaded.refused.length) return refused('model-provider-unavailable');
        const selected = selectModelProvider(loader.snapshot('model-provider'), entry);
        if (!selected) return refused('model-provider-unavailable');
@@ -1216,7 +1402,7 @@ export async function startBroker({
        return refused(['model-provider-unavailable','model-catalogue-unavailable','model-harness-incompatible'].includes(answer?.code) ? answer.code : 'model-provider-unavailable');
      },
      modelPreflight: async ({ business, role }) => {
-        const current = settings ? settings.current(business) : businesses[business];
+        const current = organization ? loadOrg(business) : businesses[business];
        if (!Object.hasOwn(current?.roles ?? {}, role)) throw new BusError('unknown-role');
        return modelKeys ? modelKeys.preflight(business + '/' + role) : null;
      },
@@ -1266,6 +1452,7 @@ export async function startBroker({
      sessionClearStart: (r) => broker.sessionClearStart(r),
      refuse: (cap, code, subject) => broker.refuse(cap, code, subject),
      credentialStatus,
+      definitionScan,
      launches: bound,
      readers: readCaps,
      async close() {
@@ -53,10 +53,10 @@ export function turnRecords(store, business) {
    };
  });
 }
-export async function createUsage({ store, businesses, log, keyForRun = () => null, proxyView = () => null, keyOrphans = () => null }) {
+export async function createUsage({ store, businesses, pluginDataRoot = null, log, keyForRun = () => null, proxyView = () => null, keyOrphans = () => null }) {
  const loaders = new Map();
  for (const [id, b] of Object.entries(businesses)) {
-    const loader = createLoader({ log });
+    const loader = createLoader({ log, dataRoot:pluginDataRoot });
    await loader.load(b.plugins ?? {});
    loaders.set(id, loader);
  }
@@ -0,0 +1,122 @@
+// #1873 Phase A slice A3: the broker half of root and project agent copies. The business carries the
+// boot's `copies` view (organization agent-copies.mjs withCopies): a bound copy is also in `roles`,
+// an unbound or refused one is not. The cli half, with real runners, is cli agent-copies.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from '../src/store.mjs';
+import { BusError, Broker } from '../src/broker.mjs';
+
+const shipped = (name) => JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
+const SECRET = 'sk-test-NOT-A-SECRET-1234';
+
+const copy = (name, definition, project, state, extra = {}) => ({ name, level: project === null ? 'root' : 'project', project, definition, state, ...extra });
+const demo = () => ({
+  id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'chief' },
+  definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging }, companion: { messaging: shipped('companion').messaging } },
+  projects: { stack: { root: '/nonexistent/stack' }, web: { root: '/nonexistent/web' }, docs: { root: '/nonexistent/docs' } },
+  roles: {
+    chief: { definition: 'chief-of-staff', ...none },
+    pm: { definition: 'pm', ...none },
+    assistant: { definition: 'assistant', ...none },
+    gate: { definition: 'merge-gate', ...none },
+    'companion.stack': { definition: 'companion', ...none },
+    buddy: { definition: 'companion', ...none },
+  },
+  copies: {
+    gate: copy('gate', 'merge-gate', null, 'instance'),
+    buddy: copy('buddy', 'companion', null, 'instance'),
+    'companion.stack': copy('companion', 'companion', 'stack', 'instance'),
+    researcher: copy('researcher', 'research', null, 'unbound', { missing: ['gitea'] }),
+    wide: copy('wide', 'merge-gate', null, 'refused', { reason: 'model <value> is not in launch.models' }),
+    'lint.web': copy('lint', 'security-reviewer', 'web', 'refused', { reason: 'project web refuses its agents: ghost is excluded, but nothing defines it' }),
+  },
+  // Each code project's union as withCopies computes it: web excludes buddy, docs refuses.
+  unions: {
+    stack: { ok: true, agents: ['assistant', 'buddy', 'chief', 'companion.stack', 'gate', 'pm'] },
+    web: { ok: true, agents: ['assistant', 'chief', 'gate', 'pm'] },
+    docs: { ok: false, reason: 'projects.docs.agents.ghost: names no root or organization agent to exclude' },
+  },
+});
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-copies-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const b = new Broker({ store, businesses: { demo: demo() } });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (verb, args = {}) => b.request(human, { verb, args });
+  const refusal = (fn) => {
+    try { fn(); } catch (e) { assert.ok(e instanceof BusError, String(e)); return e; }
+    assert.fail('no refusal');
+  };
+  const trail = () => store.all('SELECT kind, body FROM events').map((e) => `${e.kind} ${e.body}`).join('\n');
+  return { b, store, call, refusal, trail };
+}
+
+test('A3 bus: a bound copy takes a launch request; an unbound or refused one refuses at the verb by name, with the code alone in the trail', (t) => {
+  const f = setup(t);
+  assert.match(f.call('instance.launch', { instance: 'gate' }).request, /\S/);
+  const unbound = f.refusal(() => f.call('instance.launch', { instance: 'researcher' }));
+  assert.deepEqual([unbound.code, unbound.reason], ['credential-unbound', 'researcher has no binding in demo for gitea']);
+  const refused = f.refusal(() => f.call('instance.launch', { instance: 'wide' }));
+  assert.equal(refused.code, 'copy-refused');
+  assert.match(refused.reason, /^wide can't launch in demo: /);
+  const project = f.refusal(() => f.call('instance.launch', { instance: 'lint.web' }));
+  assert.equal(project.code, 'project-refused');
+  assert.match(project.reason, /^lint\.web can't launch in demo: project web refuses its agents: /);
+  // Regenerate takes the same check.
+  assert.equal(f.refusal(() => f.call('instance.regenerate', { instance: 'researcher' })).code, 'credential-unbound');
+  // A name that is no copy and no instance is still unknown.
+  assert.equal(f.refusal(() => f.call('instance.launch', { instance: 'nobody' })).code, 'unknown-role');
+  // The trail holds each refusal's code, never its reason.
+  const trail = f.trail();
+  assert.match(trail, /credential-unbound/);
+  for (const text of ['has no binding', "can't launch", 'refuses its agents', SECRET]) assert.equal(trail.includes(text), false, text);
+});
+
+test('A3 bus: a project agent takes a thread only in its own project, and only when named', (t) => {
+  const f = setup(t);
+  const stack = f.call('project.create', { name: 'stack work', repo: 'stack' }).id;
+  const web = f.call('project.create', { name: 'web work', repo: 'web' }).id;
+  const loose = f.call('project.create', { name: 'loose' }).id;
+  // Unnamed, the organization file's own thread instance is still the one choice.
+  const plain = f.call('thread.create', { project: stack, name: 'plain' }).id;
+  assert.equal(f.store.get('SELECT instance FROM threads WHERE id=?', plain).instance, 'assistant');
+  const own = f.call('thread.create', { project: stack, name: 'own', instance: 'companion.stack' });
+  assert.match(own.id, /\S/);
+  for (const project of [web, loose])
+    assert.equal(f.refusal(() => f.call('thread.create', { project, name: 'elsewhere', instance: 'companion.stack' })).code, 'project-agent-elsewhere');
+  // A named copy the boot refused says why, before the thread instance check.
+  const unbound = f.refusal(() => f.call('thread.create', { project: stack, name: 'r', instance: 'researcher' }));
+  assert.deepEqual([unbound.code, unbound.reason], ['credential-unbound', 'researcher has no binding in demo for gitea']);
+});
+
+test('A3 bus: a room holds only the thread instances that work in its project; an excluded agent takes no thread there; a refused union takes none at all, naming the project', (t) => {
+  const f = setup(t);
+  const project = (repo) => f.call('project.create', { name: `${repo ?? 'loose'} work`, ...(repo ? { repo } : {}) }).id;
+  const [stack, web, docs, loose] = [project('stack'), project('web'), project('docs'), project(null)];
+  const members = (id) => f.call('room.open', { project: id }).threads.map((x) => x.instance).sort();
+  // Another project's agent never joins, and the project's own exclusion holds.
+  assert.deepEqual(members(stack), ['assistant', 'buddy', 'companion.stack']);
+  assert.deepEqual(members(web), ['assistant']);
+  assert.deepEqual(members(loose), ['assistant', 'buddy']);
+  assert.deepEqual(f.call('room.send', { project: web, body: 'hello' }).to, ['assistant']);
+  const excluded = f.refusal(() => f.call('thread.create', { project: web, name: 'b', instance: 'buddy' }));
+  assert.deepEqual([excluded.code, excluded.reason], ['project-refused', "buddy can't work in project web: the project excludes it"]);
+  // docs's union refuses: no thread, named or not, and no room, each naming docs and why.
+  for (const fn of [
+    () => f.call('thread.create', { project: docs, name: 'plain' }),
+    () => f.call('thread.create', { project: docs, name: 'a', instance: 'assistant' }),
+    () => f.call('room.open', { project: docs }),
+  ]) {
+    const e = f.refusal(fn);
+    assert.equal(e.code, 'project-refused');
+    assert.match(e.reason, /^project docs refuses its agents: .*ghost/);
+  }
+  assert.equal(f.trail().includes('refuses its agents'), false, 'the trail holds the code only');
+});
@@ -0,0 +1,141 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtempSync,mkdirSync,readFileSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {Broker} from '../src/broker.mjs';
+import {Store} from '../src/store.mjs';
+import {autonomyHost,authorityHost} from '../src/autonomy-host.mjs';
+import {organizationWriter} from '../../organization/src/organization.mjs';
+import {instanceSettings} from '../../organization/src/instance-settings.mjs';
+import {hireDecisions} from '../../organization/src/hire-decisions.mjs';
+import {loadBusiness} from '../../organization/src/organization-config.mjs';
+import {businessDoc,rolesCopy,writeJson} from '../../organization/tests/helpers.mjs';
+const inline={tools:['read'],network:'none',authority:{withinRole:[],crossRole:[]},credentials:[],instructions:'Changed role'};
+const cap={limit:100000,since:'2026-01-01T00:00:00.000Z'};
+function world(t,options={}) {
+ const root=mkdtempSync(join(tmpdir(),'au-authority-')),rolesDir=rolesCopy(root),dataRoot=join(root,'data');mkdirSync(dataRoot,{mode:0o700});
+ const doc=businessDoc(root,'demo');doc.plugins={harness:['pi'],'limit-check':['token-limit']};
+ doc.launch.limits.tokens={providers:{zai:cap}};
+ // #1873: an account quota alone, covered only through the host's declared harness fact.
+ if(options.account){doc.launch.account={name:'shared',credential:'FIXTURE_TOKEN'};doc.launch.limits.tokens={keys:{shared:cap}};}
+ doc.definitions={judge:{rev:1,role:{...inline,authority:{withinRole:['decision.resolve.authority'],crossRole:[]}},instructions:'Judge'},scout:{rev:3,role:structuredClone(inline),instructions:'Prior role'}};
+ // Definition instructions live beside the role composition.
+ for(const d of Object.values(doc.definitions))delete d.role.instructions;
+ doc.roles.judge={definition:'org:judge',vars:{harness:'pi',model:'claude-opus-5-5'}};
+ doc.roles.scout={definition:'org:scout',vars:{harness:'pi',model:'claude-opus-5-5'}};
+ doc.launch.instances.push('scout');doc.autonomy={authority:'near the loop',authorityResolver:'judge',notices:true,reverseWindowHours:1};
+ writeJson(join(root,'businesses/demo.json'),doc);
+ let reversing=false,broker,now=Date.now;
+ const writer=organizationWriter({dir:root,rolesDir,barrier:point=>{if(reversing && point==='prepared' && options.expirePrepared)Date.now=()=>now()+3600001;if(!reversing && point==='prepared' && options.removeResolverPrepared){const b=structuredClone(loaded());b.roles.judge.authority.withinRole=[];broker.reloadBusiness('demo',b);}}});
+ const store=new Store(dataRoot),order=[];
+ const loaded=()=>{const b=loadBusiness('demo',{dir:root,rolesDir});return {...b,roles:Object.fromEntries(Object.entries(b.roles).map(([n,e])=>[n,{...b.definitions[e.definition],...e}]))};};
+ const reload=id=>{if(reversing && options.crossAfterCommit)Date.now=()=>now()+3600001;if(reversing && options.reloadRefused)return false;broker.reloadBusiness(id,loaded());return true;};
+ const service=hireDecisions({writer,rolesDir,configDir:root,dataRoot,assertClean:()=>{}});
+ const hires=authorityHost(service,{reload,modelKeys:{prepareRevoke:async(instance,guard)=>{guard();assert.equal(instance,'demo/scout');order.push('prepare');},completeRevoke:instance=>{assert.equal(instance,'demo/scout');assert.ok(store.get("SELECT 1 FROM events WHERE json_extract(body,'$.action')='fire.stopped'"));assert.equal(writer.read('demo').document.definitions.scout.instructions,'Changed role');order.push('complete');}}});
+ const host=autonomyHost({writer,dataRoot,business:()=>loaded(),hires,reload,...(options.countsAccount?{countsAccount:options.countsAccount}:{})});
+ const instances=instanceSettings({dir:root,rolesDir,writer,revoke:()=>{order.push('fire-revoke');}});
+ broker=new Broker({store,businesses:{demo:loaded()},hires,autonomy:host,organization:(id,verb,args,actor,context)=>{if(verb==='instance.fireCheck'){instances.checkFire(id,args.name);return {};}if(verb==='instance.fire')return instances.fire(id,args,{actor,context});throw Error('unexpected organization verb');}});
+ const caps={};const call=(who,verb,args={})=>broker.request(caps[who],{verb,args});
+ for(const role of ['chief','judge','scout']){caps[role]=broker.bindLaunch({business:'demo',role,run:role+'-run',harness:'pi'});call(role,'role.claim');}
+ caps.owner=broker.bindConsole({business:'demo',human:'jason',subject:{provider:'test',iss:'test',sub:'owner'}});
+ t.after(()=>{Date.now=now;store.close();rmSync(root,{recursive:true,force:true});});
+ const raise=(extra={})=>call('chief','hire.raise',{op:'change',level:'org',name:'scout',role:{inline},route:{harness:'pi',model:'claude-opus-5-5'},reason:'Change the task',...extra});
+ const reverse=id=>{reversing=true;return call('owner','decision.reverse.console',{id});};
+ return {writer,store,order,broker,call,raise,reverse,loaded};
+}
+for(const crossAfterCommit of [false,true])test(`AU authority reverse uses runtime key wrapper and relaunches after commit (deadline crossed: ${crossAfterCommit})`,async t=>{
+ const f=world(t,{crossAfterCommit}),d=await f.raise();assert.deepEqual(d.hire.flagged,[]);assert.equal(d.route_to,'judge');
+ await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});assert.equal(f.writer.read('demo').document.definitions.scout.rev,4);
+ const r=await f.reverse(d.id);assert.equal(r.committed,true);assert.equal(r.relaunch,'requested');assert.deepEqual(f.order,['prepare','complete']);
+ const restored=f.writer.read('demo').document.definitions.scout;assert.equal(restored.rev,5);assert.equal(restored.instructions,'Prior role');
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse.failed'").n,0);
+ assert.ok(f.store.get("SELECT 1 FROM events WHERE json_extract(body,'$.action')='lifecycle.launch' AND subject='scout'"));
+});
+test('AU a committed authority reverse reports pending recovery when reload refuses',async t=>{
+ const f=world(t,{reloadRefused:true}),d=await f.raise();await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});
+ const r=await f.reverse(d.id);assert.equal(r.committed,true);assert.equal(r.restart,true);assert.equal(r.relaunch,'pending');assert.equal(f.writer.read('demo').document.definitions.scout.instructions,'Prior role');
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse.failed'").n,0);
+});
+test('AU authority reverse crossing deadline in prepared IO never publishes',async t=>{
+ const f=world(t,{expirePrepared:true}),d=await f.raise();await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});const prior=f.writer.read('demo').revision;
+ await assert.rejects(f.reverse(d.id),{code:'reverse-window-closed'});assert.equal(f.writer.read('demo').revision,prior);f.writer.recover('demo');assert.equal(f.writer.read('demo').revision,prior);
+});
+test('AU authority resolver rechecks budget removal after a proposal was raised',async t=>{
+ const f=world(t),d=await f.raise(),b=structuredClone(f.loaded());b.plugins['limit-check']=[];f.broker.reloadBusiness('demo',b);
+ const before=f.writer.read('demo').revision;await assert.rejects(f.call('judge','decision.resolve',{id:d.id,choice:'yes'}),{code:'autonomy-precondition'});
+ assert.equal(f.writer.read('demo').revision,before);assert.equal(f.store.get('SELECT count(*) n FROM decision_events WHERE decision=?',d.id).n,0);
+});
+
+test('AU authority apply rechecks a removed resolve right at publication',async t=>{
+ const f=world(t,{removeResolverPrepared:true}),d=await f.raise(),before=f.writer.read('demo').revision;
+ await assert.rejects(f.call('judge','decision.resolve',{id:d.id,choice:'yes'}),{code:'not-resolver'});
+ assert.equal(f.writer.read('demo').revision,before);f.writer.recover('demo');assert.equal(f.writer.read('demo').revision,before);
+});
+test('AU authority hire reverse runs normal fire/revoke and records committed delisting',async t=>{
+ const f=world(t),d=await f.raise({op:'hire',name:'helper'});await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});
+ assert.ok(f.writer.read('demo').document.launch.instances.includes('helper'));
+ const r=await f.reverse(d.id);assert.equal(r.committed,true);assert.ok(!f.writer.read('demo').document.launch.instances.includes('helper'));assert.deepEqual(f.order,['fire-revoke']);
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);
+});
+
+test('AU completion-event failure after durable authority inverse records committed recovery, never reverse.failed',async t=>{
+ const f=world(t),d=await f.raise();await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});
+ const run=f.store.run.bind(f.store);let injected=false;
+ f.store.run=(sql,...args)=>{
+  if(!injected && sql.includes('INSERT INTO events') && args.some(x=>typeof x==='string' && x.startsWith('{') && JSON.parse(x).action==='fire.done')){
+   injected=true;throw new Error('injected completion event failure');
+  }
+  return run(sql,...args);
+ };
+ const r=await f.reverse(d.id);assert.equal(injected,true);assert.equal(r.committed,true);assert.equal(r.completion,'failed');assert.equal(r.restart,true);assert.equal(r.relaunch,'pending');
+ assert.equal(f.writer.read('demo').document.definitions.scout.instructions,'Prior role');
+ assert.equal(f.writer.read('demo').document.definitions.scout.rev,5);
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse.failed'").n,0);
+});
+
+test('AU inverse receipt-write failure returns committed with trailPending and never writes reverse.failed',async t=>{
+ const f=world(t),d=await f.raise();await f.call('judge','decision.resolve',{id:d.id,choice:'yes'});
+ const run=f.store.run.bind(f.store);let injected=false;
+ f.store.run=(sql,...args)=>{
+  if(sql.includes('INSERT INTO events') && args.some(x=>typeof x==='string' && x.startsWith('{') && JSON.parse(x).operation==='autonomy.reverse')){
+   injected=true;throw new Error('injected receipt write failure');
+  }
+  return run(sql,...args);
+ };
+ const r=await f.reverse(d.id);assert.equal(injected,true);assert.equal(r.committed,true);assert.equal(r.trailPending,true);assert.equal(r.relaunch,'requested');
+ assert.equal(f.writer.read('demo').document.definitions.scout.instructions,'Prior role');
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse.failed'").n,0);
+});
+test('AU an account-quota authority raise routes to the resolver only when the host says every harness spends the account (#1873)',async t=>{
+ const covered=world(t,{account:true,countsAccount:name=>name==='pi'}),d=await covered.raise();assert.equal(d.route_to,'judge');
+ for(const countsAccount of [undefined,()=>false,()=>null]){
+  const f=world(t,{account:true,countsAccount});
+  await assert.rejects(f.raise(),{code:'autonomy-precondition'});
+  assert.equal(f.store.get("SELECT count(*) n FROM decisions").n,0);
+ }
+});
+// #1873 review finding 2: the runtime itself carries each harness module's countsAccount into the
+// broker's authority budget check. Only harness modules decide; the business names none here but
+// through plugins.harness.
+for(const [harness,code] of [['claude-code',null],['pi','autonomy-precondition']])test(`AU runtime: an account-quota authority setting with only ${harness} enabled ${code?'refuses':'saves'} (#1873)`,async t=>{
+ const {startBroker}=await import('../src/runtime.mjs');
+ const {systemFor}=await import('../../organization/tests/helpers.mjs');
+ const root=mkdtempSync(join(tmpdir(),'au-runtime-')),rolesDir=rolesCopy(root);t.after(()=>rmSync(root,{recursive:true,force:true}));
+ const doc=businessDoc(root,'demo');doc.plugins={harness:[harness],'limit-check':['token-limit']};
+ for(const r of Object.values(doc.roles))if(r.vars?.harness)r.vars.harness=harness;
+ doc.launch.account={name:'shared',credential:'FIXTURE_TOKEN'};doc.launch.limits.tokens={keys:{shared:cap}};
+ doc.definitions={judge:{rev:1,role:{...inline,authority:{withinRole:['decision.resolve.authority'],crossRole:[]}},instructions:'Judge'}};
+ delete doc.definitions.judge.role.instructions;
+ doc.roles.judge={definition:'org:judge',vars:{harness,model:'claude-opus-5-5'}};
+ writeJson(join(root,'businesses/demo.json'),doc);mkdirSync(join(root,'data'),{mode:0o700});
+ const loaded=()=>{const b=loadBusiness('demo',{dir:root,rolesDir});return {...b,roles:Object.fromEntries(Object.entries(b.roles).map(([n,e])=>[n,{...b.definitions[e.definition],...e}]))};};
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:loaded()},organization:{dir:root,rolesDir,system:systemFor(root)}});t.after(()=>bus.close());
+ const owner=bus.broker.bindConsole({business:'demo',human:'jason',subject:{provider:'test',iss:'test',sub:'owner'}});
+ const {revision}=await bus.broker.request(owner,{verb:'autonomy.get.console'});
+ const set=bus.broker.request(owner,{verb:'autonomy.set.console',args:{revision,autonomy:{authority:'near the loop',authorityResolver:'judge',notices:true}}});
+ if(code)await assert.rejects(set,{code});
+ else {await set;assert.equal(JSON.parse(readFileSync(join(root,'businesses/demo.json'),'utf8')).autonomy.authority,'near the loop');}
+});
@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtempSync,mkdirSync,writeFileSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {execFileSync} from 'node:child_process';
+import {Store} from '../src/store.mjs';
+import {Broker} from '../src/broker.mjs';
+import {autonomyHost} from '../src/autonomy-host.mjs';
+import {initializeWorking,workingRepo,push,prepareLand,finishLand,dropLand} from '../../seat/src/working.mjs';
+import {gitEnv} from '../../seat/src/checkout.mjs';
+const TASK='vikunja:1/2',SUBJECT={provider:'test',iss:'https://issuer.test',sub:'owner'};
+const git=(cwd,...args)=>execFileSync('git',['-c','user.name=Test','-c','[email protected]',...args],{cwd,encoding:'utf8',env:gitEnv()}).trim();
+async function world(t,level='near the loop') {
+ const dir=mkdtempSync(join(tmpdir(),'au-')),root=join(dir,'root'),dataRoot=join(dir,'data');mkdirSync(root);mkdirSync(dataRoot,{mode:0o700});
+ git(root,'init','-q','-b','main');writeFileSync(join(root,'file'),'before\n');git(root,'add','file');git(root,'commit','-qm','Initial');
+ const before=git(root,'rev-parse','HEAD');
+ const clone=join(dir,'clone');git(dir,'clone','-q',root,clone);git(clone,'checkout','-qb','feat');writeFileSync(join(clone,'file'),'after\n');git(clone,'commit','-qam','Change');const reviewed=git(clone,'rev-parse','HEAD');
+ const bundle=join(dir,'bundle');git(clone,'bundle','create',bundle,'refs/heads/feat','--not','--remotes=origin');
+ await initializeWorking({dataRoot,business:'demo',project:'stack',root});
+ await push({dataRoot,business:'demo',project:'stack',root,taskRef:TASK,branch:'feat',bundle});
+ const authority=(withinRole=[],crossRole=[])=>({withinRole,crossRole});
+ const business={id:'demo',human:'jason',projects:{stack:{root}},autonomy:{merge:level,notices:true,reverseWindowHours:1},arbiters:{technical:'cto',delivery:'cto'},roles:{cto:{definition:'cto',authority:authority(['decision.resolve.technical'])},coder:{definition:'coder',authority:authority(['git.push.working','review.request','message.send'])},reviewer:{definition:'reviewer',authority:authority(['review.verdict','message.send'])},gate:{definition:'merge-gate',authority:authority([],['git.merge.protected'])}}};
+ let gates=0;
+ const host=autonomyHost({dataRoot,business:()=>business,processing:{work:fn=>fn({guard(){},signal:undefined})},gate:{classify:async()=>true,run:async()=>{gates++;return {ok:true};}}});
+ const store=new Store(dataRoot),broker=new Broker({store,businesses:{demo:business},autonomy:host}),caps={};
+ t.after(()=>{store.close();rmSync(dir,{recursive:true,force:true});});
+ const call=(who,verb,args={})=>broker.request(caps[who],{verb,args});
+ for(const role of Object.keys(business.roles)){caps[role]=broker.bindLaunch({business:'demo',role,run:role+'-run',harness:'pi'});call(role,'role.claim');}
+ caps.human=broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+ caps.owner=broker.bindConsole({business:'demo',human:'jason',subject:SUBJECT});
+ broker.checkPush(caps.coder,TASK);broker.recordPush(caps.coder,{task_ref:TASK,project:'stack',branch:'feat',ref:'work/vikunja-1-2',commit:reviewed,previous:null});
+ const request=call('coder','review.request',{task_ref:TASK,commit:reviewed,to:'reviewer'});
+ call('reviewer','review.verdict',{task_ref:TASK,request:request.request,verdict:'approve',body:'Reviewed'});
+ const d=call('gate','decision.raise',{action:'git.merge.protected',project:'stack',target:TASK,question:'Land work/vikunja-1-2?',options:[{key:'yes',text:'Land change'},{key:'no',text:'Hold'}],recommendation:'yes',blocking:false});
+ call('cto','decision.resolve',{id:d.id,choice:'yes'});
+ const land=async()=>{
+  const facts=broker.checkLand(caps.gate,{task_ref:TASK,decision:d.id});
+  const logs=join(dir,'land');mkdirSync(logs,{recursive:true});
+  const prepared=await prepareLand({dataRoot,business:'demo',project:'stack',root,taskRef:TASK,commit:reviewed,dir:logs,name:'original',rootHits:()=>[],message:()=> 'Change'});
+  try {await finishLand({dataRoot,business:'demo',project:'stack',land:prepared,record:r=>broker.recordLand(facts.ticket,{commit:r.commit,previous:r.previous,reviewed,base:prepared.base,patch_id:prepared.patch_id})});}finally{await dropLand({dataRoot,business:'demo',project:'stack',worktree:prepared.worktree});}
+  return prepared.commit;
+ };
+ return {broker,business,store,caps,call,d,before,land,gates:()=>gates,show:(...args)=>git(dir,`--git-dir=${workingRepo(dataRoot,'demo','stack')}`,...args)};
+}
+test('AU near merge lands immediately, owner notice reverses through gate and records a real child revert',async t=>{
+ const f=await world(t),landed=await f.land();
+ assert.equal(f.show('show','main:file'),'after');assert.equal(f.call('human','inbox').find(x=>x.id===f.d.id).autonomy.notice,true);
+ const reverse=await f.call('owner','decision.reverse.console',{id:f.d.id});
+ assert.equal(f.gates(),1);assert.equal(f.show('show','main:file'),'before');assert.equal(f.show('rev-parse','main^'),landed);
+ assert.match(f.show('log','-1','--format=%B','main'),new RegExp(f.d.id));
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);
+ assert.equal(reverse.reverted,landed);
+});
+test('AU in-loop landing refuses until confirmation; decline requires a new arbiter resolution',async t=>{
+ const f=await world(t,'in the loop');
+ await assert.rejects(f.land(),e=>['not-resolved','confirmation-required'].includes(e.code));
+ f.call('owner','decision.confirm.console',{id:f.d.id,confirm:false,reason:'Review again'});
+ assert.throws(()=>f.call('owner','decision.confirm.console',{id:f.d.id,confirm:true}),{code:'decision-not-eligible'});
+ f.call('cto','decision.resolve',{id:f.d.id,choice:'yes'});f.call('owner','decision.confirm.console',{id:f.d.id,confirm:true});
+ await f.land();assert.equal(f.show('show','main:file'),'after');
+ assert.throws(()=>f.call('owner','decision.confirm.console',{id:f.d.id,confirm:true}),{code:'decision-not-eligible'});
+});
+test('AU landing rechecks the resolver right both before land and after the gate',async t=>{
+ const f=await world(t);const facts=f.broker.checkLand(f.caps.gate,{task_ref:TASK,decision:f.d.id});
+ f.business.roles.cto.authority.withinRole=[];f.broker.reloadBusiness('demo',f.business);
+ assert.throws(()=>f.broker.checkLand(f.caps.gate,{task_ref:TASK,decision:f.d.id}),{code:'not-resolver'});
+ assert.throws(()=>f.broker.recordLand(facts.ticket,{commit:'a'.repeat(40),previous:f.before,reviewed:'b'.repeat(40),base:f.before,patch_id:'c'.repeat(40)}),{code:'not-resolver'});
+ assert.equal(f.show('rev-parse','main'),f.before);
+});
@@ -0,0 +1,164 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fixture } from './spec-fixtures.mjs';
+const SUBJECT = {provider:'test',iss:'https://issuer.test',sub:'owner'};
+async function setup(t, autonomy, autonomyHost=null) {
+  const f=await fixture(t,{autonomyHost,roles:{coder:{definition:'coder',authority:{withinRole:[],crossRole:['git.merge.protected','task.scope.change','policy.change','prd.approve']}}}});
+  if(autonomy) {f.business.autonomy=autonomy;f.broker.reloadBusiness('demo',f.business);}
+  f.owner=f.broker.bindConsole({business:'demo',human:'jason',subject:SUBJECT});
+  return f;
+}
+test('AU no setting keeps merge with technical arbiter',async t=>{
+  const f=await setup(t);const d=f.raise({action:'git.merge.protected'});assert.equal(d.route_to,'chief');
+});
+test('AU in-loop merge keeps the arbiter resolver, waits for person, decline returns to arbiter',async t=>{
+  const f=await setup(t,{merge:'in the loop'}),d=f.raise({action:'git.merge.protected',target:'vikunja:1/2'});
+  assert.equal(d.route_to,'chief');
+  assert.throws(()=>f.call(f.human,'decision.resolve',{id:d.id,choice:'yes'}),{code:'not-resolver'});
+  f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  assert.throws(()=>f.broker.authorize(f.coder,'git.merge.protected',{decision:d.id,target:'vikunja:1/2'}),{code:'confirmation-required'});
+  f.call(f.owner,'decision.confirm.console',{id:d.id,confirm:false,reason:'Please revise'});
+  assert.equal(f.call(f.chief,'inbox').find(x=>x.id===d.id)?.id,d.id);
+  f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  f.call(f.owner,'decision.confirm.console',{id:d.id,confirm:true});
+  assert.equal(f.broker.authorize(f.coder,'git.merge.protected',{decision:d.id,target:'vikunja:1/2'}).decision,d.id);
+});
+test('AU R5 subject resolver or resolver definition routes to person',async t=>{
+  const f=await setup(t);
+  for(const target of ['chief','chief-of-staff'])assert.equal(f.raise({action:'policy.change',target}).route_to,'human');
+});
+test('AU mismatched PRD domain refuses at raise with expected domain',async t=>{
+  const f=await setup(t);
+  assert.throws(()=>f.raise({action:'prd.approve',domain:'delivery'}),e=>e.code==='invalid-domain' && /technical/.test(e.reason));
+  assert.equal(f.store.get("SELECT count(*) n FROM decisions WHERE action='prd.approve'").n,0);
+});
+test('AU revoked resolver right refuses when an approved decision is consumed',async t=>{
+  const f=await setup(t),d=f.raise({action:'task.scope.change',target:'vikunja:1/2'});
+  f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  f.business.roles.chief.authority.withinRole=[];f.broker.reloadBusiness('demo',f.business);
+  assert.throws(()=>f.broker.authorize(f.coder,'task.scope.change',{decision:d.id,target:'vikunja:1/2'}),{code:'not-resolver'});
+});
+test('AU member, agent and dev tester cannot change settings',async t=>{
+  const revision='a'.repeat(64),f=await setup(t,null,{get:()=>({revision,autonomy:{}})});
+  const member=f.broker.bindHireConsole({business:'demo',actor:'member',subject:{...SUBJECT,sub:'member'},rights:['org.hire']});
+  for(const cap of [f.coder,member])assert.throws(()=>f.call(cap,'autonomy.set.console',{revision,autonomy:{merge:'near the loop'}}),{code:'human-required'});
+  assert.throws(()=>f.call(f.human,'autonomy.set.console',{revision,autonomy:{merge:'near the loop'}}),{code:'human-required'});
+});
+test('AU near-loop merge sends owner a bounded notice; expired reverse names ordinary path',async t=>{
+  const f=await setup(t,{merge:'near the loop',notices:true,reverseWindowHours:1}),d=f.raise({action:'git.merge.protected'});
+  f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  const n=f.call(f.human,'inbox').find(x=>x.id===d.id);
+  assert.equal(n.autonomy.notice,true);assert.ok(Date.parse(n.autonomy.reverseUntil)>Date.now());
+  const now=Date.now;
+  try{Date.now=()=>now()+3600001;await assert.rejects(Promise.resolve().then(()=>f.call(f.owner,'decision.reverse.console',{id:d.id})),e=>e.code==='reverse-window-closed' && /ordinary.*decision/.test(e.reason));}finally{Date.now=now;}
+});
+test('AU no setting can move each hard wait from a person',async t=>{
+  const f=await setup(t,{'cross-role':'out of the loop',merge:'near the loop',authority:'out of the loop'});
+  for(const action of ['git.push.protected','host.sudo','credential.mint','spend','deploy','data.delete']){
+    if(action==='host.sudo')continue; // Its host grant precondition is covered in hard-waits.test.mjs.
+    assert.equal(f.raise({action}).route_to,'human');
+  }
+});
+test('AU owner setting changes have immutable actor trail; bad classes/levels refuse; tester refused',async t=>{
+  let f,autonomy={},revision='a'.repeat(64);
+  const host={get:()=>({autonomy,revision}),set:(_b,a)=>{autonomy=a.autonomy;revision='b'.repeat(64);f.business.autonomy=autonomy;f.broker.reloadBusiness('demo',f.business);return {revision,transaction:'transaction-1'};},reversible:()=>true};
+  f=await setup(t,null,host);
+  await f.call(f.owner,'autonomy.set.console',{revision,autonomy:{merge:'in the loop'}});
+  assert.equal(f.store.all("SELECT actor_role,actor_run,body FROM events WHERE json_extract(body,'$.operation')='autonomy.set'").length,1);
+  const row=f.store.get("SELECT body FROM events WHERE json_extract(body,'$.operation')='autonomy.set'");assert.deepEqual(JSON.parse(row.body).subject,SUBJECT);
+  for(const value of [{unknown:'near the loop'},{merge:'fast'}])await assert.rejects(f.call(f.owner,'autonomy.set.console',{revision,autonomy:value}),{code:'invalid-autonomy'});
+  f.business.vars={'bus.tester':true};f.broker.reloadBusiness('demo',f.business);const tester=f.broker.bindTester({business:'demo'});
+  assert.throws(()=>f.call(tester,'autonomy.set.console',{revision,autonomy:{}}),{code:'human-required'});
+  assert.throws(()=>f.broker.recordEvent(f.coder,{kind:'action.allowed',body:{operation:'autonomy.confirmed',decision:'forged'}}),{code:'reserved-event'});
+});
+test('AU reverse consumes once and rechecks the window at the effect boundary',async t=>{
+  let effects=0;
+  const host={reverse:async({beforeWrite,record})=>{beforeWrite();effects++;return {commit:'b'.repeat(40)};}};
+  const f=await setup(t,{merge:'near the loop',notices:true},host),d=f.raise({action:'git.merge.protected'});
+  f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  const r=await f.call(f.owner,'decision.reverse.console',{id:d.id});assert.equal(r.reversed,true);assert.equal(effects,1);
+  await assert.rejects(f.call(f.owner,'decision.reverse.console',{id:d.id}),{code:'decision-reversed'});
+  assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);
+});
+test('AU a near-loop reverse that crosses the deadline cannot write',async t=>{
+  let effects=0;const now=Date.now;
+  const f=await setup(t,{merge:'near the loop',notices:true,reverseWindowHours:1},{reverse:async({beforeWrite})=>{Date.now=()=>now()+3600001;beforeWrite();effects++;return {};}});
+  const d=f.raise({action:'git.merge.protected'});f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+  try{await assert.rejects(f.call(f.owner,'decision.reverse.console',{id:d.id}),{code:'reverse-window-closed'});}finally{Date.now=now;}
+  assert.equal(effects,0);
+});
+
+test('AU policy near refuses with a named next step; in and the existing out level remain usable',async t=>{
+ let f,autonomy={},revision='a'.repeat(64);
+ const host={get:()=>({autonomy,revision}),set:(_b,a)=>{autonomy=a.autonomy;revision='b'.repeat(64);f.business.autonomy=autonomy;f.broker.reloadBusiness('demo',f.business);return {revision,transaction:'policy-setting'};},reversible:()=>false};
+ f=await setup(t,null,host);
+ await assert.rejects(f.call(f.owner,'autonomy.set.console',{revision,autonomy:{policy:'near the loop'}}),e=>e.code==='policy-reverse-unavailable' && /in the loop or out of the loop/.test(e.nextStep));
+ assert.deepEqual(autonomy,{});
+ await f.call(f.owner,'autonomy.set.console',{revision,autonomy:{policy:'in the loop'}});
+ const d=f.raise({action:'policy.change',target:'policy-1'});f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+ assert.throws(()=>f.broker.authorize(f.coder,'policy.change',{decision:d.id,target:'policy-1'}),{code:'confirmation-required'});
+ f.call(f.owner,'decision.confirm.console',{id:d.id,confirm:true});
+ assert.equal(f.broker.authorize(f.coder,'policy.change',{decision:d.id,target:'policy-1'}).decision,d.id);
+ await f.call(f.owner,'autonomy.set.console',{revision,autonomy:{policy:'out of the loop'}});
+ const out=f.raise({action:'policy.change',target:'policy-2'});f.call(f.chief,'decision.resolve',{id:out.id,choice:'yes'});
+ assert.equal(f.broker.authorize(f.coder,'policy.change',{decision:out.id,target:'policy-2'}).decision,out.id);
+});
+test('AU near cross-role authorization without a trusted inverse fails closed before consumption',async t=>{
+ const f=await setup(t,{'cross-role':'near the loop',notices:true}),d=f.raise({action:'task.scope.change',target:'vikunja:1/2'});
+ f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+ assert.throws(()=>f.broker.authorize(f.coder,'task.scope.change',{decision:d.id,target:'vikunja:1/2'}),{code:'reversal-unavailable'});
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.decision')=? AND json_extract(body,'$.action')='task.scope.change' AND json_extract(body,'$.operation') IS NOT 'decision.raise'",d.id).n,0);
+});
+
+
+test('AU a withdrawal after decline is terminal for resolver, owner and confirmation',async t=>{
+ const f=await setup(t,{merge:'in the loop'}),d=f.raise({action:'git.merge.protected'});
+ f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+ f.call(f.owner,'decision.confirm.console',{id:d.id,confirm:false,reason:'Revise'});
+ f.call(f.coder,'decision.withdraw',{id:d.id});
+ assert.throws(()=>f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'}),{code:'decision-closed'});
+ for(const cap of [f.chief,f.human])assert.ok(!f.call(cap,'inbox').some(x=>x.id===d.id));
+ assert.throws(()=>f.call(f.owner,'decision.confirm.console',{id:d.id,confirm:true}),e=>['decision-closed','decision-not-eligible'].includes(e.code));
+});
+async function settingsFixture(t) {
+ let f,autonomy={},revision='a'.repeat(64),writes=0;
+ const host={get:()=>({autonomy,revision}),set:(_b,a)=>{writes++;autonomy=a.autonomy;revision='b'.repeat(64);f.business.autonomy=autonomy;f.broker.reloadBusiness('demo',f.business);return {revision,transaction:'setting-test'};},reversible:()=>true};
+ f=await setup(t,null,host);
+ f.business.roles.judge={definition:'judge',authority:{withinRole:['decision.resolve.authority'],crossRole:[]}};
+ f.business.roles.reviewer.authority.withinRole.push('review.verdict');
+ f.business.launch={by:'chief',models:{model:{provider:'anthropic',model:'test-model'}},limits:{tokens:{}}};
+ f.business.plugins={'limit-check':['token-limit']};
+ f.broker.reloadBusiness('demo',f.business);
+ return {...f,set:value=>f.call(f.owner,'autonomy.set.console',{revision,autonomy:value}),writes:()=>writes};
+}
+const authorityNear={authority:'near the loop',authorityResolver:'judge',notices:true};
+const tokenCap={limit:1000,since:'2026-01-01T00:00:00.000Z'};
+test('AU authority near requires an enforced organization budget covering every allowed model, including zero caps',async t=>{
+ const f=await settingsFixture(t);
+ for(const tokens of [{},{instances:{coder:tokenCap}},{providers:{unrelated:tokenCap}}]){
+  f.business.launch.limits.tokens=tokens;f.broker.reloadBusiness('demo',f.business);
+  await assert.rejects(f.set(authorityNear),{code:'autonomy-precondition'});
+ }
+ f.business.launch.limits.tokens={providers:{anthropic:{...tokenCap,limit:0}}};
+ f.business.plugins={'limit-check':[]};f.broker.reloadBusiness('demo',f.business);
+ await assert.rejects(f.set(authorityNear),{code:'autonomy-precondition'});
+ f.business.plugins={'limit-check':['token-limit']};f.broker.reloadBusiness('demo',f.business);
+ await f.set(authorityNear);assert.equal(f.writes(),1);
+});
+test('AU authority out refuses until per-definition agent limits exist, even with current agents capped',async t=>{
+ const f=await settingsFixture(t);
+ f.business.launch.limits.tokens={providers:{anthropic:tokenCap},instances:Object.fromEntries(Object.keys(f.business.roles).map(n=>[n,tokenCap]))};
+ f.broker.reloadBusiness('demo',f.business);await f.set(authorityNear);
+ f.call(f.owner,'autonomy.review.console',{decisionClass:'authority'});
+ await assert.rejects(f.set({...authorityNear,authority:'out of the loop'}),e=>e.code==='authority-limits-unavailable' && /near the loop/.test(e.nextStep));
+ assert.equal(f.writes(),1);
+});
+test('AU moving out requires an actual near resolution and a later owner review',async t=>{
+ const f=await settingsFixture(t);await f.set({merge:'in the loop'});await f.set({merge:'near the loop',notices:true});
+ f.call(f.owner,'autonomy.review.console',{decisionClass:'merge'});
+ await assert.rejects(f.set({merge:'out of the loop',notices:true}),{code:'autonomy-precondition'});
+ const d=f.raise({action:'git.merge.protected'});f.call(f.chief,'decision.resolve',{id:d.id,choice:'yes'});
+ await assert.rejects(f.set({merge:'out of the loop',notices:true}),{code:'autonomy-precondition'});
+ f.call(f.owner,'autonomy.review.console',{decisionClass:'merge'});
+ await f.set({merge:'out of the loop',notices:true});
+});
@@ -37,7 +37,9 @@ const baselines = {
 // #1839: artifact Console replies alone may use 2 MiB; the proof and other limits are unchanged.
 // #1873 U1: humanCall, busCaller, userCall and userCaller take an optional signal and absolute
 // deadline; userCall shares transport(). Nonces, argv and limits are unchanged.
- "packages/webui/src/bus.mjs": "3ef8064dd7911f9eee4475b52c74a1d551583a065474b1bcee968cd45f722747",
+ // #1873 A3: STATUS maps credential-unbound, copy-refused, project-refused and project-agent-elsewhere
+ // to 409; no proof or transport change.
+ "packages/webui/src/bus.mjs": "d8f3e0eb5299fdb192e98a1238ca693aae7c36af9a21de72d5f5d39610589377",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);

@@ -8,7 +8,6 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Store, schemaDigest } from '../src/store.mjs';
 import { Broker, ACTIONS } from '../src/broker.mjs';
-import { HIRE_ALLOWED } from '../../organization/src/vocabulary.mjs';
 import { startBroker } from '../src/runtime.mjs';
 import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
 import { busOrganization } from '../src/organization-context.mjs';
@@ -711,380 +710,17 @@ test('row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse
  assert.deepEqual(organization.at(-1), ['demo', 'veto.set', { revision: PATCH.revision, op: 'unkeep', name: 'coder' }, 'jason']);
 });

-// Row 194 (#1692, D2.1-D2.3): the chief's hire and fire. PRD 1.7 REQ-COS-3 routes role.hire and
-// role.fire within-role for the chief (sage-1471, mos-1089), so they take the reason form, as
-// role.end does: no decision, a reason of 1 to 500 characters that goes into the log. The role
-// files are stubs, so a definition's authority is the test's to set.
 const LISTED = { launch: { by: 'chief', instances: ['pm', 'coder'], keep: ['pm'], noHire: ['banned'] } };
-const roleDoc = (withinRole, extra = {}) => ({ roleVersion: 2, authority: { withinRole, crossRole: [] }, hireable: [], ...extra });
-const ROLE_FILES = {
-  'chief-of-staff': roleDoc(chiefAuthority, { hireable: ['coder', 'researcher', 'wide', 'banned'] }),
-  coder: roleDoc(['message.send', 'record.write']),
-  // A version 1 file has empty authority lists, so only the version check refuses it (M60).
-  researcher: { roleVersion: 1, authority: { withinRole: [], crossRole: [] }, hireable: [] },
-  wide: roleDoc(['message.send', 'task.create']),
-  banned: roleDoc(['message.send']),
-  pm: roleDoc(['message.send']),
-};
-const roleFile = (files) => (name) => {
-  if (!Object.hasOwn(files, name)) throw Object.assign(new Error(`no role ${name}`), { name: 'BusinessError' });
-  return files[name];
-};
-function hireSetup(t, extra = LISTED, files = ROLE_FILES) {
-  return setup(t, extra, { roleFile: roleFile(files) });
-}
-const HIRE = { name: 'helper', definition: 'coder', reason: 'more hands for the queue' };
-const FIRE = { name: 'coder', reason: 'the work is done' };
-const CONTEXT = (reason) => ({ instance: 'chief', run: 'chief-run', reason });
-const withoutReason = ({ reason, ...rest }) => rest;

-test('row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it', (t) => {
-  const { call, organization, allowed, store } = hireSetup(t);
-  const result = call('chief', 'instance.hire', HIRE);
-  assert.equal(result.transaction, 't-1');
-  assert.deepEqual(organization, [['demo', 'instance.hire', withoutReason(HIRE), 'chief-of-staff.chief', CONTEXT(HIRE.reason)]]);
-  const [use, ...rest] = allowed('role.hire');
-  assert.equal(rest.length, 0);
-  assert.equal(use.subject, 'helper');
-  assert.deepEqual({ reason: use.body.reason, transaction: use.body.transaction, decision: use.body.decision ?? null }, { reason: HIRE.reason, transaction: 't-1', decision: null });
-  // Within-role: no decision is raised or needed.
-  assert.equal(store.get('SELECT count(*) AS n FROM decisions').n, 0);
-  // vars reach the writer with the name and definition.
-  call('chief', 'instance.hire', { ...HIRE, name: 'aide', vars: { model: 'm', 'limits.x': 1 } });
-  assert.deepEqual(organization.at(-1)[2], { name: 'aide', definition: 'coder', vars: { model: 'm', 'limits.x': 1 } });
-});
-
-// T11 (D5): a business id names one business on one bus. The chief's hire and fire go to its own
-// business's writer, and no argument names another.
-test('row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own', (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-two-'));
-  const store = new Store(root);
-  t.after(() => {
-    store.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const organization = [];
-  const one = demo(LISTED).demo;
-  const b = new Broker({
-    store,
-    businesses: { demo: one, other: { ...one, id: 'other' } },
-    roleFile: roleFile(ROLE_FILES),
-    organization: (...args) => (organization.push(args), { revision: 'b'.repeat(64), transaction: 't-' + organization.length }),
-  });
-  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  b.request(chief, { verb: 'role.claim' });
-  for (const verb of ['instance.hire', 'instance.fire'])
-    for (const extra of [{ business: 'other' }, { target: 'other' }])
-      assert.throws(() => b.request(chief, { verb, args: { ...(verb === 'instance.hire' ? HIRE : FIRE), ...extra } }), /invalid-request/, `${verb} ${Object.keys(extra)}`);
-  assert.equal(organization.length, 0);
-  b.request(chief, { verb: 'instance.hire', args: HIRE });
-  b.request(chief, { verb: 'instance.fire', args: FIRE });
-  assert.deepEqual(organization.map((c) => [c[0], c[1]]), [['demo', 'instance.hire'], ['demo', 'instance.fireCheck'], ['demo', 'instance.fire']]);
-  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE business='other'").n, 0);
-});
-
-test('row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key', (t) => {
-  const { call, organization } = hireSetup(t);
-  for (const reason of [undefined, '', 'x'.repeat(501), 7]) {
-    const r = reason === undefined ? {} : { reason };
-    assert.throws(() => call('chief', 'instance.hire', { name: 'helper', definition: 'coder', ...r }), /invalid-request/, String(reason));
-    assert.throws(() => call('chief', 'instance.fire', { name: 'coder', ...r }), /invalid-request/, String(reason));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, decision: 'd-1' }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, decision: 'd-1' }), /invalid-request/);
-  for (const name of ['human', 'tester']) assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name }), /invalid-request/, name);
-  assert.equal(organization.length, 0);
-  call('chief', 'instance.hire', { ...HIRE, reason: 'x'.repeat(500) });
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions', (t) => {
-  const granted = { authority: { withinRole: ['message.send', 'role.hire', 'role.fire'], crossRole: [] } };
-  const { call, organization, allowed } = hireSetup(t, { ...LISTED, roles: { ...roles, pm: { definition: 'pm', ...granted }, coder: { definition: 'coder', ...granted } } });
-  for (const who of ['pm', 'coder', 'assistant']) {
-    assert.throws(() => call(who, 'instance.hire', HIRE), /role-not-chief/, who);
-    assert.throws(() => call(who, 'instance.fire', FIRE), /role-not-chief/, who);
-  }
-  assert.throws(() => call('tester', 'instance.hire', HIRE), /tester-refused/);
-  assert.throws(() => call('reader', 'instance.hire', HIRE), /read-only/);
-  assert.throws(() => call('human', 'instance.fire', FIRE), /agent-required/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-test('row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer', (t) => {
-  for (const missing of ['role.hire', 'role.fire']) {
-    const authority = { withinRole: chiefAuthority.withinRole.filter((a) => a !== missing), crossRole: [] };
-    const { call, organization, lastClaim } = hireSetup(t, { ...LISTED, roles: { ...roles, chief: { definition: 'chief-of-staff', authority } } });
-    const [verb, args] = missing === 'role.hire' ? ['instance.hire', HIRE] : ['instance.fire', FIRE];
-    assert.throws(() => call('chief', verb, args), /decision-required/, missing);
-    assert.equal(organization.length, 0, missing);
-    assert.equal(lastClaim('coder').op, 'claim', missing);
-    // The other action still goes through.
-    const [other, otherArgs] = missing === 'role.hire' ? ['instance.fire', FIRE] : ['instance.hire', HIRE];
-    call('chief', other, otherArgs);
-    assert.equal(organization.filter(([, verb]) => verb !== 'instance.fireCheck').length, 1, missing);
-  }
-});
-
-test('row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer\'s refusals pass through by name', (t) => {
-  const { call, organization, writer } = hireSetup(t);
-  const again = { name: 'coder', definition: 'coder', reason: 'needed again' };
-  for (const code of ['organization-instance-exists', 'organization-instance-retired', 'definition-not-hireable', 'instance-kept']) {
-    writer.error = Object.assign(new Error(code), { code });
-    assert.throws(() => call('chief', 'instance.hire', again), new RegExp(code));
-  }
-  writer.error = null;
-  call('chief', 'instance.hire', again);
-  assert.deepEqual(organization.at(-1).slice(1, 3), ['instance.hire', withoutReason(again)]);
-});
-
-test('row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn\'t', (t) => {
-  assert.deepEqual([...HIRE_ALLOWED], ['message.send', 'record.write', 'review.request', 'task.update.assigned', 'task.scope.change', 'git.push.working']);
-  for (const action of ACTIONS) {
-    const files = { ...ROLE_FILES, wide: roleDoc(['message.send', action]) };
-    const { call, organization } = hireSetup(t, LISTED, files);
-    const run = () => call('chief', 'instance.hire', { ...HIRE, definition: 'wide' });
-    if (HIRE_ALLOWED.includes(action)) {
-      run();
-      assert.equal(organization.length, 1, action);
-    } else {
-      assert.throws(run, /definition-not-hireable/, action);
-      assert.equal(organization.length, 0, action);
-    }
-  }
-  const { call, organization } = hireSetup(t);
-  const hire = (definition) => call('chief', 'instance.hire', { ...HIRE, definition });
-  // Version 1 (M60), noHire, not on the chief's list, and no role file.
-  for (const definition of ['researcher', 'banned', 'pm', 'nothing'])
-    assert.throws(() => hire(definition), /definition-not-hireable/, definition);
-  assert.equal(organization.length, 0);
-  hire('coder');
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8b: a hire without the role files configured refuses not-configured', (t) => {
-  const { call, organization } = setup(t, LISTED);
-  assert.throws(() => call('chief', 'instance.hire', HIRE), /not-configured/);
-  assert.equal(organization.length, 0);
-  assert.throws(() => new Broker({ store: null, businesses: demo(), roleFile: 'roles' }), /roleFile must be a function/);
-});
-
-test('row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs', (t) => {
-  const { call, organization, allowed, lastClaim, writer } = hireSetup(t);
-  // An open launch request of the coder, made by the human.
-  const open = call('human', 'instance.launch', { instance: 'coder' }).request;
-  let seen = null;
-  writer.during = ([, verb]) => { if (verb === 'instance.fire') seen = { stopped: allowed('fire.stopped').length, claim: lastClaim('coder').op, used: allowed('role.fire').length }; };
-  const result = call('chief', 'instance.fire', FIRE);
-  // Step A ran before the writer; step C after it.
-  assert.deepEqual(seen, { stopped: 1, claim: 'revoke', used: 0 });
-  assert.deepEqual(lastClaim('coder'), { op: 'revoke', decision: null, reason: 'the work is done', by: 'chief-run' });
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.deepEqual(result.cancelled, [open]);
-  assert.deepEqual(organization.at(-1), ['demo', 'instance.fire', { name: 'coder' }, 'chief-of-staff.chief', CONTEXT(FIRE.reason)]);
-  const [end] = allowed('lifecycle.end');
-  assert.equal(end.subject, 'coder');
-  assert.deepEqual({ ...end.body, request: null }, { action: 'lifecycle.end', request: null, via: 'chief', by: 'chief', runs: ['coder-run'], reason: 'the work is done', kill: true });
-  assert.equal(allowed('lifecycle.cancelled').filter((e) => e.body.request === open).length, 1);
-  const [use] = allowed('role.fire');
-  assert.equal(use.subject, 'coder');
-  assert.equal(use.body.reason, 'the work is done');
-  assert.equal(use.body.transaction, result.transaction);
-  assert.deepEqual(allowed('fire.done').map((e) => [e.subject, e.body.transaction]), [['coder', result.transaction]]);
-  // The human's read of the request shows the kill.
-  assert.equal(call('human', 'instance.request', { request: end.body.request }).kill, true);
-});
-
-// S6 (D2.2): the launcher closes a fire's end with the runs row 191's stop killed or left alive, and
-// each becomes its own event against the instance. Only a fire's end carries them.
-test('row 194 T9a (bus): a fire end\'s done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop\'s reason; a terminate\'s done or a bad stop refuses', (t) => {
-  const { b, call, allowed } = hireSetup(t);
-  call('chief', 'instance.fire', FIRE);
-  const [end] = allowed('lifecycle.end');
-  const request = end.body.request;
-  assert.equal(b.lifecycleTake({ business: 'demo', request }).go, true);
-  const done = (stops) => b.lifecycleDone({ business: 'demo', request, stops });
-  for (const bad of [[{ run: 'coder-run', pid: 4242, outcome: 'stopped' }], [{ run: 'coder-run', pid: 1, outcome: 'killed' }],
-    [{ run: 'coder-run', outcome: 'killed' }], [{ run: 'coder-run', pid: 4242, outcome: 'killed', signals: [] }], 'killed',
-    // sage-2289: only an alive stop carries a reason, and only unknown.
-    [{ run: 'coder-run', pid: 4242, outcome: 'killed', reason: 'unknown' }], [{ run: 'coder-run', pid: null, outcome: 'alive', reason: 'stuck' }]])
-    assert.throws(() => done(bad), { code: 'invalid-request' }, JSON.stringify(bad));
-  const closed = done([{ run: 'coder-run', pid: 4242, outcome: 'killed' }, { run: 'coder-other', pid: null, outcome: 'alive' },
-    { run: 'coder-unknown', pid: null, outcome: 'alive', reason: 'unknown' }]);
-  assert.equal(closed.state, 'closed');
-  assert.deepEqual(allowed('lifecycle.end.killed').map((e) => [e.subject, e.body]), [['coder', { action: 'lifecycle.end.killed', request, run: 'coder-run', pid: 4242 }]]);
-  assert.deepEqual(allowed('lifecycle.end.alive').map((e) => [e.subject, e.body]), [['coder', { action: 'lifecycle.end.alive', request, run: 'coder-other', pid: null }],
-    ['coder', { action: 'lifecycle.end.alive', request, run: 'coder-unknown', pid: null, reason: 'unknown' }]]);
-  // A terminate's end sends SIGTERM only, so its done has no stops.
-  const term = call('human', 'instance.end', { instance: 'pm' }).request;
-  assert.equal(b.lifecycleTake({ business: 'demo', request: term }).go, true);
-  assert.throws(() => b.lifecycleDone({ business: 'demo', request: term, stops: [{ run: 'pm-run', pid: 4242, outcome: 'killed' }] }), { code: 'invalid-request' });
-  assert.equal(allowed('lifecycle.end.killed').length, 1);
-  assert.equal(b.lifecycleDone({ business: 'demo', request: term }).state, 'closed');
-});
-
-test('row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone', (t) => {
-  const { call, organization, allowed, lastClaim } = hireSetup(t, { launch: { by: 'chief', instances: ['coder'], keep: ['pm'] } });
-  const fire = (name) => call('chief', 'instance.fire', { name, reason: 'r' });
-  assert.throws(() => fire('pm'), /instance-kept/);
-  assert.throws(() => fire('nobody'), /unknown-role/);
-  assert.throws(() => fire('assistant'), /organization-definition-refused/);
-  assert.throws(() => fire('chief'), /organization-instance-referenced/);
-  assert.throws(() => fire('coder'), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length + allowed('lifecycle.end').length + allowed('role.fire').length, 0);
-  assert.equal(lastClaim('coder').op, 'claim');
-});
-
-test('row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once', (t) => {
-  const { call, b, caps, organization, allowed, writer } = hireSetup(t);
-  writer.during = ([, verb]) => { if (verb === 'instance.fire') throw new Error('disk'); };
-  assert.throws(() => call('chief', 'instance.fire', FIRE), /outcome-unknown/);
-  writer.during = null;
-  assert.equal(allowed('fire.stopped').length, 1);
-  assert.equal(allowed('role.fire').length, 0);
-  // W-N1: while it fires, no launch of the instance starts by any path.
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  assert.throws(() => b.authorize(caps.chief, 'role.launch', { target: 'coder' }), /instance-firing/);
-  // The repeat has no claim to revoke. The revoked run is still bound until the launcher reports it
-  // ended, so the repeat asks for its kill again, then delists and logs.
-  const result = call('chief', 'instance.fire', FIRE);
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.deepEqual(allowed('lifecycle.end').map((e) => e.body.kill), [true, true]);
-  // Once done, the instance launches again.
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it', (t) => {
-  const { call, organization, allowed, store, writer } = hireSetup(t);
-  // The delist commits, then the step C transaction aborts.
-  writer.during = ([, verb]) => verb === 'instance.fire' && store.run("CREATE TRIGGER fail_c BEFORE INSERT ON events WHEN json_extract(new.body,'$.action')='fire.done' BEGIN SELECT RAISE(ABORT, 'c failed'); END");
-  assert.throws(() => call('chief', 'instance.fire', FIRE));
-  writer.during = null;
-  store.run('DROP TRIGGER fail_c');
-  assert.equal(allowed('role.fire').length, 0);
-  assert.equal(allowed('fire.done').length, 0);
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  call('chief', 'instance.fire', FIRE);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.equal(allowed('fire.done').length, 1);
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance\'s done does not end it', (t) => {
-  const { call, store } = hireSetup(t);
-  const step = (instance, action) =>
-    store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,'demo','action.allowed','chief','chief-run',?,?)",
-      `${action}-${instance}-${Math.random()}`, new Date().toISOString(), instance, JSON.stringify({ action, request: null, transaction: null }));
-  step('coder', 'fire.done');
-  step('coder', 'fire.stopped');
-  step('pm', 'fire.done');
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  step('coder', 'fire.done');
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer', (t) => {
-  const { call, organization, lastClaim, allowed } = hireSetup(t);
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name: 'pm' }), /instance-kept/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, name: 'pm' }), /instance-kept/);
-  assert.equal(organization.length, 0);
-  assert.equal(lastClaim('pm').op, 'claim');
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-// webby-0094 B1: the file's keep, which this copy hasn't loaded, refuses at the fire check, before
-// step A revokes, ends or marks anything, so the instance isn't left firing.
-test('row 194 T10: a fire the writer\'s check refuses from the file stops nothing and leaves the instance launchable', (t) => {
-  const { call, organization, lastClaim, allowed, writer } = hireSetup(t);
-  writer.during = ([, verb]) => { if (verb === 'instance.fireCheck') throw Object.assign(new Error('instance-kept'), { code: 'instance-kept' }); };
-  assert.throws(() => call('chief', 'instance.fire', FIRE), /instance-kept/);
-  writer.during = null;
-  assert.deepEqual(organization.map(([, verb]) => verb), ['instance.fireCheck']);
-  assert.equal(lastClaim('coder').op, 'claim');
-  assert.equal(allowed('fire.stopped').length + allowed('lifecycle.end').length + allowed('role.fire').length, 0);
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T18: hire and fire take only their own keys, and a refused call writes nothing', (t) => {
-  const { call, organization, allowed } = hireSetup(t);
-  for (const extra of [{ keep: ['x'] }, { launch: {} }, { revision: 'a'.repeat(64) }, { force: true }]) {
-    assert.throws(() => call('chief', 'instance.hire', { ...HIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-    assert.throws(() => call('chief', 'instance.fire', { ...FIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, vars: { harness: 'pi' } }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, definition: 'coder' }), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length, 0);
-});
-
-test('row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone', async (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-hire-'));
-  const rolesDir = rolesCopy(root);
-  // A hireable scratch definition: version 2, no credentials, every action on HIRE_ALLOWED.
-  writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
-  writeJson(join(rolesDir, 'aide.json'), {
-    roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
-    authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],
-  });
-  const chiefFile = join(rolesDir, 'chief-of-staff.json');
-  writeJson(chiefFile, { ...JSON.parse(readFileSync(chiefFile, 'utf8')), hireable: ['aide'] });
-  const file = join(root, 'businesses/demo.json');
-  writeJson(file, { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } });
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  // The boot copy is the file's own bus form, as cli bootConfig builds it, so a write reloads.
-  const busForm = (dir, roles) => {
-    const b = loadBusiness('demo', { dir, rolesDir: roles });
-    const resolved = {};
-    for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: systemFor(dir), business: b, instance });
-    return busOrganization(b, resolved);
-  };
-  const bus = await startBroker({
-    dataRoot: join(root, 'data'),
-    businesses: { demo: busForm(root, rolesDir) },
-    organization: { dir: root, rolesDir, system: systemFor(root) },
-  });
-  t.after(async () => {
-    await bus.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const { broker } = bus;
-  const chief = broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  broker.request(chief, { verb: 'role.claim' });
-  const call = (cap, verb, args) => broker.request(cap, { verb, args });
-  const receipts = () =>
-    readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).filter((r) => r.state === 'committed');
-  const document = () => JSON.parse(readFileSync(file, 'utf8'));
-
-  // The shipped chief file grants both actions, so the runtime takes the reason form.
-  // A refused hire: coder declares credentials and isn't on the chief's list. The file is unchanged.
-  const bytes = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.hire', { name: 'helper', definition: 'coder', reason: 'r' }), /definition-not-hireable/);
-  assert.equal(readFileSync(file, 'utf8'), bytes);
-
-  call(chief, 'instance.hire', { name: 'helper', definition: 'aide', reason: 'more hands' });
-  assert.deepEqual(document().roles.helper, { definition: 'aide' });
-  assert.ok(document().launch.instances.includes('helper'));
-  const [h] = receipts().slice(-1);
-  assert.equal(h.actor, 'chief-of-staff.chief');
-  assert.deepEqual(h.context, CONTEXT('more hands'));
-
-  const result = call(chief, 'instance.fire', { name: 'helper', reason: 'the work is done' });
-  assert.equal(result.delisted, true);
-  assert.ok(!document().launch.instances.includes('helper'));
-  assert.deepEqual(receipts().slice(-1)[0].context, CONTEXT('the work is done'));
-  // The reloaded business sees the delist: a refused call leaves the file alone.
-  const after = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.fire', { name: 'helper', reason: 'again', extra: 1 }), /invalid-request/);
-  assert.equal(readFileSync(file, 'utf8'), after);
+test('A4 the retired lifecycle verbs always require a decision and never call the writer',t=>{
+  const {call,organization}=setup(t,KEPT);
+  for(const who of ['chief','coder','human'])for(const verb of ['instance.hire','instance.fire'])
+    assert.throws(()=>call(who,verb,{name:'coder',definition:'coder',reason:'help'}),{code:'decision-required'});
+  assert.equal(organization.length,0);
 });

 test('row 194 W-N1: the launcher\'s take of a launch or regenerate of a firing instance closes it as instance-firing', (t) => {
-  const { b, call, store } = hireSetup(t);
+  const { b, call, store } = setup(t,LISTED);
  const launch = call('human', 'instance.launch', { instance: 'coder' }).request;
  const regenerate = call('human', 'instance.regenerate', { instance: 'pm' }).request;
  // A fire's step A as the store holds it with no step C, for requests step A didn't see.
@@ -89,7 +89,7 @@ function setup(t) {
 // #797 / #1839 adds the owner-only artifact read to the existing decision and request controls;
 // no unsuffixed verb is ever a console verb.
 test('N4: owner Console verbs have an explicit immutable whitelist and exclude decision.resolve', () => {
-  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
+  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'autonomy.get.console', 'autonomy.set.console', 'autonomy.review.console', 'decision.confirm.console', 'decision.reverse.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'hire.preview.console', 'hire.resolve.console', 'hire.start.console', 'hire.templates.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
    'request.get.console', 'request.projects.console', 'request.answer.console', 'request.attach.console', 'request.cancel.console']);
  assert.ok(CONSOLE_VERBS.every(verb => verb.endsWith('.console')));
  assert.equal(CONSOLE_VERBS.includes('decision.resolve'), false);
@@ -227,7 +227,8 @@ test('ordinary PRD approval and nine non-yes/no choices use the same protocol wi
 test('ordinary role routes refuse Console resolution and agent answers retain the actual role/run', (t) => {
  const f = setup(t);
  for (const route of ['pm', 'chief']) {
-    const id = grantDecision(f.store, { action: 'policy.change', route, close: null });
+    const id = grantDecision(f.store, { action: 'policy.change', route, raiser:route==='chief'?'pm':'chief', close: null });
+
    refusesSync(() => f.call('console', 'decision.preview.console', { id }), 'decision-not-eligible');
    refusesSync(() => f.call('console', 'decision.resolve.console', { id, choice: 'yes', digest: '0'.repeat(64) }), 'decision-not-eligible');
    f.call(route, 'decision.resolve', { id, choice: 'yes' });
@@ -0,0 +1,135 @@
+// #1873 CB1: a copy credential binding through the broker. Only the chief raises one; only the
+// organization owner resolves it; no autonomy level, member right, resolver agent, tester or reader
+// moves it. The written record stays pending, so nothing launches on it in CB1.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { materializeCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const GITEA = { gitea: { scopes: ['read:repository'], projects: ['stack'] } };
+const SECRET = 'sk-test-NOT-A-SECRET-1234';
+
+async function fixture(t, edit = d => d) {
+  const root = mkdtempSync(join(tmpdir(), 'cb1-bus-')), rolesDir = rolesCopy(root);
+  const base = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  base.projects.stack.agents = { checker: { definition: 'reviewer' } };
+  const doc = edit(base);
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const storeRoot = join(root, 'data'); mkdirSync(storeRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot: storeRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(storeRoot);
+  const service = hireDecisions({ writer, rolesDir, dataRoot: storeRoot, configDir: root, assertClean: v => { if (JSON.stringify(v).includes(SECRET)) throw Object.assign(new Error('x'), { code: 'definition-holds-credential' }); }, copies: id => snapshot.org === id ? snapshot : null });
+  const loaded = () => { const d = loadBusiness('demo', { dir: root, rolesDir }); return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions[e.definition], ...e }])) }; };
+  let writes = 0;
+  const b = new Broker({ store, businesses: { demo: loaded() }, hires: { ...service, apply: async (...args) => { writes++; const r = await service.apply(...args); b.reloadBusiness('demo', loaded()); return r; } } });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const member = (rights, extra = {}) => b.bindHireConsole({ business: 'demo', actor: 'member', subject: { ...SUBJECT, sub: 'member' }, rights, ...extra });
+  const caps = { chief: b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' }), coder: b.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi' }) };
+  b.request(caps.chief, { verb: 'role.claim' }); b.request(caps.coder, { verb: 'role.claim' });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const bind = (extra = {}) => ({ op: 'change', level: 'root', name: 'rev', reason: 'Bind the reviewer copy', binding: { services: GITEA }, ...extra });
+  const raise = extra => call(caps.chief, 'hire.raise', bind(extra));
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const bindings = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings ?? {};
+  return { root, rolesDir, file, b, store, writer, service, owner, member, caps, call, bind, raise, bindings, writes: () => writes, loaded };
+}
+
+test('CB1 bus: only the chief raises a binding; the decision names the copy and holds no token or path', async t => {
+  const f = await fixture(t);
+  await assert.rejects(f.call(f.caps.coder, 'hire.raise', f.bind()), { code: 'role-not-chief' });
+  assert.equal(f.store.get('SELECT count(*) n FROM decisions').n, 0);
+  const d = await f.raise();
+  assert.equal(d.route_to, 'human');
+  assert.equal(d.question, 'bind credentials for copy rev?');
+  assert.equal(d.hire.binding.instance, 'rev');
+  const text = JSON.stringify(d);
+  for (const bad of [SECRET, f.root, 'token']) assert.ok(!text.includes(bad), bad);
+  assert.equal(f.writes(), 0);
+  assert.deepEqual(f.bindings(), {});
+});
+
+test('CB1 bus: no autonomy level routes a binding away from the owner', async t => {
+  for (const authority of ['near the loop', 'out of the loop']) {
+    const f = await fixture(t, doc => {
+      doc.definitions = { resolver: { rev: 1, role: { tools: ['read'], network: 'none', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.authority'], crossRole: [] }, credentials: [] }, instructions: 'Resolve independent decisions.' } };
+      doc.roles.cto = { definition: 'org:resolver' };
+      doc.plugins['limit-check'] = ['token-limit']; doc.launch.limits = { tokens: { providers: { zai: { limit: 100000, since: '2026-01-01T00:00:00.000Z' } } } };
+      doc.autonomy = { authority, authorityResolver: 'cto', notices: true };
+      return doc;
+    });
+    const live = f.loaded(); live.roles.cto.authority = { withinRole: ['decision.resolve.authority'], crossRole: [] }; f.b.reloadBusiness('demo', live);
+    const resolver = f.b.bindLaunch({ business: 'demo', role: 'cto', run: 'cto-run', harness: 'pi' }); f.b.request(resolver, { verb: 'role.claim' });
+    const d = await f.raise();
+    assert.equal(d.route_to, 'human', authority);
+    // The authority resolver cannot take it, nor can the chief through the agent verb.
+    await assert.rejects(f.call(resolver, 'decision.resolve', { id: d.id, choice: 'yes' }), { code: 'hire-resolution-required' }, authority);
+    await assert.rejects(f.call(f.caps.chief, 'decision.resolve', { id: d.id, choice: 'yes' }), { code: 'hire-resolution-required' }, authority);
+    assert.equal(f.writes(), 0, authority);
+    assert.deepEqual(f.bindings(), {}, authority);
+    // A project-level unbind is not root; it lists the lines it removes and still goes to the owner.
+    if (authority === 'near the loop') {
+      await f.call(f.owner, 'hire.start.console', { op: 'change', level: 'project', project: 'stack', name: 'checker', reason: 'Bind', binding: { services: GITEA } });
+      const u = await f.raise({ level: 'project', project: 'stack', name: 'checker', binding: { services: null } });
+      assert.equal(u.hire.level, 'project');
+      assert.equal(u.route_to, 'human');
+      await assert.rejects(f.call(resolver, 'decision.resolve', { id: u.id, choice: 'yes' }), { code: 'hire-resolution-required' });
+      assert.equal(f.bindings()['checker.stack'].state, 'pending');
+    }
+  }
+});
+
+test('CB1 bus: members with org.hire or decide, the tester and a reader cannot resolve; the owner can, once', async t => {
+  const f = await fixture(t);
+  const d = await f.raise();
+  const digest = d.hire.digest;
+  await assert.rejects(f.call(f.member(['org.hire']), 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'human-required' });
+  await assert.rejects(f.call(f.member(['org.hire', 'decide'], { instanceOwner: true }), 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'human-required' });
+  await assert.rejects(f.call(f.member(['decide']), 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'right-required' });
+  await assert.rejects(f.call(f.b.bindTester({ business: 'demo' }), 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'human-required' });
+  await assert.rejects(f.call(f.b.bindReader({ business: 'demo' }), 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'human-required' });
+  await assert.rejects(f.call(f.owner, 'decision.resolve', { id: d.id, choice: 'yes' }), { code: 'human-required' });
+  assert.equal(f.writes(), 0);
+  assert.deepEqual(f.bindings(), {});
+  await assert.rejects(f.call(f.owner, 'hire.resolve.console', { id: d.id, choice: 'yes', digest: '0'.repeat(64) }), { code: 'decision-stale' });
+  await f.call(f.owner, 'hire.resolve.console', { id: d.id, choice: 'yes', digest });
+  assert.equal(f.writes(), 1);
+  const rec = f.bindings().rev;
+  assert.equal(rec.state, 'pending');
+  assert.equal(rec.decision, d.id);
+  await assert.rejects(f.call(f.owner, 'hire.resolve.console', { id: d.id, choice: 'yes', digest }), { code: 'decision-closed' });
+  assert.equal(f.writes(), 1);
+});
+
+test('CB1 bus: a one-step Console binding is owner-only; a member is refused before any decision is saved', async t => {
+  const f = await fixture(t);
+  await assert.rejects(f.call(f.member(['org.hire'], { instanceOwner: true }), 'hire.start.console', f.bind()), { code: 'human-required' });
+  assert.equal(f.store.get('SELECT count(*) n FROM decisions').n, 0);
+  await f.call(f.owner, 'hire.start.console', f.bind());
+  assert.equal(f.bindings().rev.state, 'pending');
+  // Unbind is owner-only too.
+  await assert.rejects(f.call(f.member(['org.hire']), 'hire.start.console', f.bind({ binding: { services: null } })), { code: 'human-required' });
+  await f.call(f.owner, 'hire.start.console', f.bind({ binding: { services: null } }));
+  assert.equal(f.bindings().rev.state, 'unbound');
+});
+
+test('CB1 bus: every new refusal has a table entry with a next step', () => {
+  for (const code of ['organization-bindings-protected', 'credential-binding-changed', 'credential-role-changed', 'credential-definition-unpinned', 'credential-scope-exceeded', 'credential-unbound', 'copy-unavailable', 'copy-refused']) {
+    assert.ok(Object.hasOwn(REFUSALS, code), code);
+    assert.ok(REFUSALS[code].nextStep?.length > 20, code);
+    assert.ok(!/(^|[\s("'`])(\/|~\/)/.test(REFUSALS[code].nextStep), code);
+  }
+});
@@ -0,0 +1,227 @@
+// #1873 CB2 live acceptance: credentials.issue for an agent copy's Gitea service against a scratch
+// gitea/gitea:1.27.1, a throwaway container on 127.0.0.1 over TLS with a scratch CA, removed after.
+// The test never pulls an image; without Docker or the image it skips. Every token here is a scratch
+// token this container made; none is printed, and nothing here reaches git.mosaicstack.dev or any
+// real service.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { request } from 'node:https';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { materializeCopies, copiesView } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
+
+const IMAGE = 'gitea/gitea:1.27.1';
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+const docker = (...args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 120000 });
+const skip = docker('image', 'inspect', IMAGE).status === 0 ? false : `no Docker or no local ${IMAGE}; this test never pulls`;
+
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+
+// One HTTPS call to the scratch container, trusting only the scratch CA.
+function call(url, ca, method, path, { auth = null, body = null } = {}) {
+  return new Promise((resolve) => {
+    const data = body ? JSON.stringify(body) : null;
+    const headers = { accept: 'application/json', ...(data ? { 'content-type': 'application/json' } : {}), ...(auth ? { authorization: auth } : {}) };
+    const req = request(url + path, { method, ca, headers, timeout: 10000 }, (res) => {
+      let text = '';
+      res.on('data', (c) => (text += c));
+      res.on('end', () => {
+        let json = null;
+        try {
+          json = text ? JSON.parse(text) : null;
+        } catch {}
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve({ status: 0, json: null }));
+    req.end(data ?? undefined);
+  });
+}
+
+test('CB2-D: on scratch 1.27.1 an owner-issued copy token is proved live: equal and narrower bind; broader, all, admin, foreign, unrelated and opaque refuse', { skip, timeout: 300000 }, async (t) => {
+  // Capture the child's complete TAP stdout/stderr before any of it reaches this runner, so the parent
+  // can search for the actual minted values without putting one in an assertion.
+  if (!process.env.CB2_COPY_CAPTURE) {
+    const capture = mkdtempSync(join(tmpdir(), 'cb2cap-'));
+    t.after(() => rmSync(capture, { recursive: true, force: true }));
+    const file = join(capture, 'minted');
+    const childEnv = { ...process.env, CB2_COPY_CAPTURE: file };
+    delete childEnv.NODE_TEST_CONTEXT;
+    const child = spawnSync(process.execPath, ['--test', '--test-name-pattern=^CB2-D:', fileURLToPath(import.meta.url)], {
+      encoding: 'utf8', timeout: 280000, env: childEnv,
+    });
+    const values = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : [];
+    const output = (child.stdout ?? '') + (child.stderr ?? '');
+    assert.ok(values.every((value) => !output.includes(value) && !output.includes(sha(value))), 'complete TAP stdout/stderr contain no minted token');
+    t.diagnostic(output);
+    t.diagnostic(`minted ${values.length}, hits 0 (complete TAP stdout/stderr)`);
+    assert.equal(child.status, 0, 'Docker child passed');
+    assert.equal(values.length, 6, 'all six scratch tokens were minted: the acceptance actually ran');
+    return;
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'cb2d-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const tlsDir = join(dir, 'tls'), tls = scratchCa(tlsDir);
+  // The container's git user reads the scratch key; it is a throwaway key for this run only.
+  chmodSync(tlsDir, 0o755);
+  chmodSync(join(tlsDir, 'server.key'), 0o644);
+  const ca = readFileSync(tls.ca, 'utf8'), port = await freePort();
+  const url = `https://127.0.0.1:${port}`, name = 'cb2-' + randomBytes(6).toString('hex');
+  t.after(() => docker('rm', '-f', name));
+  const started = docker('run', '-d', '--rm', '--name', name, '-p', `127.0.0.1:${port}:3000`, '-v', `${tlsDir}:/certs:ro`,
+    '-e', 'GITEA__security__INSTALL_LOCK=true', '-e', 'GITEA__database__DB_TYPE=sqlite3',
+    '-e', 'GITEA__service__DISABLE_REGISTRATION=true', '-e', 'GITEA__server__PROTOCOL=https',
+    '-e', 'GITEA__server__CERT_FILE=/certs/server.pem', '-e', 'GITEA__server__KEY_FILE=/certs/server.key',
+    '-e', `GITEA__server__ROOT_URL=${url}/`, IMAGE);
+  assert.equal(started.status, 0, 'scratch container starts');
+  const end = Date.now() + 120000;
+  while ((await call(url, ca, 'GET', '/api/v1/version')).status !== 200) {
+    assert.ok(Date.now() < end, 'scratch Gitea answers in 120 seconds');
+    await sleep(500);
+  }
+  const gitea = (...args) => docker('exec', '-u', 'git', name, 'gitea', ...args);
+  const minted = [];
+  const createUser = (user, admin = false) => {
+    const r = gitea('admin', 'user', 'create', '--username', user, '--email', `${user}@example.test`,
+      '--password', randomBytes(16).toString('base64url'), '--must-change-password=false', ...(admin ? ['--admin'] : []));
+    assert.equal(r.status, 0, `create scratch ${user}`);
+  };
+  const mint = (user, scopes) => {
+    const r = gitea('admin', 'user', 'generate-access-token', '--username', user, '--token-name', 'cb2-' + randomBytes(4).toString('hex'),
+      '--scopes', scopes.join(','), '--raw');
+    assert.equal(r.status, 0, `mint scratch ${user}`);
+    const value = r.stdout.trim();
+    assert.ok(/^[0-9a-f]{40}$/.test(value), 'minted token shape');
+    minted.push(value);
+    writeFileSync(process.env.CB2_COPY_CAPTURE, JSON.stringify(minted), { mode: 0o600 });
+    return value;
+  };
+  createUser('scratch-admin', true);
+  createUser('owner');
+  const admin = 'token ' + mint('scratch-admin', ['write:admin', 'write:repository', 'write:user']);
+  for (const repo of ['stack', 'other']) {
+    const made = await call(url, ca, 'POST', '/api/v1/admin/users/owner/repos', { auth: admin, body: { name: repo, auto_init: true, private: true } });
+    assert.equal(made.status, 201, `create owner/${repo}`);
+  }
+
+  // The organization: one root agent "rev" whose copy binding approves write:repository and
+  // read:user on project stack, whose remote is the scratch owner/stack.
+  const root = mkdtempSync(join(tmpdir(), 'cb2o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${url}/owner/stack`;
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo');
+  await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => (snapshot.org === id ? snapshot : null) });
+  const loaded = () => {
+    const d = loadBusiness('demo', { dir: root, rolesDir });
+    // The boot's copies view, as the runtime's loadWithCopies gives the broker.
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions[e.definition], ...e }])), copies: copiesView(snapshot.copies) };
+  };
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  const issue = copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca, timeoutMs: 10000 });
+  const b = new Broker({
+    store, businesses: { demo: loaded() },
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', loaded()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a),
+  });
+  const consoleCap = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const request_ = (cap, verb, args) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  await request_(consoleCap, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy',
+    binding: { services: { gitea: { scopes: ['write:repository', 'read:user'], projects: ['stack'] } } } });
+  const rec = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings.rev;
+  assert.equal(rec().state, 'pending');
+  const slot = join(storeRoot, 'demo', 'rev', 'gitea');
+  const issueToken = (token) => request_(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token });
+
+  // The copy's dedicated account: a read collaborator on owner/stack only.
+  const login = copyBotLogin(rec().orgIncarnation, rec().copyId, 'gitea');
+  createUser(login);
+  const collaborate = (repo, permission) => call(url, ca, 'PUT', `/api/v1/repos/owner/${repo}/collaborators/${login}`, { auth: admin, body: { permission } });
+  assert.equal((await collaborate('stack', 'read')).status, 204, 'bot is a read collaborator on owner/stack');
+
+  const refused = async (token, code, label) => {
+    await assert.rejects(issueToken(token), { code }, label);
+    assert.equal(rec().state, 'pending', label);
+    assert.equal(rec().services.gitea.grantId, undefined, label);
+    assert.ok(!existsSync(slot), `${label}: a refused token leaves no slot`);
+  };
+
+  // Equal: the approved scopes exactly.
+  const equal = mint(login, ['write:repository', 'read:user']);
+  const self = await call(url, ca, 'GET', '/api/v1/token', { auth: 'token ' + equal });
+  assert.equal(self.status, 200);
+  assert.equal(self.json.user.login, login, 'Gitea 1.27.1 names the token owner on /api/v1/token');
+  const one = await issueToken(equal);
+  assert.equal(one.state, 'bound');
+  assert.equal(one.account, login);
+  assert.deepEqual([rec().state, rec().services.gitea.grantId, rec().services.gitea.grantGeneration], ['bound', `gitea:${self.json.user.id}:${self.json.id}`, 1]);
+  assert.equal(statSync(slot).mode & 0o777, 0o600);
+  assert.equal(readFileSync(slot, 'utf8'), equal + '\n');
+
+  // Narrower: read within the approved write.
+  const narrow = mint(login, ['read:repository', 'read:user']);
+  await issueToken(narrow);
+  assert.deepEqual([rec().state, rec().services.gitea.grantGeneration], ['bound', 2]);
+  assert.equal(readFileSync(slot, 'utf8'), narrow + '\n');
+
+  // Broader in one category, and "all": exceeded; a failed re-issue deactivates the binding.
+  await refused(mint(login, ['write:repository', 'write:user']), 'credential-scope-exceeded', 'write:user beyond read:user');
+  await refused(mint(login, ['all']), 'credential-scope-exceeded', 'all');
+  // The administrator's own token, inside the approved scopes: not the copy's account.
+  await refused(mint('scratch-admin', ['read:repository', 'read:user']), 'credential-identity-refused', 'admin account');
+  // A token Gitea never issued.
+  await refused(randomBytes(20).toString('hex'), 'credential-scope-unverified', 'opaque token');
+  // An unrelated repository the account can also reach.
+  assert.equal((await collaborate('other', 'read')).status, 204);
+  await refused(narrow, 'credential-scope-exceeded', 'unrelated repository');
+
+  // Nothing kept names a token, its digest, the slot path or a request.
+  const kept = [file, join(root, 'businesses/.history/demo/changes.jsonl')].filter(existsSync).map((p) => readFileSync(p, 'utf8')).join('\n')
+    + ['events', 'decisions'].map((tb) => JSON.stringify(store.all(`SELECT * FROM ${tb}`))).join('\n');
+  for (const value of minted) assert.ok(!kept.includes(value) && !kept.includes(sha(value)) && !kept.includes(sha(value + '\n')), 'kept text holds no token');
+  for (const bad of [slot, storeRoot, '/api/v1', 'authorization']) assert.ok(!kept.includes(bad), 'kept text holds no path or request');
+  t.diagnostic(`minted ${minted.length}`);
+});
@@ -0,0 +1,558 @@
+// #1873 CB2 (design section 5 steps 4 to 6, section 8 row CB2): credentials.issue for an agent copy's
+// bound Gitea service, verified live against a fake Gitea before any grant metadata lands. The
+// organization writer's half is packages/organization/tests/copy-grant-writer.test.mjs; the real
+// server acceptance is copy-grant-docker.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { copyGrant, tokenLevels, verifyGiteaToken, boundRepositories, MAX_ROTATE_DAYS, sweepCopySlots } from '../src/copy-grant.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { materializeCopies, copiesView } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const present = (p) => { try { lstatSync(p); return true; } catch { return false; } };
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+
+async function fixture(t, { services = READ, edit = (d) => d } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'cb2-')), rolesDir = rolesCopy(root);
+  const api = await fakeGiteaApi(t, root);
+  const base = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  base.projects.stack.agents = { checker: { definition: 'reviewer' } };
+  base.projects.stack.remote = `${api.url}/owner/stack`;
+  const doc = edit(base);
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => snapshot.org === id ? snapshot : null });
+  const loaded = () => { const d = loadBusiness('demo', { dir: root, rolesDir }); return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions[e.definition], ...e }])), copies: copiesView((opts.copies ?? snapshot).copies) }; };
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 }); chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  const hooks = {};
+  const opts = { timeoutMs: 3000 };
+  const issue = (...a) => copyGrant({ credentials, writer, copies: opts.copies ?? snapshot, organizations: () => ['demo'], ca: api.ca, timeoutMs: opts.timeoutMs, hooks })(...a);
+  const direct = (args, ctx) => issue('demo', args, ctx);
+  const b = new Broker({ store, businesses: { demo: loaded() }, hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', loaded()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a) });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const bind = (name = 'rev', svc = services, extra = {}) => call(owner, 'hire.start.console', { op: 'change', level: 'root', name, reason: 'Bind the copy', binding: { services: svc }, ...extra });
+  await bind();
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const rec = (name = 'rev') => JSON.parse(readFileSync(file, 'utf8')).copyBindings?.[name];
+  const repo = api.addRepo('owner', 'stack');
+  // The copy's dedicated account, a read collaborator on owner/stack, and one token from it.
+  const bot = (name = 'rev', { perm = 'read', admin = false } = {}) => {
+    const r = rec(name);
+    const login = copyBotLogin(r.orgIncarnation, r.copyId, 'gitea');
+    const u = api.users.get(login) ?? api.addUser(login, { is_admin: admin }).user;
+    repo.collaborators.push(login); repo.permissions[login] = perm;
+    return u;
+  };
+  const token = (u, scopes = ['read:repository', 'read:user'], o) => api.addToken(u.login, `t${api.issued.length}`, scopes, o);
+  const slot = (name = 'rev') => join(storeRoot, 'demo', name, 'gitea');
+  const issueAs = (cap, args) => call(cap, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), ...args });
+  return { root, file, api, b, store, writer, credentials, hooks, opts, direct, owner, human, chief, call, bind, rec, bot, token, slot, repo, storeRoot, issueAs, loaded, snapshot };
+}
+
+// Everything the bus or the organization keeps after an issue: the document, the receipts, the store.
+function kept(f) {
+  const files = [f.file, join(f.root, 'businesses/.history/demo/changes.jsonl')].filter(existsSync).map((p) => readFileSync(p, 'utf8'));
+  const rows = ['events', 'decisions'].map((tb) => JSON.stringify(f.store.all(`SELECT * FROM ${tb}`)));
+  return files.join('\n') + rows.join('\n');
+}
+
+test('CB2 an owner-issued copy token is verified live, staged and bound; nothing kept names the token or its path', async (t) => {
+  const f = await fixture(t);
+  assert.equal(f.rec().state, 'pending');
+  const u = f.bot();
+  const tok = f.token(u);
+  const date = ahead(30);
+  const result = await f.issueAs(f.human, { token: tok.sha1, date });
+  assert.deepEqual(result, { agent: 'rev', service: 'gitea', verb: 'issue', date, state: 'bound', account: u.login, generation: result.generation });
+  const r = f.rec();
+  assert.equal(r.state, 'bound');
+  assert.deepEqual(r.services.gitea, { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] }, rotateBy: date, grantId: `gitea:${u.id}:${tok.id}`, grantGeneration: 1 });
+  assert.equal(statSync(f.slot()).mode & 0o777, 0o600);
+  assert.equal(readFileSync(f.slot(), 'utf8'), tok.sha1 + '\n');
+  // Only GETs went to Gitea, every one as the copy's account.
+  assert.ok(f.api.requests.length > 0);
+  for (const req of f.api.requests) {
+    assert.equal(req.method, 'GET');
+    if (req.path !== '/api/v1/version') assert.equal(req.as, u.login);
+  }
+  const text = kept(f) + JSON.stringify(result);
+  for (const bad of [tok.sha1, sha(tok.sha1), sha(tok.sha1 + '\n'), f.slot(), f.storeRoot, '/api/v1', 'authorization']) assert.ok(!text.includes(bad), 'kept text holds a secret, path or request');
+  // Copies still cannot launch in CB2: the snapshot does not resolve a gitea-only copy (CB3 owns launch).
+});
+
+test('CB2 narrower and equal scopes are accepted; any broader token is exceeded and leaves the record inactive', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['write:repository', 'read:user'], projects: ['stack'] } } });
+  const u = f.bot('rev', { perm: 'write' });
+  for (const scopes of [['write:repository', 'write:user'], ['all'], ['write:admin', 'read:user'], ['read:repository', 'read:user', 'read:issue'], ['read:user', 'read:misc']]) {
+    const tok = f.token(u, scopes);
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' }, scopes.join());
+    assert.equal(f.rec().state, 'pending', scopes.join());
+    assert.equal(f.rec().services.gitea.grantId, undefined);
+    assert.ok(!existsSync(f.slot()), 'a refused token leaves no slot');
+  }
+  // Equal.
+  await f.issueAs(f.human, { token: f.token(u, ['write:repository', 'read:user']).sha1 });
+  assert.equal(f.rec().state, 'bound');
+  // Narrower (read within the approved write) re-issues; the grant generation counts up.
+  f.repo.permissions[u.login] = 'read';
+  const narrow = f.token(u, ['read:repository', 'read:user']);
+  await f.issueAs(f.human, { token: narrow.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration, f.rec().services.gitea.grantId], ['bound', 2, `gitea:${u.id}:${narrow.id}`]);
+  // A failed re-issue after bound deactivates the binding and removes its slot.
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['all']).sha1 }), { code: 'credential-scope-exceeded' });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantId, existsSync(f.slot())], ['pending', undefined, false]);
+});
+
+test('CB2 read is narrower than write within a category; categories are independent; push needs write', async (t) => {
+  assert.deepEqual(tokenLevels(['read:repository', 'write:repository', 'read:user']), { repository: 'write', user: 'read' });
+  assert.deepEqual(tokenLevels(['write:issue', 'read:issue']), { issue: 'write' });
+  for (const bad of [['all'], ['write:admin'], ['read:admin'], ['read:sudo'], ['repository'], [], null, [7]]) assert.equal(tokenLevels(bad), null, JSON.stringify(bad));
+  const f = await fixture(t);
+  // The binding approved read:repository; the account can push, so the token reaches more than read.
+  const u = f.bot('rev', { perm: 'write' });
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-scope-exceeded' });
+  // write:issue is another category: read:repository never approves it.
+  f.repo.permissions[u.login] = 'read';
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['read:repository', 'read:user', 'write:issue']).sha1 }), { code: 'credential-scope-exceeded' });
+  await f.issueAs(f.human, { token: f.token(u).sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 push is held to the binding, not the token: a narrower token binds for a push account on a write binding', async () => {
+  const push = { '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { admin: false, push: true, pull: true } }], total: 1 } };
+  await assert.rejects(V(scripted(push).transport), { code: 'credential-scope-exceeded' });
+  const write = { approved: ['write:repository', 'read:user'] };
+  assert.deepEqual(await V(scripted(push).transport, write), { userId: 5, tokenId: 9, login: 'bot' });
+  const writeToken = { '/api/v1/token': { status: 200, json: { id: 9, scopes: ['write:repository', 'read:user'], user: { id: 5, login: 'bot' } } } };
+  assert.deepEqual(await V(scripted({ ...push, ...writeToken }).transport, write), { userId: 5, tokenId: 9, login: 'bot' });
+  await assert.rejects(V(scripted({ ...push, ...writeToken }).transport), { code: 'credential-scope-exceeded' });
+});
+
+test('CB2 the boot copy must still match the record: a missing, refused or changed copy refuses before anything is staged or sent', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const rev = f.snapshot.copies.rev;
+  const cases = [
+    [{ ...f.snapshot, copies: {} }, 'copy-unavailable'],
+    [{ ...f.snapshot, org: 'other' }, 'copy-unavailable'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, state: 'refused' } } }, 'copy-unavailable'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, level: 'project', project: 'stack' } } }, 'credential-binding-changed'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, name: 'other' } } }, 'credential-binding-changed'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, definition: 'coder' } } }, 'credential-binding-changed'],
+  ];
+  const before = kept(f), sent = f.api.requests.length;
+  for (const [copies, code] of cases) {
+    f.opts.copies = copies;
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code }, JSON.stringify(copies.copies?.rev ?? copies.org));
+  }
+  f.opts.copies = null;
+  // No record for the name, or a name the organization's own roles hold.
+  await assert.rejects(f.direct({ agent: 'nobody', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code: 'credential-unbound' });
+  f.opts.copies = { ...f.snapshot, copies: { ...f.snapshot.copies, chief: { ...rev, name: 'chief' } } };
+  const { document } = f.writer.read('demo');
+  const shadow = { ...f.writer, read: () => ({ ...f.writer.read('demo'), document: { ...document, copyBindings: { ...document.copyBindings, chief: document.copyBindings.rev } } }) };
+  await assert.rejects(copyGrant({ credentials: f.credentials, writer: shadow, copies: f.opts.copies, organizations: () => ['demo'] })('demo', { agent: 'chief', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code: 'copy-unavailable' });
+  f.opts.copies = null;
+  assert.deepEqual([kept(f) === before, f.api.requests.length, present(join(f.storeRoot, 'demo'))], [true, sent, false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 stageCopy refuses a name a loaded reference holds and an unknown service, leaving the file alone', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'cb2-ref-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const storeRoot = join(root, 'agents');
+  mkdirSync(join(storeRoot, 'demo', 'rev'), { recursive: true, mode: 0o700 }); chmodSync(storeRoot, 0o700); chmodSync(join(storeRoot, 'demo'), 0o700);
+  const file = join(storeRoot, 'demo', 'rev', 'gitea');
+  writeFileSync(file, 'r'.repeat(40) + '\n', { mode: 0o600 });
+  const credentials = new Credentials({ references: { 'demo/rev': { gitea: { service: 'gitea', store: true, file, rotateBy: ahead(30) } } }, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  assert.throws(() => credentials.stageCopy('demo/rev', 'gitea', 'a'.repeat(40)), { code: 'credential-reference' });
+  assert.equal(readFileSync(file, 'utf8'), 'r'.repeat(40) + '\n');
+  assert.throws(() => credentials.stageCopy('demo/other', 'model', 'a'.repeat(40)), { code: 'credential-reference' });
+  assert.equal(present(join(storeRoot, 'demo', 'other')), false);
+});
+
+test('CB2 a Vikunja binding refuses credential-scope-unverified before anything is staged or sent', async (t) => {
+  const vik = { tasks: ['read_one'] };
+  const f = await fixture(t, { services: { gitea: READ.gitea, vikunja: { scopes: vik, projects: ['stack'] } } });
+  const before = readFileSync(f.file, 'utf8');
+  await assert.rejects(f.issueAs(f.human, { service: 'vikunja', token: 'v'.repeat(40) }), { code: 'credential-scope-unverified' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  assert.ok(!existsSync(join(f.storeRoot, 'demo', 'rev')));
+  // With a Gitea grant the record still waits on Vikunja: pending, never bound.
+  await f.issueAs(f.human, { token: f.token(f.bot()).sha1 });
+  assert.equal(f.rec().state, 'pending');
+  assert.ok(f.rec().services.gitea.grantId);
+  assert.ok(REFUSALS['credential-scope-unverified'].nextStep.includes('Vikunja'));
+});
+
+test('CB2 unrelated repositories, admin rights or a missing bound repository refuse', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const other = f.api.addRepo('someone', 'private', { collaborators: [u.login] });
+  other.permissions[u.login] = 'read';
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' });
+  other.collaborators.length = 0;
+  const own = f.api.addRepo(u.login, 'scratch');
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' });
+  f.api.repos.splice(f.api.repos.indexOf(own), 1);
+  f.repo.collaborators.length = 0;
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  assert.equal(f.rec().state, 'pending');
+  f.repo.collaborators.push(u.login);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+// A scripted Gitea for the verifier's own branches: paging, organizations and malformed answers.
+function scripted(over = {}) {
+  const base = {
+    '/api/v1/version': { status: 200, json: { version: '1.27.1' } },
+    '/api/v1/token': { status: 200, json: { id: 9, scopes: ['read:repository', 'read:user'], user: { id: 5, login: 'bot' } } },
+    '/api/v1/user': { status: 200, json: { id: 5, login: 'bot', is_admin: false } },
+    '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { admin: false, push: false, pull: true } }], total: 1 },
+    '/api/v1/user/orgs': { status: 200, json: [], total: 0 },
+    ...over,
+  };
+  const seen = [];
+  const transport = async ({ path, method }) => {
+    seen.push(`${method} ${path}`);
+    const key = path.split('?')[0];
+    const a = base[key];
+    return typeof a === 'function' ? a(path) : { total: null, ...a };
+  };
+  return { transport, seen };
+}
+const V = (transport, extra = {}) => verifyGiteaToken({ transport, url: 'https://127.0.0.1:1', token: 'x'.repeat(40), approved: ['read:repository', 'read:user', 'read:organization'], repos: new Set(['owner/stack']), login: 'bot', rotateBy: ahead(30), ...extra });
+
+test('CB2 verifier: paging must agree, organizations are refused with an organization scope', async () => {
+  assert.deepEqual(await V(scripted().transport), { userId: 5, tokenId: 9, login: 'bot' });
+  const pages = (p1, p2) => (path) => (path.includes('page=1') ? p1 : p2);
+  const repo = (n) => ({ full_name: `owner/${n}`, permissions: { admin: false, push: false, pull: true } });
+  const two = new Set(['owner/stack', 'owner/b']);
+  const many = Array.from({ length: 50 }, (_, i) => repo(`r${i}`));
+  const fifty = new Set(many.map((r) => r.full_name.toLowerCase()));
+  // A total that changes between pages, a page that comes back short, and no total at all.
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': pages({ status: 200, json: many, total: 51 }, { status: 200, json: [repo('x')], total: 52 }) }).transport, { repos: fifty }), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': pages({ status: 200, json: many, total: 52 }, { status: 200, json: [], total: 52 }) }).transport, { repos: fifty }), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack')], total: null } }).transport), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack'), repo('b')], total: 2 } }).transport), { code: 'credential-scope-exceeded' });
+  assert.ok(await V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack'), repo('b')], total: 2 } }).transport, { repos: two }));
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { push: false, pull: true } }], total: 1 } }).transport), { code: 'credential-scope-exceeded' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack' }], total: 1 } }).transport), { code: 'credential-scope-unverified' });
+  // Organizations: only asked when the token has an organization level.
+  const plain = scripted({ '/api/v1/user/orgs': { status: 200, json: [{ id: 1, username: 'acme' }], total: 1 } });
+  assert.ok(await V(plain.transport));
+  assert.ok(!plain.seen.some((s) => s.includes('/user/orgs')));
+  const orgTok = { '/api/v1/token': { status: 200, json: { id: 9, scopes: ['read:organization', 'read:repository', 'read:user'], user: { id: 5, login: 'bot' } } } };
+  assert.ok(await V(scripted(orgTok).transport));
+  await assert.rejects(V(scripted({ ...orgTok, '/api/v1/user/orgs': { status: 200, json: [{ id: 1, username: 'acme' }], total: 1 } }).transport), { code: 'credential-scope-exceeded' });
+  await assert.rejects(V(scripted({ ...orgTok, '/api/v1/user/orgs': { status: 500, json: null } }).transport), { code: 'credential-scope-unverified' });
+  // The bound projects' remotes: one https Gitea origin, agreeing remotes.
+  const doc = (projects) => ({ projects });
+  assert.deepEqual([...boundRepositories(doc({ a: { remote: 'https://127.0.0.1:9/Owner/Stack' } }), ['a']).repos], ['owner/stack']);
+  for (const [d, ps] of [[doc({ a: { remote: 'http://127.0.0.1:9/o/r' } }), ['a']], [doc({ a: {} }), ['a']], [doc({}), ['a']], [doc({ a: { remote: 'https://127.0.0.1:9/o/r' }, b: { remote: 'https://127.0.0.2:9/o/r' } }), ['a', 'b']], [doc({}), []],
+    [doc({ a: { remote: 'https://127.0.0.1:9/o/r', git: { mode: 'remote', remote: 'https://127.0.0.1:9/o/s' } } }), ['a']]])
+    assert.throws(() => boundRepositories(d, ps), { code: 'credential-scope-unverified' });
+});
+
+test('CB2 a foreign account, an administrator or another copy\'s token is identity-refused', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const foreign = f.api.addUser('someone-else').user;
+  f.repo.collaborators.push('someone-else');
+  for (const tok of [f.token(foreign), { sha1: f.api.adminToken }]) {
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-identity-refused' });
+    assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  }
+  // The copy's own login, made an administrator.
+  u.is_admin = true;
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-identity-refused' });
+  u.is_admin = false;
+  // /user names another account than /token did.
+  const undo = f.api.rule((e) => e.path === '/api/v1/user', { status: 200, json: { id: u.id + 1000, login: u.login, is_admin: false } });
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-identity-refused' });
+  undo();
+  // Another copy's account and token: checker.stack is bound in the same organization.
+  await f.call(f.owner, 'hire.start.console', { op: 'change', level: 'project', project: 'stack', name: 'checker', reason: 'Bind', binding: { services: READ } });
+  const checker = f.bot('checker.stack');
+  const theirs = f.token(checker);
+  await assert.rejects(f.issueAs(f.human, { token: theirs.sha1 }), { code: 'credential-identity-refused' });
+  await f.issueAs(f.human, { agent: 'checker.stack', token: theirs.sha1 });
+  assert.equal(f.rec('checker.stack').state, 'bound');
+  assert.equal(f.rec().state, 'pending');
+  assert.notEqual(checker.login, u.login);
+});
+
+test('CB2 an opaque or unverifiable token refuses unverified; a malformed one refuses credential-format', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  // A malformed token refuses before anything is staged or sent (build review 2): the bound record is
+  // unchanged, nothing reached Gitea and no slot exists.
+  const before = kept(f), sent = f.api.requests.length;
+  await assert.rejects(f.issueAs(f.human, { token: 'short' }), { code: 'credential-format' });
+  await assert.rejects(f.issueAs(f.human, { token: 'has space ' + 'x'.repeat(30) }), { code: 'credential-format' });
+  assert.deepEqual([kept(f) === before, f.api.requests.length, present(join(f.storeRoot, 'demo', 'rev'))], [true, sent, false]);
+  await assert.rejects(f.issueAs(f.human, { token: 'f'.repeat(40) }), { code: 'credential-scope-unverified' });
+  const tok = f.token(u);
+  for (const answer of [{ status: 200, json: { id: tok.id, scopes: tok.scopes } }, { status: 200, json: { id: tok.id, scopes: tok.scopes, user: { login: u.login } } }, { status: 500, json: null }, { drop: true }]) {
+    const undo = f.api.rule((e) => e.path === '/api/v1/token', answer);
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' }, JSON.stringify(answer));
+    undo();
+  }
+  f.opts.timeoutMs = 300;
+  const hang = f.api.rule((e) => e.path.startsWith('/api/v1/user/repos'), { hang: true });
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  hang();
+  f.opts.timeoutMs = 3000;
+  f.api.state.version = '1.26.0';
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  f.api.state.version = '1.27.1';
+  // The token lacks read:user, which the binding approved: its repositories cannot be listed.
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['read:repository']).sha1 }), { code: 'credential-scope-unverified' });
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 a token any definition already holds refuses before anything is staged or sent', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const before = readFileSync(f.file, 'utf8');
+  // The boot copy snapshot's definitions are live text for the bus's lifetime.
+  f.opts.copies = { ...f.snapshot, definitions: { ...f.snapshot.definitions, leaky: { note: `see ${tok.sha1}` } } };
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'definition-holds-credential' });
+  assert.deepEqual([readFileSync(f.file, 'utf8') === before, existsSync(f.slot()), f.api.requests.length], [true, false, 0]);
+  f.opts.copies = null;
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 a binding without read:user is unverifiable before anything is staged', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['read:repository'], projects: ['stack'] } } });
+  const before = readFileSync(f.file, 'utf8');
+  await assert.rejects(f.issueAs(f.human, { token: f.token(f.bot()).sha1 }), { code: 'credential-scope-unverified' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+});
+
+test('CB2 dates: the rotation date is after today, at most a year ahead, and not after the token expires', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const before = readFileSync(f.file, 'utf8');
+  for (const date of [ahead(0), ahead(-1), ahead(MAX_ROTATE_DAYS + 1), '2099-02-30', '2099-1-01', 'tomorrow'])
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1, date }), { code: 'credential-date' }, date);
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  const soon = f.token(u, undefined, { expires: `${ahead(10)}T00:00:00Z` });
+  await assert.rejects(f.issueAs(f.human, { token: soon.sha1, date: ahead(10) }), { code: 'credential-date' });
+  await assert.rejects(f.issueAs(f.human, { token: soon.sha1, date: ahead(30) }), { code: 'credential-date' });
+  const odd = f.token(u, undefined, { expires: 'not-a-date' });
+  await assert.rejects(f.issueAs(f.human, { token: odd.sha1 }), { code: 'credential-scope-unverified' });
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: soon.sha1, date: ahead(9) });
+  assert.equal(f.rec().services.gitea.rotateBy, ahead(9));
+  await f.issueAs(f.human, { token: f.token(u, undefined, { expires: `${ahead(400)}T00:00:00Z` }).sha1, date: ahead(MAX_ROTATE_DAYS) });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 the slot is read back by identity: symlinks, hard links, stale and replaced files refuse credential-file', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const other = f.token(u);
+  const elsewhere = join(f.root, 'elsewhere');
+  const cases = {
+    symlink: ['afterStage', () => { writeFileSync(elsewhere, tok.sha1 + '\n', { mode: 0o600 }); unlinkSync(f.slot()); symlinkSync(elsewhere, f.slot()); }],
+    hardlink: ['afterStage', () => { rmSync(elsewhere, { force: true }); linkSync(f.slot(), elsewhere); }],
+    stale: ['afterStage', () => { renameSync(f.slot(), elsewhere); writeFileSync(f.slot(), tok.sha1 + '\n', { mode: 0o600 }); }],
+    mode: ['afterStage', () => chmodSync(f.slot(), 0o644)],
+    // A writer replaces a file by renaming a new one over it, as the store does.
+    replacedAfterRemote: ['afterRemote', () => { writeFileSync(elsewhere, other.sha1 + '\n', { mode: 0o600 }); renameSync(elsewhere, f.slot()); }],
+    replacedBeforeCommit: ['beforeCommit', () => { writeFileSync(elsewhere, other.sha1 + '\n', { mode: 0o600 }); renameSync(elsewhere, f.slot()); }],
+    // Unlinked and written again: the inode number may be reused, the content still differs.
+    reusedInode: ['afterStage', () => { unlinkSync(f.slot()); writeFileSync(f.slot(), other.sha1 + '\n', { mode: 0o600 }); }],
+    rewrittenInPlace: ['beforeCommit', () => writeFileSync(f.slot(), other.sha1 + '\n')],
+  };
+  for (const [name, [hook, act]] of Object.entries(cases)) {
+    rmSync(elsewhere, { force: true });
+    f.hooks[hook] = act;
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-file' }, name);
+    delete f.hooks[hook];
+    assert.equal(f.rec().state, 'pending', name);
+    assert.equal(f.rec().services.gitea.grantId, undefined, name);
+    // The bus removes only the file it wrote; a file someone else put there stays.
+    if (['symlink', 'stale', 'replacedAfterRemote', 'replacedBeforeCommit'].includes(name)) assert.ok(present(f.slot()), name);
+    if (['hardlink', 'mode', 'rewrittenInPlace'].includes(name)) assert.ok(!present(f.slot()), name);
+    rmSync(f.slot(), { force: true });
+  }
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 crash points leave the record pending and the slot removed; a new verified issue recovers', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  for (const hook of ['afterStage', 'afterRemote', 'beforeCommit']) {
+    f.hooks[hook] = () => { throw new Error('crash'); };
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'outcome-unknown' }, hook);
+    delete f.hooks[hook];
+    assert.deepEqual([f.rec().state, f.rec().services.gitea.grantId, existsSync(f.slot())], ['pending', undefined, false], hook);
+  }
+  // A hard crash after the stage (security review P2): the record is pending and the staged token is
+  // on disk. The next start's sweep removes it before anything loads; the record stays pending and
+  // only a fresh verified issue binds.
+  const r = f.rec();
+  const { revision } = f.writer.read('demo');
+  f.writer.stageCopyGrant('demo', { instance: 'rev', service: 'gitea', copyId: r.copyId, generation: r.generation, decision: r.decision, incarnation: r.orgIncarnation }, { revision, actor: 'jason', owner: true });
+  f.credentials.stageCopy('demo/rev', 'gitea', tok.sha1);
+  assert.equal(f.rec().state, 'pending');
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', f.writer.read('demo').document]], {}), [{ instance: 'demo/rev', service: 'gitea' }]);
+  assert.deepEqual([f.rec().state, present(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration], ['bound', 1]);
+  // A lost reply: the commit landed but the caller never heard. Issuing again re-verifies.
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration], ['bound', 2]);
+});
+
+test('CB2 the start sweep removes only ungranted copy slots and staged temp files', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+  const doc = () => [['demo', f.writer.read('demo').document]];
+  const copyDir = join(f.storeRoot, 'demo', 'rev');
+  // A granted slot stays; an interrupted write's temp file goes; a name that is no service stays.
+  writeFileSync(join(copyDir, 'gitea.tmp'), 'x', { mode: 0o600 });
+  writeFileSync(join(copyDir, 'notes'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), {}), [{ instance: 'demo/rev', service: 'gitea' }]);
+  assert.deepEqual([present(f.slot()), present(join(copyDir, 'gitea.tmp')), present(join(copyDir, 'notes'))], [true, false, true]);
+  // An ungranted service of a bound copy goes; a slot a loaded reference names stays.
+  writeFileSync(join(copyDir, 'vikunja'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), { 'demo/rev': { vikunja: { service: 'vikunja' } } }), []);
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), {}), [{ instance: 'demo/rev', service: 'vikunja' }]);
+  // A role's own slots and an unreadable organization are never touched.
+  const roleDir = join(f.storeRoot, 'demo', 'chief');
+  mkdirSync(roleDir, { mode: 0o700 }); writeFileSync(join(roleDir, 'gitea'), 'x', { mode: 0o600 });
+  const edited = { ...f.writer.read('demo').document };
+  edited.copyBindings = { ...edited.copyBindings, chief: { ...edited.copyBindings.rev, services: {} } };
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', edited]], {}), []);
+  assert.equal(present(join(roleDir, 'gitea')), true);
+  writeFileSync(join(copyDir, 'gitea.tmp'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', null]], {}), []);
+  assert.equal(present(join(copyDir, 'gitea.tmp')), true);
+  // No store, a missing org dir: nothing. A store dir that isn't private refuses as Credentials would.
+  assert.deepEqual(sweepCopySlots(null, doc(), {}), []);
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['other', f.writer.read('demo').document]], {}), []);
+  chmodSync(copyDir, 0o755);
+  assert.throws(() => sweepCopySlots(f.storeRoot, doc(), {}), /credential-file/);
+  chmodSync(copyDir, 0o700);
+});
+
+test('CB2 a stage write that fails leaves no staged token behind', async (t) => {
+  const f = await fixture(t);
+  // The slot path is a non-empty directory: the rename fails after the temp file holds the token.
+  mkdirSync(join(f.slot(), 'x'), { recursive: true, mode: 0o700 });
+  assert.throws(() => f.credentials.stageCopy('demo/rev', 'gitea', 'a'.repeat(40)));
+  assert.deepEqual(readdirSync(join(f.storeRoot, 'demo', 'rev')), ['gitea']);
+});
+
+test('CB2 a rebind, a failed owner recheck or a concurrent issue during the remote work refuses the commit', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  // The owner approves a new binding while Gitea is being asked.
+  f.hooks.afterRemote = () => f.bind('rev', { gitea: { scopes: ['read:user', 'read:repository'], projects: ['stack'] } });
+  // The document moved under the commit: its revision check refuses before the binding fence.
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'revision-conflict' });
+  delete f.hooks.afterRemote;
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  // The caller's owner recheck fails after the remote work (the broker's #copyOwner), and again
+  // when it fails only under the writer's locks.
+  for (const at of [1, 2]) {
+    let n = 0;
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true, recheck: () => { if (++n >= at) throw new BusError('human-required'); } }), { code: 'human-required' });
+    assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  }
+  // Not the owner, or the tester's name, never reaches the writer.
+  for (const ctx of [{ actor: 'jason', owner: false }, { actor: 'tester', owner: true }])
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, ctx), { code: 'human-required' });
+  // Two issues: the first is held after its remote work while the second binds.
+  const second = f.token(u);
+  let release, first = true;
+  const held = new Promise((r) => { release = r; });
+  f.hooks.afterRemote = () => { if (first) { first = false; return held; } };
+  const a = f.issueAs(f.human, { token: tok.sha1 });
+  await new Promise((r) => setTimeout(r, 50));
+  while (f.hooks.afterRemote && first) await new Promise((r) => setTimeout(r, 10));
+  await f.issueAs(f.human, { token: second.sha1 });
+  release();
+  await assert.rejects(a, (e) => ['revision-conflict', 'credential-binding-changed', 'credential-file'].includes(e.code));
+  delete f.hooks.afterRemote;
+  assert.equal(f.rec().state, 'bound');
+  assert.equal(f.rec().services.gitea.grantId, `gitea:${u.id}:${second.id}`);
+  assert.equal(readFileSync(f.slot(), 'utf8'), second.sha1 + '\n', 'the second issue\'s slot stays');
+});
+
+test('CB2 only the organization owner issues: the chief, the tester, a reader and an org.hire member are refused before staging', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const before = readFileSync(f.file, 'utf8');
+  const member = (owner) => f.b.bindHireConsole({ business: 'demo', actor: 'member', subject: { ...SUBJECT, sub: 'member' }, rights: ['org.hire', 'decide'], owner, instanceOwner: true });
+  const got = [];
+  for (const cap of [f.chief, f.b.bindTester({ business: 'demo' }), f.b.bindReader({ business: 'demo' }), member(false), member(true), f.owner]) {
+    await assert.rejects(f.issueAs(cap, { token: tok.sha1 }), (e) => { got.push(e.code); return !String(e.message).includes(tok.sha1); });
+  }
+  // The Console caps, the owner's included, never reach credentials.issue: the token comes from the
+  // owner's CLI on standard input.
+  assert.deepEqual(got, ['human-required', 'tester-refused', 'human-required', 'human-required', 'human-required', 'human-required']);
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  assert.ok(!existsSync(join(f.storeRoot, 'demo')));
+  // Only a name the boot's copies view holds goes to the copy verifier; any other unknown name
+  // answers credential-unknown as before, and nothing is staged or sent.
+  await assert.rejects(f.issueAs(f.human, { agent: 'nobody', token: tok.sha1 }), { code: 'credential-unknown' });
+  assert.deepEqual([readFileSync(f.file, 'utf8') === before, f.api.requests.length, existsSync(join(f.storeRoot, 'demo'))], [true, 0, false]);
+});
+
+test('CB2 refusal table: the new codes have rails and next steps that name no path', () => {
+  for (const code of ['credential-scope-unverified', 'credential-identity-refused', 'credential-date', 'credential-format', 'credential-file', 'copy-unavailable']) {
+    const g = REFUSALS[code];
+    assert.ok(g && g.rail.length && g.nextStep.length, code);
+    assert.doesNotMatch(g.nextStep, /\/|~|\.json\b|secrets/, code);
+  }
+});
@@ -0,0 +1,238 @@
+// #1873 CB3 live acceptance: a bound copy's launch gate against a scratch gitea/gitea:1.27.1, a
+// throwaway container on 127.0.0.1 over TLS with a scratch CA, removed after. The boot proves the
+// slot live, a launch carries its authority to the bound session, one checked call reads the bound
+// repository, and a reissue denies the next call before any request. The test never pulls an image;
+// without Docker or the image it skips. Every token here is a scratch token this container made;
+// none is printed, and nothing here reaches git.mosaicstack.dev or any real service.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { request } from 'node:https';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
+
+const IMAGE = 'gitea/gitea:1.27.1';
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+const docker = (...args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 120000 });
+const skip = docker('image', 'inspect', IMAGE).status === 0 ? false : `no Docker or no local ${IMAGE}; this test never pulls`;
+
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+
+// One HTTPS call to the scratch container as its administrator, trusting only the scratch CA.
+function call(url, ca, method, path, { auth = null, body = null } = {}) {
+  return new Promise((resolve) => {
+    const data = body ? JSON.stringify(body) : null;
+    const headers = { accept: 'application/json', ...(data ? { 'content-type': 'application/json' } : {}), ...(auth ? { authorization: auth } : {}) };
+    const req = request(url + path, { method, ca, headers, timeout: 10000 }, (res) => {
+      let text = '';
+      res.on('data', (c) => (text += c));
+      res.on('end', () => {
+        let json = null;
+        try {
+          json = text ? JSON.parse(text) : null;
+        } catch {}
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve({ status: 0, json: null }));
+    req.end(data ?? undefined);
+  });
+}
+
+test('CB3-D: on scratch 1.27.1 a bound copy boots proved, launches with its authority, reads only its repository, refuses a redirect, and a reissue denies the next call unsent', { skip, timeout: 300000 }, async (t) => {
+  // The child's complete TAP output is captured before any of it reaches this runner, so the parent
+  // can search it for the minted values without putting one in an assertion.
+  if (!process.env.CB3_COPY_CAPTURE) {
+    const capture = mkdtempSync(join(tmpdir(), 'cb3cap-'));
+    t.after(() => rmSync(capture, { recursive: true, force: true }));
+    const file = join(capture, 'minted');
+    const childEnv = { ...process.env, CB3_COPY_CAPTURE: file };
+    delete childEnv.NODE_TEST_CONTEXT;
+    const child = spawnSync(process.execPath, ['--test', '--test-name-pattern=^CB3-D:', fileURLToPath(import.meta.url)], {
+      encoding: 'utf8', timeout: 280000, env: childEnv,
+    });
+    const values = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : [];
+    const output = (child.stdout ?? '') + (child.stderr ?? '');
+    assert.ok(values.every((value) => !output.includes(value) && !output.includes(sha(value))), 'complete TAP stdout/stderr contain no minted token');
+    t.diagnostic(output);
+    t.diagnostic(`minted ${values.length}, hits 0 (complete TAP stdout/stderr)`);
+    assert.equal(child.status, 0, 'Docker child passed');
+    assert.equal(values.length, 3, 'all three scratch tokens were minted: the acceptance actually ran');
+    return;
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'cb3d-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const tlsDir = join(dir, 'tls'), tls = scratchCa(tlsDir);
+  // The container's git user reads the scratch key; it is a throwaway key for this run only.
+  chmodSync(tlsDir, 0o755);
+  chmodSync(join(tlsDir, 'server.key'), 0o644);
+  const ca = readFileSync(tls.ca, 'utf8'), port = await freePort();
+  const url = `https://127.0.0.1:${port}`, name = 'cb3-' + randomBytes(6).toString('hex');
+  t.after(() => docker('rm', '-f', name));
+  const started = docker('run', '-d', '--rm', '--name', name, '-p', `127.0.0.1:${port}:3000`, '-v', `${tlsDir}:/certs:ro`,
+    '-e', 'GITEA__security__INSTALL_LOCK=true', '-e', 'GITEA__database__DB_TYPE=sqlite3',
+    '-e', 'GITEA__service__DISABLE_REGISTRATION=true', '-e', 'GITEA__server__PROTOCOL=https',
+    '-e', 'GITEA__server__CERT_FILE=/certs/server.pem', '-e', 'GITEA__server__KEY_FILE=/certs/server.key',
+    '-e', `GITEA__server__ROOT_URL=${url}/`, IMAGE);
+  assert.equal(started.status, 0, 'scratch container starts');
+  const end = Date.now() + 120000;
+  while ((await call(url, ca, 'GET', '/api/v1/version')).status !== 200) {
+    assert.ok(Date.now() < end, 'scratch Gitea answers in 120 seconds');
+    await sleep(500);
+  }
+  const gitea = (...args) => docker('exec', '-u', 'git', name, 'gitea', ...args);
+  const minted = [];
+  const createUser = (user, admin = false) => {
+    const r = gitea('admin', 'user', 'create', '--username', user, '--email', `${user}@example.test`,
+      '--password', randomBytes(16).toString('base64url'), '--must-change-password=false', ...(admin ? ['--admin'] : []));
+    assert.equal(r.status, 0, `create scratch ${user}`);
+  };
+  const mint = (user, scopes) => {
+    const r = gitea('admin', 'user', 'generate-access-token', '--username', user, '--token-name', 'cb3-' + randomBytes(4).toString('hex'),
+      '--scopes', scopes.join(','), '--raw');
+    assert.equal(r.status, 0, `mint scratch ${user}`);
+    const value = r.stdout.trim();
+    assert.ok(/^[0-9a-f]{40}$/.test(value), 'minted token shape');
+    minted.push(value);
+    writeFileSync(process.env.CB3_COPY_CAPTURE, JSON.stringify(minted), { mode: 0o600 });
+    return value;
+  };
+  createUser('scratch-admin', true);
+  createUser('owner');
+  const admin = 'token ' + mint('scratch-admin', ['write:admin', 'write:repository', 'write:user']);
+  for (const repo of ['stack', 'other']) {
+    const made = await call(url, ca, 'POST', '/api/v1/admin/users/owner/repos', { auth: admin, body: { name: repo, auto_init: true, private: true } });
+    assert.equal(made.status, 201, `create owner/${repo}`);
+  }
+
+  // The organization: one root agent "rev" (research, Gitea alone) bound read-only to project stack.
+  const root = mkdtempSync(join(tmpdir(), 'cb3o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${url}/owner/stack`;
+  writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo');
+  await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'research' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => (snapshot.org === id ? snapshot : null) });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, by op only.
+  const sent = [];
+  const transport = (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issue = copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca, timeoutMs: 10000 });
+  const b = new Broker({
+    store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a),
+  });
+  const consoleCap = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const request_ = (cap, verb, args) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  await request_(consoleCap, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services: READ } });
+  const rec = () => JSON.parse(readFileSync(join(root, 'businesses/demo.json'), 'utf8')).copyBindings.rev;
+  const login = copyBotLogin(rec().orgIncarnation, rec().copyId, 'gitea');
+  createUser(login);
+  const collaborate = (repo) => call(url, ca, 'PUT', `/api/v1/repos/owner/${repo}/collaborators/${login}`, { auth: admin, body: { permission: 'read' } });
+  assert.equal((await collaborate('stack')).status, 204, 'bot is a read collaborator on owner/stack');
+  const issueToken = (token) => request_(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token });
+  assert.equal((await issueToken(mint(login, ['read:repository', 'read:user']))).state, 'bound');
+
+  // Bound after this gate was made: restart-required until a boot proves it.
+  await assert.rejects(gate.prepare('demo', 'rev'), { code: 'restart-required' });
+  assert.deepEqual(sent, []);
+  await gate.boot('demo');
+  assert.deepEqual(gate.bound(), { rev: ['gitea'] });
+  assert.ok(sent.includes('GET /api/v1/token'), 'the boot proved the slot live at the service');
+  promoted = promoteCopies(snapshot, gate.bound());
+  b.reloadBusiness('demo', business());
+
+  // A launch: prepare proves the slot again, bindLaunch carries the authority to the session.
+  const project = (await request_(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+  const thread = (await request_(human, 'thread.create', { project, name: 'one', instance: 'rev' })).id;
+  const proofs = sent.length;
+  const revision = writer.read('demo').revision;
+  const { authority } = await gate.prepare('demo', 'rev', revision);
+  assert.ok(sent.slice(proofs).includes('GET /api/v1/token'));
+  const cap = b.bindLaunch({ business: 'demo', role: 'rev', run: 'rev-run', harness: 'pi', thread, copyAuthority: authority, revision });
+  const use = (req) => Promise.resolve().then(() => gate.call(b.copySession(cap), req));
+  const own = await use({ method: 'GET', path: '/api/v1/repos/owner/stack' });
+  assert.equal(own.status, 200);
+  assert.equal(own.json.full_name, 'owner/stack');
+  // A repository outside the binding, and a write on a read binding: refused before any request.
+  const before = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/other' }), { code: 'copy-request-refused' });
+  await assert.rejects(use({ method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } }), { code: 'copy-request-refused' });
+  assert.equal(sent.length, before);
+
+  // A reissue (a new generation) while the session is live: the next call refuses, none is sent.
+  await issueToken(mint(login, ['read:repository', 'read:user']));
+  assert.equal(rec().services.gitea.grantGeneration, 2);
+  const afterIssue = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'restart-required' });
+  assert.equal(sent.length, afterIssue, 'no request after the reissue');
+
+  // Gitea answers a renamed repository's old path with a redirect. A fresh boot and launch on the
+  // second token; the bound path now redirects, and the gate refuses it without following.
+  const gate2 = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  await gate2.boot('demo');
+  assert.deepEqual(gate2.bound(), { rev: ['gitea'] });
+  const { authority: authority2 } = await gate2.prepare('demo', 'rev');
+  // The broker's session for the old launch is gone with its authority; this one is gate2's own.
+  assert.throws(() => b.copySession(cap), { code: 'restart-required' });
+  const session = { business: 'demo', role: 'rev', copyAuthority: authority2 };
+  assert.equal((await gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' })).status, 200);
+  assert.equal((await call(url, ca, 'PATCH', '/api/v1/repos/owner/stack', { auth: admin, body: { name: 'moved' } })).status, 200, 'rename owner/stack');
+  const viaOld = await call(url, ca, 'GET', '/api/v1/repos/owner/stack', { auth: admin });
+  assert.equal(viaOld.status, 301, 'Gitea 1.27.1 redirects a renamed repository\'s old path');
+  const n = sent.length;
+  await assert.rejects(gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'copy-redirect-refused' });
+  assert.equal(sent.length, n + 1, 'one request, never followed');
+  t.diagnostic(`minted ${minted.length}`);
+});
@@ -0,0 +1,567 @@
+// #1873 CB3 (design section 5 steps 7 and 8, section 8 row CB3): a bound agent copy launches only
+// when the bus's boot proved its binding live at the service, every launch carries a launch
+// authority the bus checks again at prepare, final admission and bindLaunch, and each credential
+// call is checked against the session's authority before and after the request. The fake Gitea is
+// fake-gitea-api.mjs on 127.0.0.1; the runtime and launcher halves are runtime tests below and
+// packages/cli/tests/agent-copies.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const WRITE = { gitea: { scopes: ['read:user', 'write:repository'], projects: ['stack'] } };
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const CODES = ['restart-required', 'credential-revoked', 'credential-revoking', 'credential-unavailable', 'credential-expired',
+  'copy-authority-changed', 'copy-request-refused', 'copy-redirect-refused', 'organization-changed', 'organization-unreadable'];
+
+// demo with the project stack on the fake Gitea and the root copy rev (research, which needs gitea
+// alone; a binding may be narrower than the role). The
+// owner binds rev with `services` and, unless `issue` is false, issues one live token for it (CB2).
+// `gate` is the CB3 gate on the boot snapshot; `boot()` runs its boot check and returns the broker's
+// business with the copies it proved promoted, as runtime.mjs does.
+async function fixture(t, { services = READ, perm = 'read', issue = true, definition = 'research', budgets = {} } = {}) {
+  let clock = Date.now();
+  const root = mkdtempSync(join(tmpdir(), 'cb3-')), rolesDir = rolesCopy(root);
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const api = await fakeGiteaApi(t, root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${api.url}/owner/stack`;
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => snapshot.org === id ? snapshot : null });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 }); chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, with what the test lets through; `hold` parks one until released.
+  const sent = [];
+  const transport = async (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca: api.ca, timeoutMs: 3000, now: () => new Date(clock), ...budgets });
+  const advance = (days) => { clock += days * 86400000; };
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issueGrant = (...a) => copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca: api.ca, timeoutMs: 3000 })(...a);
+  const b = new Broker({ store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issueGrant(...a) });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const rec = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings?.rev;
+  const repo = api.addRepo('owner', 'stack');
+  api.addRepo('owner', 'other');
+  await call(owner, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services } });
+  const r = rec();
+  const login = copyBotLogin(r.orgIncarnation, r.copyId, 'gitea');
+  const bot = api.addUser(login).user;
+  repo.collaborators.push(login); repo.permissions[login] = perm;
+  const scopes = services.gitea.scopes;
+  const reissue = (scopesNow = scopes) => call(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token: api.addToken(login, `t${api.issued.length}`, scopesNow).sha1 });
+  if (issue) await reissue();
+  const boot = async () => {
+    await gate.boot('demo');
+    promoted = promoteCopies(snapshot, gate.bound());
+    b.reloadBusiness('demo', business());
+  };
+  const slot = join(storeRoot, 'demo', 'rev', 'gitea');
+  // A run of rev, bound with the authority the launcher's prepare returned.
+  // rev is a thread instance, so each run takes a thread of its own in the stack project.
+  let project = null;
+  const threadFor = async (run) => {
+    project ??= (await call(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+    return (await call(human, 'thread.create', { project, name: run, instance: 'rev' })).id;
+  };
+  const launch = async (run = 'rev-run') => {
+    const thread = await threadFor(run);
+    const revision = writer.read('demo').revision;
+    const { authority } = await gate.prepare('demo', 'rev', revision);
+    return { authority, thread, cap: b.bindLaunch({ business: 'demo', role: 'rev', run, harness: 'pi', thread, copyAuthority: authority, revision }) };
+  };
+  const use = (cap, request) => Promise.resolve().then(() => gate.call(b.copySession(cap), request));
+  const GET = { method: 'GET', path: '/api/v1/repos/owner/stack' };
+  // The organization file edited in place, as an owner's editor would.
+  const edit = (fn) => {
+    const d = JSON.parse(readFileSync(file, 'utf8'));
+    fn(d);
+    writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+  };
+  // The next request matching `match` waits at the fake server until release() lets it through.
+  const hold = (match) => {
+    let release, arrived;
+    const go = new Promise((r) => { release = r; });
+    const seen = new Promise((r) => { arrived = r; });
+    const unrule = api.rule((e, body) => match(e, body), async () => { unrule(); arrived(); await go; return { pass: true }; });
+    return { release: () => release(), arrived: seen };
+  };
+  // Gate requests to the copy's repositories (the proof's /version, /token and /user routes aside).
+  const repoCalls = () => sent.filter((x) => x.includes('/api/v1/repos/')).length;
+  return { root, rolesDir, edit, hold, advance, repoCalls, file, api, b, gate, threadFor, writer, credentials, owner, human, call, rec, bot, login, repo, reissue, boot, slot, launch, use, sent, GET, storeRoot, snapshot, business };
+}
+
+const refuses = (code) => (e) => { assert.ok(e instanceof BusError, String(e?.stack ?? e)); assert.equal(e.code, code); return true; };
+
+test('CB3 every new refusal code is in the refusal table with a rail and a next step naming no path', () => {
+  for (const code of CODES) {
+    const entry = REFUSALS[code];
+    assert.ok(entry, code);
+    assert.match(entry.rail, /^R\d+[/:]/, code);
+    assert.ok(entry.nextStep.length > 20, code);
+    assert.ok(!/(^|\s)(\/|~\/)\S/.test(entry.nextStep), `${code} names a path`);
+  }
+});
+
+test('CB3 a copy bound before boot is proved live at boot and launches; prepare, admission and bindLaunch carry one authority', async (t) => {
+  const f = await fixture(t);
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const role = f.b.taskRoles('demo').rev;
+  assert.deepEqual([role.copyBound, role.credentials], [['gitea'], {}]);
+  const { authority, cap } = await f.launch();
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+  // The live proof at prepare went to the bound origin as the copy's account.
+  assert.ok(f.sent.includes('GET /api/v1/token'));
+  const r = await f.use(cap, f.GET);
+  assert.equal(r.status, 200);
+  assert.equal(r.json.full_name, 'owner/stack');
+  assert.ok(!JSON.stringify(r).includes(f.api.issued.at(-1)));
+  // bindLaunch refuses a bound copy without the authority, or with another one.
+  const r2 = await f.threadFor('r2'), r3 = await f.threadFor('r3');
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2 }), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r3', harness: 'pi', thread: r3, copyAuthority: 'f'.repeat(64) }), refuses('copy-authority-changed'));
+  // A non-copy never carries one.
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', copyAuthority: authority }), refuses('invalid-request'));
+});
+
+test('CB3 a binding approved after boot answers restart-required at every launch step and sends nothing', async (t) => {
+  const f = await fixture(t, { issue: false });
+  assert.notEqual(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  // The owner issues the grant now: the record is bound and granted, but the boot didn't prove it.
+  await f.reissue();
+  assert.equal(f.rec().state, 'bound');
+  assert.equal(f.b.taskRoles('demo').rev, undefined);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('restart-required'));
+  assert.throws(() => f.gate.admit('demo', 'rev', 'f'.repeat(64)), refuses('restart-required'));
+  // The verb says so too, before its own unbound refusal.
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('restart-required'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a partial binding (a role needing gitea and vikunja, bound for gitea alone) never launches and its boot sends nothing', async (t) => {
+  const f = await fixture(t, { definition: 'reviewer' });
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('credential-scope-unverified'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a redirect from the bound origin is refused and never followed', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.path === '/api/v1/repos/owner/stack', { status: 302 });
+  await assert.rejects(f.use(cap, f.GET), refuses('copy-redirect-refused'));
+  assert.equal(f.api.requests.filter((e) => e.path.startsWith('/api/v1/repos/')).length, 1);
+});
+
+test('CB3 a call reaches only the admitted repositories, by the methods the binding allows, with no body on a read', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  for (const request of [
+    { method: 'GET', path: '/api/v1/repos/owner/other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/../other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/%2e%2e/other' },
+    { method: 'GET', path: '/api/v1/user' },
+    { method: 'GET', path: 'https://evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '//evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack', body: { x: 1 } },
+    { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } },
+    { method: 'TRACE', path: '/api/v1/repos/owner/stack' },
+    { service: 'vikunja', method: 'GET', path: '/api/v1/repos/owner/stack' },
+  ]) await assert.rejects(f.use(cap, request), refuses('copy-request-refused'), JSON.stringify(request));
+  assert.equal(f.repoCalls(), 0);
+  // The session, never the arguments, names who the call is for.
+  await assert.rejects(f.gate.call({ business: 'demo', role: 'rev', copyAuthority: 'f'.repeat(64) }, f.GET), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.copySession(f.human), refuses('copy-request-refused'));
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 a write binding reaches its repository by POST as the copy\'s account (a READ binding is refused above)', async (t) => {
+  const f = await fixture(t, { services: WRITE, perm: 'write' });
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.method === 'POST' && e.path === '/api/v1/repos/owner/stack/issues', { status: 201, json: { number: 1 } });
+  const r = await f.use(cap, { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } });
+  assert.deepEqual(r, { status: 201, json: { number: 1 } });
+  const seen = f.api.requests.filter((e) => e.path === '/api/v1/repos/owner/stack/issues');
+  assert.deepEqual(seen.map((e) => [e.method, e.as]), [['POST', f.login]]);
+});
+
+test('CB3 a re-issue, a replaced slot or rewritten token bytes deny the next call with no request and no cached token', async (t) => {
+  for (const [name, change, code] of [
+    ['re-issue', (f) => f.reissue(), 'restart-required'],
+    ['slot replaced', (f) => { writeFileSync(f.slot + '.n', 'x'.repeat(40), { mode: 0o600 }); renameSync(f.slot + '.n', f.slot); }, 'credential-unavailable'],
+    ['bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40))), 'credential-unavailable'],
+    ['slot removed', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+    ['mode widened', (f) => chmodSync(f.slot, 0o644), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      assert.equal((await f.use(cap, f.GET)).status, 200);
+      const before = f.sent.length;
+      await change(f);
+      // The bus's session lookup refuses the run itself, before the gate's own check.
+      assert.throws(() => f.b.copySession(cap), refuses(code));
+      await assert.rejects(f.use(cap, f.GET), refuses(code));
+      // No new launch either.
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses(code));
+      assert.deepEqual(f.sent.slice(before), []);
+    });
+  }
+});
+
+test('CB3 a revoke while a call is in flight denies that call\'s answer and the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+  const pending = f.use(cap, f.GET);
+  await h.arrived;
+  await f.reissue();
+  h.release();
+  await assert.rejects(pending, refuses('restart-required'));
+  const before = f.sent.length;
+  await assert.rejects(f.use(cap, f.GET), refuses('restart-required'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a grant change in flight fences the copy: nothing is admitted or sent until it ends, and an unknown outcome keeps the fence', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const r2 = await f.threadFor('r2');
+  const authority = f.gate.authority('demo', 'rev').authority;
+  // The owner's re-issue holds at its live proof; the copy is fenced meanwhile.
+  const h = f.hold((e) => e.path === '/api/v1/version');
+  const issuing = f.reissue();
+  await h.arrived;
+  const before = f.sent.length;
+  assert.equal(f.gate.revoking('demo', 'rev'), true);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoking'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2, copyAuthority: authority }), refuses('credential-revoking'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoking'));
+  assert.equal(f.sent.length, before);
+  h.release();
+  await issuing;
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  // A definite refusal lifts the fence; an unknown outcome, a system error or a codeless throw keeps it.
+  await assert.rejects(f.gate.fence('demo', 'rev', () => { throw new BusError('credential-date'); }), refuses('credential-date'));
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  for (const thrown of [new BusError('outcome-unknown'), Object.assign(new Error('disk'), { code: 'ENOSPC' }), new Error('bug')]) {
+    const g = await fixture(t);
+    await g.boot();
+    await assert.rejects(g.gate.fence('demo', 'rev', () => { throw thrown; }));
+    assert.equal(g.gate.revoking('demo', 'rev'), true, String(thrown.code));
+    await assert.rejects(g.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+    assert.deepEqual(g.sent.filter((x) => !x.startsWith('GET /api/v1/version') && !x.startsWith('GET /api/v1/token') && !x.startsWith('GET /api/v1/user')), []);
+  }
+});
+
+// Each change lands while prepare's live proof is at the server (between the authority before and
+// after), then again between prepare and bindLaunch, then between bindLaunch and the first use. None
+// may end in a request to the copy's repositories.
+const RACES = [
+  ['role definition changed', (f) => writeFileSync(join(f.rolesDir, 'research.md'), readFileSync(join(f.rolesDir, 'research.md'), 'utf8') + '\nChanged.\n')],
+  ['binding generation moved', (f) => f.edit((d) => { d.copyBindings.rev.generation += 1; })],
+  ['binding unbound', (f) => f.edit((d) => { d.copyBindings.rev.state = 'unbound'; })],
+  ['grant scopes narrowed', (f) => f.edit((d) => { d.copyBindings.rev.services.gitea.scopes = ['read:user']; })],
+  ['token bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40)))],
+  ['project remote moved', (f) => f.edit((d) => { d.projects.stack.remote = 'https://elsewhere.test/owner/stack'; })],
+  ['project removed', (f) => f.edit((d) => { delete d.projects.stack; })],
+  ['project excludes the copy', (f) => f.edit((d) => { d.projects.stack.agents = { ...d.projects.stack.agents, rev: { exclude: true } }; })],
+];
+
+test('CB3 a change during prepare\'s live proof refuses the launch with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const h = f.hold((e) => e.path === '/api/v1/token');
+      const preparing = f.gate.prepare('demo', 'rev');
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(preparing, (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+test('CB3 a change between prepare and bindLaunch, or between bindLaunch and use, refuses with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(`${name} before bind`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const thread = await f.threadFor('r1');
+      const { authority } = await f.gate.prepare('demo', 'rev');
+      await change(f);
+      assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority }),
+        (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+    await t.test(`${name} before use`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      await change(f);
+      await assert.rejects(f.use(cap, f.GET), (e) => e instanceof BusError && /^(copy-|credential-|restart-|run-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The organization's registry entry rewritten in place (mode kept), as a lifecycle change would.
+const registryEdit = (f, fn) => {
+  const file = join(f.root, 'org-runtime.json');
+  const d = JSON.parse(readFileSync(file, 'utf8'));
+  fn(d.orgs.demo, d);
+  writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+};
+
+test('CB3 an organization no longer active admits and sends nothing, with the binding and incarnation unchanged', async (t) => {
+  for (const state of ['archived', 'deleting', 'reserved']) {
+    await t.test(`${state} after launch`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap, authority } = await f.launch();
+      registryEdit(f, (e) => { e.state = state; });
+      const before = f.sent.length;
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoked'));
+      assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+      await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+      assert.equal(f.sent.length, before);
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+  await t.test('archived while prepare\'s proof is at the server', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev');
+    await h.arrived;
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    h.release();
+    await assert.rejects(preparing, refuses('credential-revoked'));
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('archived before boot', async (t) => {
+    const f = await fixture(t);
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    await f.boot();
+    assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  });
+  await t.test('registry unsafe after launch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const { cap } = await f.launch();
+    chmodSync(join(f.root, 'org-runtime.json'), 0o644);
+    const before = f.sent.length;
+    await assert.rejects(f.use(cap, f.GET), refuses('credential-unavailable'));
+    assert.equal(f.sent.length, before);
+  });
+});
+
+test('CB3 an organization recreated under the same id (a new incarnation) admits and sends nothing for the old copy', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap, authority } = await f.launch();
+  registryEdit(f, (e) => { e.incarnation = 'f'.repeat(32); });
+  const before = f.sent.length;
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+  assert.equal(f.sent.length, before);
+});
+
+// The project points at another repository on the same server: origin, binding and slot are as
+// boot proved them, only the repositories the launch authority covers move.
+const repointed = (f) => f.edit((d) => { d.projects.stack.remote = d.projects.stack.remote.replace('/owner/stack', '/owner/other'); });
+
+test('CB3 a change while a call is in flight denies that call\'s answer, including one that moves only the launch authority', async (t) => {
+  for (const [name, change, code] of [['repository repointed', repointed, 'credential-revoked'],
+    ...RACES.filter(([n]) => ['role definition changed', 'project excludes the copy'].includes(n)).map(([n, c]) => [n, c, null])]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+      const pending = f.use(cap, f.GET);
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(pending, code ? refuses(code) : (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+    });
+  }
+});
+
+test('CB3 a running copy session whose launch authority moved answers no agent verb', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  // Past the copy check to the holder check: the session holds no claim yet.
+  await assert.rejects(f.call(cap, 'inbox'), refuses('not-holder'));
+  repointed(f);
+  assert.doesNotThrow(() => f.gate.authority('demo', 'rev'));
+  await assert.rejects(f.call(cap, 'inbox'), refuses('copy-authority-changed'));
+});
+
+test('CB3 a binding with no repository scope sends no repository request, read or write', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['read:user'], projects: ['stack'] } } });
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const { cap } = await f.launch();
+  for (const method of ['GET', 'HEAD', 'POST'])
+    await assert.rejects(f.use(cap, { method, path: '/api/v1/repos/owner/stack' }), refuses('copy-request-refused'), method);
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 the organization file revision the launch resolved holds through prepare, final admission and bindLaunch', async (t) => {
+  // Same document, other bytes: the launch authority is unchanged, only the revision moves.
+  const rewrite = (f) => writeFileSync(f.file, JSON.stringify(JSON.parse(readFileSync(f.file, 'utf8'))) + '\n');
+  await t.test('changed before prepare', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    rewrite(f);
+    const before = f.sent.length;
+    await assert.rejects(f.gate.prepare('demo', 'rev', revision), refuses('organization-changed'));
+    assert.equal(f.sent.length, before);
+  });
+  await t.test('changed during prepare\'s proof', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev', revision);
+    await h.arrived;
+    rewrite(f);
+    h.release();
+    await assert.rejects(preparing, refuses('organization-changed'));
+  });
+  await t.test('changed after final admission, before bindLaunch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const thread = await f.threadFor('r1');
+    const revision = f.writer.read('demo').revision;
+    const { authority } = await f.gate.prepare('demo', 'rev', revision);
+    f.gate.admit('demo', 'rev', authority, revision);
+    rewrite(f);
+    assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+    assert.throws(() => f.gate.admit('demo', 'rev', authority, revision), refuses('organization-changed'));
+    const bind = (extra) => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority, ...extra });
+    assert.throws(() => bind({ revision }), refuses('organization-changed'));
+    assert.throws(() => bind({}), refuses('organization-changed'));
+    assert.equal(f.repoCalls(), 0);
+    // The same authority on the file as it stands now binds: the refusal above was the revision's.
+    assert.ok(bind({ revision: f.writer.read('demo').revision }));
+  });
+  await t.test('a non-copy never carries a revision', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', revision: f.writer.read('demo').revision }), refuses('invalid-request'));
+  });
+});
+
+test('CB3 a copy past its rotation date refuses credential-expired at prepare and at the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.advance(31);
+  const before = f.sent.length;
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-expired'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-expired'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a boot that cannot verify proves nothing: the service unreachable, the token refused, the slot missing', async (t) => {
+  for (const [name, setup, code] of [
+    // The verifier answers an unreachable service as unverified (copy-grant.mjs verifyGiteaToken).
+    ['service down', (f) => f.api.rule(() => true, { drop: true }), 'credential-scope-unverified'],
+    ['token revoked at the service', (f) => f.api.rule((e) => e.path === '/api/v1/token', { status: 401, json: { message: 'no' } }), 'credential-scope-unverified'],
+    ['slot missing', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      setup(f);
+      await f.boot();
+      assert.deepEqual(f.gate.bound(), {});
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses(code));
+      await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses(code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The launcher's host stops on a reply later than 10 s, so a slow service must not hold prepare past
+// its budget: the proof gets no answer, the launch is refused, and nothing more is sent.
+test('CB3: a service that does not answer within the budget fails prepare and boot closed, inside the budget', { timeout: 60000 }, async (t) => {
+  await t.test('prepare', async (t) => {
+    const f = await fixture(t, { budgets: { prepareMs: 400 } });
+    await f.boot();
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+    assert.ok(Date.now() - at < 2500, `prepare took ${Date.now() - at} ms`);
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('boot', async (t) => {
+    const f = await fixture(t, { budgets: { bootMs: 400 } });
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await f.boot();
+    assert.ok(Date.now() - at < 2500, `boot took ${Date.now() - at} ms`);
+    assert.deepEqual(f.gate.bound(), {});
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+  });
+});
@@ -4,13 +4,15 @@
 // scratch root only.
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { startBroker } from '../src/runtime.mjs';
 import { Broker, CREDENTIAL_VERBS } from '../src/broker.mjs';
 import { Store } from '../src/store.mjs';
 import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
+import { definitionPin } from '../../organization/src/copy-bindings.mjs';
+import { readTemplate } from '../../organization/src/definitions.mjs';

 const TOKEN = 'fake_issued_token_0123456789';
 const ROTATED = 'fake_rotated_token_9876543210';
@@ -18,16 +20,18 @@ const OTHER = 'fake_other_token_5555555555';
 const DATE = '2099-01-01';
 const role = { authority: { withinRole: ['message.send'], crossRole: [] } };

-async function setup(t, { storeRoot = true } = {}) {
+async function setup(t, { storeRoot = true, before = () => {}, edit = () => {} } = {}) {
  const root = mkdtempSync(join(tmpdir(), 'bus-cred-verbs-'));
  t.after(() => rmSync(root, { recursive: true, force: true }));
  const rolesDir = rolesCopy(root);
  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } };
+  edit(doc, rolesDir);
  doc.roles.coder.credentials.gitea = { store: true, rotateBy: DATE };
  writeJson(join(root, 'businesses/demo.json'), doc);
  mkdirSync(join(root, 'data'), { mode: 0o700 });
  if (storeRoot) mkdirSync(join(root, 'secrets', 'agents'), { mode: 0o700 });
  const store = (agent, service) => join(root, 'secrets', 'agents', 'demo', agent, service);
+  before(store);
  // The bus's resolved business carries the same references; a store one names its derived file.
  const demo = {
    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
@@ -187,3 +191,26 @@ test('#1886: a store root that exists with loose modes still refuses start', asy
  };
  await assert.rejects(startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } }), /credential-file/);
 });
+
+test('CB2 security review P2: the start sweep removes a copy slot a crashed issue left staged', async (t) => {
+  // A copy binding left pending by an issue killed after its stage, its token and a temp file on disk.
+  const pending = (doc, rolesDir) => {
+    doc.copyBindings = { rev: {
+      copyId: 'c'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: definitionPin('reviewer', { definitions: {}, rolesDir, readTemplate }), generation: 2, state: 'pending',
+      services: { gitea: { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] } } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+  };
+  const staged = (store) => {
+    mkdirSync(join(store('rev', 'gitea'), '..'), { recursive: true, mode: 0o700 });
+    chmodSync(join(store('rev', 'gitea'), '..', '..'), 0o700);
+    for (const name of ['gitea', 'gitea.tmp']) writeFileSync(store('rev', name), TOKEN + '\n', { mode: 0o600 });
+    mkdirSync(join(store('coder', 'gitea'), '..'), { recursive: true, mode: 0o700 });
+    writeFileSync(store('coder', 'gitea'), TOKEN + '\n', { mode: 0o600 });
+  };
+  const c = await setup(t, { edit: pending, before: staged });
+  assert.equal(c.file().copyBindings.rev.state, 'pending');
+  assert.deepEqual(readdirSync(join(c.store('rev', 'gitea'), '..')), []);
+  // A role's own store slot is the store's, not the sweep's.
+  assert.equal(existsSync(c.store('coder', 'gitea')), true);
+});
@@ -0,0 +1,336 @@
+// #1873 T1 follow-up (org-defscan): bus start runs the live credential store's held-secret check on
+// every organization definition, and the launch check asks the bus the same question. A hit names
+// the definition and the key, never the text there or the credential's name.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { BusError } from '../src/broker.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { DEFINITION_HOLDS_CREDENTIAL, DEFINITION_SCAN_UNREADABLE, heldPath, scanDefinitions, scanOrganizations } from '../src/definition-scan.mjs';
+import { startBroker } from '../src/runtime.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { bootConfig, loadSystem } from '../../cli/src/config.mjs';
+import { fixture, tmp } from '../../cli/tests/helpers.mjs';
+import { entryFromTemplate, readTemplate } from '../../organization/src/definitions.mjs';
+import { REPO_ROLES, writeJson } from '../../organization/tests/helpers.mjs';
+
+// The fixture bus holds SENTINEL as coder's gitea token.
+const SENTINEL = 'sk-test-NOT-A-SECRET-1234';
+const UNHELD = 'sk-test-UNHELD-LOOKS-LIKE-A-TOKEN-0000';
+
+function files(dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? files(join(dir, e.name)) : e.isFile() ? [join(dir, e.name)] : []);
+}
+
+// An organization whose coder names org:builder, a copy of the coder template; `edit` changes the
+// builder entry before the file is written. `held` is the coder's gitea token at start.
+function org(t, edit = (entry) => entry, { held = SENTINEL } = {}) {
+  const root = tmp(t, 'defscan-');
+  const builder = edit(entryFromTemplate(readTemplate(REPO_ROLES, 'coder')));
+  const f = fixture(root, 'acme', (doc) => ({ ...doc, definitions: { builder }, roles: { ...doc.roles, coder: { ...doc.roles.coder, definition: 'org:builder' } } }));
+  writeFileSync(f.doc.roles.coder.credentials.gitea.file, held);
+  const file = join(root, 'config/businesses/acme.json');
+  const boot = () => bootConfig({ system: loadSystem({ env: f.env }), businessId: 'acme', env: f.env });
+  const start = (b = boot()) => startBroker({ dataRoot: f.dataRoot, businesses: b.businesses, organization: b.organization });
+  return { root, f, file, boot, start };
+}
+
+function refusedWithout(e, reason) {
+  assert.ok(e instanceof BusError, String(e));
+  assert.equal(e.code, DEFINITION_HOLDS_CREDENTIAL);
+  assert.equal(e.reason, reason);
+  for (const text of [e.message, e.reason, String(e.stack), JSON.stringify(e)]) {
+    assert.ok(!text.includes(SENTINEL), 'the refusal never carries the value');
+    assert.ok(!/gitea/.test(text), 'the refusal never names the credential');
+  }
+  return true;
+}
+
+// The start's outcome: the refusal, or "started" after closing a bus that should not have started.
+const outcome = (start) => start.then(async (bus) => { await bus.close(); return 'started'; }, (e) => e);
+
+function nothingWritten(root) {
+  for (const path of files(root)) {
+    if (path.endsWith('.token') || path.endsWith('acme.json')) continue;
+    assert.ok(!readFileSync(path).includes(SENTINEL), path);
+  }
+}
+
+test('org-defscan: the refusal code is in the TI refusal table with a next step', () => {
+  const entry = REFUSALS[DEFINITION_HOLDS_CREDENTIAL];
+  assert.ok(entry, 'definition-holds-credential is a known refusal');
+  assert.match(entry.rail, /^R\d+:/);
+  assert.match(entry.nextStep, /definition/);
+  assert.match(entry.nextStep, /issue the credential again/);
+  assert.match(entry.nextStep, /For a hire, deny it/);
+  // The issue-time check's fail-closed code for an organization file it cannot read.
+  const unreadable = REFUSALS[DEFINITION_SCAN_UNREADABLE];
+  assert.ok(unreadable, 'definition-scan-unreadable is a known refusal');
+  assert.match(unreadable.rail, /^R\d+/);
+  assert.match(unreadable.nextStep, /organization file/);
+  assert.equal(new BusError(DEFINITION_SCAN_UNREADABLE).nextStep, unreadable.nextStep);
+});
+
+test('org-defscan: a held credential in a definition\'s instructions refuses bus start, naming definition and key only', async (t) => {
+  const o = org(t, (entry) => ({ ...entry, instructions: `${entry.instructions}\nThe forge token is ${SENTINEL}.\n` }));
+  refusedWithout(await outcome(o.start()), 'definitions.builder instructions holds a credential this bus holds');
+  nothingWritten(o.root);
+});
+
+test('org-defscan: a held credential in a personality field refuses bus start the same way', async (t) => {
+  const o = org(t, (entry) => ({ ...entry, personality: { summary: `Careful. Key ${SENTINEL}.`, traits: ['plain'] } }));
+  refusedWithout(await outcome(o.start()), 'definitions.builder personality.summary holds a credential this bus holds');
+  const p = org(t, (entry) => ({ ...entry, personality: { summary: 'Careful.', traits: ['plain', `x${SENTINEL}`] } }));
+  refusedWithout(await outcome(p.start()), 'definitions.builder personality.traits[1] holds a credential this bus holds');
+  nothingWritten(o.root);
+  nothingWritten(p.root);
+});
+
+test('org-defscan: a definition in the file but not in the boot copy is checked too', async (t) => {
+  const o = org(t);
+  const boot = o.boot();
+  // Written after the load and before the bus starts: no instance names it, so only the raw read sees it.
+  const doc = JSON.parse(readFileSync(o.file, 'utf8'));
+  doc.definitions.spare = { ...doc.definitions.builder, instructions: `Spare: ${SENTINEL}\n` };
+  writeJson(o.file, doc);
+  refusedWithout(await outcome(o.start(boot)), 'definitions.spare instructions holds a credential this bus holds');
+});
+
+test('org-defscan: a clean file starts, and token-looking text the store does not hold starts', async (t) => {
+  for (const edit of [(entry) => entry, (entry) => ({ ...entry, instructions: `${entry.instructions}\nExample: ${UNHELD}\n`, personality: { summary: `Says ${UNHELD}.` } })]) {
+    const o = org(t, edit);
+    const bus = await o.start();
+    try {
+      // The launch check's question: a clean entry answers null, a held one names the key only.
+      const entry = o.boot().businesses.acme.definitions['org:builder'];
+      assert.deepEqual(bus.definitionScan({ business: 'acme', definition: 'org:builder', entry }), { held: null });
+      const hit = bus.definitionScan({ business: 'acme', definition: 'org:builder', entry: { ...entry, instructions: `x ${SENTINEL}` } });
+      assert.deepEqual(hit, { held: 'instructions' });
+      // A malformed question refuses rather than answering clean.
+      for (const bad of [{}, { business: 'acme', definition: 'builder', entry }, { business: 'other', definition: 'org:builder', entry },
+        { business: 'acme', definition: 'org:builder', entry: null }, { business: 'acme', definition: 'org:builder', entry: [entry] }])
+        assert.throws(() => bus.definitionScan(bad), (e) => e.code === 'invalid-request');
+    } finally {
+      await bus.close();
+    }
+  }
+});
+
+// The coder's gitea credential as the human verb issues or rotates it.
+function verbs(o, bus) {
+  const human = bus.broker.bindHuman({ business: 'acme', human: o.f.doc.human, via: 'cli', outsideAgent: true });
+  return {
+    issue: (token) => bus.broker.request(human, { verb: 'credentials.issue', args: { agent: 'coder', service: 'gitea', token, date: '2099-01-01' } }),
+    revoke: () => bus.broker.request(human, { verb: 'credentials.revoke', args: { agent: 'coder', service: 'gitea', reason: 'test' } }),
+  };
+}
+// Whether the bus holds `value` now, asked the way the launch check asks.
+const holds = (bus, value) => bus.definitionScan({ business: 'acme', definition: 'org:builder', entry: { instructions: `x ${value}` } }).held !== null;
+const state = (bus) => bus.credentials.status().find((e) => e.instance === 'acme/coder' && e.service === 'gitea')?.state;
+
+function issueRefused(e, value, reason) {
+  assert.ok(e instanceof BusError, String(e));
+  assert.equal(e.code, DEFINITION_HOLDS_CREDENTIAL);
+  assert.equal(e.reason, reason);
+  for (const text of [e.message, e.reason, String(e.stack), JSON.stringify(e)]) {
+    assert.ok(!text.includes(value), 'the refusal never carries the value');
+    assert.ok(!/gitea/.test(text), 'the refusal never names the credential');
+  }
+  return true;
+}
+
+// No file under the root holds `value` except the organization file it was written into and that
+// file's own history copies.
+function onlyInOrganization(root, value) {
+  for (const path of files(root))
+    if (!path.endsWith('acme.json') && !path.includes('/businesses/.history/acme/')) assert.ok(!readFileSync(path).includes(value), path);
+}
+
+test('org-defscan: a credential issued between the final launch admission and spawn is refused at issue; the store stays as it was', async (t) => {
+  // The definition carries text that is not held at start. After the launch's final admission answers
+  // ready, the human rotates the coder's token to that text with the same date. On the bus before this
+  // fix the rotate succeeded and the agent spawned with a held value in its contract.
+  const FIRST = 'fake_first_token_0123456789';
+  const o = org(t, (entry) => ({ ...entry, instructions: `${entry.instructions}\nExample ${SENTINEL}\n` }), { held: 'fake_boot_token_5555555555' });
+  const boot = o.boot();
+  const bus = await o.start(boot);
+  t.after(() => bus.close());
+  const v = verbs(o, bus);
+  // A clean issue still works.
+  assert.equal(v.issue(FIRST).state, 'valid');
+  const writer = organizationWriter({ dir: boot.organization.dir, rolesDir: boot.organization.rolesDir, dataRoot: o.f.dataRoot });
+  const revision = writer.read('acme').revision;
+  const changes = files(o.root).filter((p) => p.endsWith('changes.jsonl')).map((p) => [p, readFileSync(p, 'utf8')]);
+  const entry = o.boot().businesses.acme.definitions['org:builder'];
+  assert.deepEqual(bus.definitionScan({ business: 'acme', definition: 'org:builder', entry }), { held: null });
+  const final = () => bus.admission({ business: 'acme', projects: [], instance: 'coder', revision });
+  assert.equal(final().ready, true);
+  // Between the admission's answer and the spawn: the rotate.
+  assert.throws(() => v.issue(SENTINEL), (e) => issueRefused(e, SENTINEL, 'organization acme definitions.builder instructions holds the credential being issued'));
+  // Nothing changed: the old token is held, the new one is not, the file and its receipts are as they were.
+  assert.ok(holds(bus, FIRST) && !holds(bus, SENTINEL));
+  assert.equal(state(bus), 'valid');
+  assert.equal(writer.read('acme').revision, revision);
+  for (const [p, text] of changes) assert.equal(readFileSync(p, 'utf8'), text, p);
+  onlyInOrganization(o.root, SENTINEL);
+  assert.equal(final().ready, true, 'the contract the agent gets holds no held value');
+});
+
+test('org-defscan: issue over a revoked entry refuses the same way for a personality field, and a clean issue then works', async (t) => {
+  const o = org(t, (entry) => ({ ...entry, personality: { summary: 'Careful.', traits: ['plain', `uses ${SENTINEL}`] } }), { held: 'fake_boot_token_5555555555' });
+  const bus = await o.start();
+  t.after(() => bus.close());
+  const v = verbs(o, bus);
+  v.revoke();
+  assert.equal(state(bus), 'revoked');
+  assert.throws(() => v.issue(SENTINEL), (e) => issueRefused(e, SENTINEL, 'organization acme definitions.builder personality.traits[1] holds the credential being issued'));
+  assert.equal(state(bus), 'revoked');
+  assert.ok(!holds(bus, SENTINEL));
+  onlyInOrganization(o.root, SENTINEL);
+  const issued = v.issue('fake_clean_token_4444444444');
+  assert.deepEqual([issued.verb, issued.state], ['issue', 'valid']);
+});
+
+test('org-defscan: a value held without the issue verb still refuses the launch at its final admission, even when the file revision is unchanged', async (t) => {
+  // Defence behind the issue check: the store comes to hold text already in the definition by a path
+  // other than the human verb, which leaves the organization file's bytes, so its revision, as they were.
+  const ROTATED = 'fake_rotated_token_9876543210';
+  const o = org(t, (entry) => ({ ...entry, instructions: `${entry.instructions}\nExample ${ROTATED}\n` }));
+  const boot = o.boot();
+  const bus = await o.start(boot);
+  t.after(() => bus.close());
+  const writer = organizationWriter({ dir: boot.organization.dir, rolesDir: boot.organization.rolesDir, dataRoot: o.f.dataRoot });
+  const revision = writer.read('acme').revision;
+  const final = () => bus.admission({ business: 'acme', projects: [], instance: 'coder', revision });
+  assert.equal(final().ready, true);
+  bus.credentials.issue('acme/coder', 'gitea', ROTATED, '2099-01-01');
+  assert.equal(writer.read('acme').revision, revision, 'the store change left the file as it was');
+  assert.deepEqual(final(), { ready: false, revision: null, code: DEFINITION_HOLDS_CREDENTIAL });
+  // An instance on a shipped template is not asked about a definition.
+  assert.equal(bus.admission({ business: 'acme', projects: [], instance: 'reviewer', revision }).ready, true);
+});
+
+test('org-defscan: issue checks the other organizations the bus serves, and refuses when one\'s file cannot be read', async (t) => {
+  // The bus serves acme and beta. beta's file has a definition holding text acme's coder then tries to
+  // be issued; later beta's file stops being JSON. Neither issue changes acme's store or file.
+  const o = org(t, (entry) => entry, { held: 'fake_boot_token_5555555555' });
+  const boot = o.boot();
+  const betaFile = join(o.root, 'config/businesses/beta.json');
+  const acme = JSON.parse(readFileSync(o.file, 'utf8'));
+  const spare = { ...acme.definitions.builder, personality: { summary: 'Spare.', voice: `quotes ${SENTINEL}` } };
+  writeJson(betaFile, { ...acme, id: 'beta', definitions: { spare } });
+  const bus = await o.start({ ...boot, businesses: { ...boot.businesses, beta: { ...boot.businesses.acme, id: 'beta' } } });
+  t.after(() => bus.close());
+  const v = verbs(o, bus);
+  const writer = organizationWriter({ dir: boot.organization.dir, rolesDir: boot.organization.rolesDir, dataRoot: o.f.dataRoot });
+  const revision = writer.read('acme').revision;
+  assert.throws(() => v.issue(SENTINEL), (e) => issueRefused(e, SENTINEL, 'organization beta definitions.spare personality.voice holds the credential being issued'));
+  writeFileSync(betaFile, '{ not json');
+  const CLEAN = 'fake_clean_token_4444444444';
+  assert.throws(() => v.issue(CLEAN), (e) => e instanceof BusError && e.code === DEFINITION_SCAN_UNREADABLE && !JSON.stringify(e).includes(CLEAN) && !String(e.stack).includes(CLEAN));
+  for (const value of [SENTINEL, CLEAN]) assert.ok(!holds(bus, value));
+  assert.equal(state(bus), 'valid');
+  assert.equal(writer.read('acme').revision, revision);
+  onlyInOrganization(o.root, CLEAN);
+  // With beta's file readable again, the clean issue goes through.
+  writeJson(betaFile, { ...acme, id: 'beta', definitions: {} });
+  assert.equal(v.issue(CLEAN).state, 'valid');
+  assert.ok(holds(bus, CLEAN));
+});
+
+test('org-defscan: the issue check covers every organization the bus serves, and an unreadable file refuses', () => {
+  const held = 'HELD-VALUE-77';
+  const assertClean = (value) => { if ((JSON.stringify(value) ?? '').includes(held)) throw new BusError('credential-leak'); };
+  const own = { id: 'acme', document: { definitions: { builder: { instructions: 'fine' } } } };
+  const files = { beta: { readable: true, document: { definitions: { spare: { instructions: 'fine', personality: { voice: `say ${held}` } } } } },
+    gamma: { readable: true, document: {} }, broken: { readable: false } };
+  const reads = [];
+  const readRaw = (id) => { reads.push(id); if (id === 'throws') throw new Error('EACCES'); return files[id]; };
+  assert.doesNotThrow(() => scanOrganizations({ organizations: ['acme', 'gamma'], own, readRaw }, assertClean));
+  assert.deepEqual(reads, ['gamma'], 'the issuing organization is the document already read');
+  assert.throws(() => scanOrganizations({ organizations: ['acme', 'gamma', 'beta'], own, readRaw }, assertClean),
+    (e) => e.code === DEFINITION_HOLDS_CREDENTIAL && e.reason === 'organization beta definitions.spare personality.voice holds the credential being issued' && !JSON.stringify(e).includes(held));
+  assert.throws(() => scanOrganizations({ organizations: ['acme', { ...own, id: 'x' }.id], own: { id: 'acme', document: { definitions: { [held]: {} } } }, readRaw: () => ({ readable: true, document: {} }) }, assertClean),
+    (e) => e.reason === 'organization acme definitions.* key holds the credential being issued' && !e.reason.includes(held));
+  for (const bad of ['broken', 'throws', 'missing'])
+    assert.throws(() => scanOrganizations({ organizations: ['acme', bad], own, readRaw }, assertClean), (e) => e.code === DEFINITION_SCAN_UNREADABLE && e.reason === undefined);
+});
+
+test('org-defscan: heldPath names the first place, a key by its parent, and never the text', () => {
+  const held = 'HELD-VALUE-77';
+  const assertClean = (value) => { if ((JSON.stringify(value) ?? '').includes(held)) throw new BusError('credential-leak'); };
+  assert.equal(heldPath({ instructions: 'fine', personality: { traits: ['a', 'b'] } }, assertClean), null);
+  assert.equal(heldPath({ instructions: 'fine', personality: { traits: ['a', `b${held}`] } }, assertClean), 'personality.traits[1]');
+  assert.equal(heldPath({ role: { tools: [held] } }, assertClean), 'role.tools[0]');
+  assert.equal(heldPath({ personality: { [held]: 'x' } }, assertClean), 'personality key');
+  assert.equal(heldPath({ [`${held}`]: 'x' }, assertClean), 'key');
+  assert.throws(() => scanDefinitions({ 'org:a': { instructions: 'ok' }, 'org:b': { instructions: held } }, assertClean, { prefix: 'org:' }),
+    (e) => e.code === DEFINITION_HOLDS_CREDENTIAL && e.reason === 'definitions.b instructions holds a credential this bus holds');
+  // A name outside the loader's pattern is not quoted.
+  assert.throws(() => scanDefinitions({ 'Bad Name': { instructions: held } }, assertClean), (e) => e.reason === 'definitions.* instructions holds a credential this bus holds');
+  assert.throws(() => scanDefinitions({ [held]: { instructions: 'ok' } }, assertClean), (e) => e.reason === 'definitions.* key holds a credential this bus holds' && !e.reason.includes(held));
+  assert.doesNotThrow(() => scanDefinitions(undefined, assertClean));
+});
+
+test('org-defscan: an approved hire whose definition holds a credential issued after the raise refuses before the decision is consumed', async (t) => {
+  // The chief raises a hire whose instructions carry text the store does not hold yet. The proposal is
+  // private, so the issue-time check cannot see it, and the store then comes to hold that text. The
+  // approval runs the same definition check as start, launch and issue: the refusal names the code, the
+  // decision stays open, and the organization file is as it was.
+  const LATER = 'fake_later_token_0123456789';
+  const o = org(t, (entry) => entry, { held: 'fake_boot_token_5555555555' });
+  const boot = o.boot();
+  const bus = await o.start(boot);
+  t.after(() => bus.close());
+  const chief = bus.broker.bindLaunch({ business: 'acme', role: 'chief', run: 'chief-run', harness: 'pi' });
+  bus.broker.request(chief, { verb: 'role.claim' });
+  const inline = { tools: ['read'], network: 'none', authority: { withinRole: [], crossRole: [] }, credentials: [], instructions: `Read and report.\nExample ${LATER}\n` };
+  const raised = await bus.broker.request(chief, { verb: 'hire.raise', args: { op: 'hire', level: 'org', name: 'scout', role: { inline }, route: { harness: 'pi', model: 'glm-5.3-flash' }, reason: 'Need help' } });
+  // Issued through the store, so the organization file and its revision stay as they were and the
+  // approval reaches the definition check rather than the revision check.
+  bus.credentials.issue('acme/coder', 'gitea', LATER, '2099-01-01');
+  assert.ok(holds(bus, LATER));
+  const writer = organizationWriter({ dir: boot.organization.dir, rolesDir: boot.organization.rolesDir, dataRoot: o.f.dataRoot });
+  const before = readFileSync(o.file);
+  const revision = writer.read('acme').revision;
+  const owner = bus.broker.bindConsole({ business: 'acme', human: o.f.doc.human, subject: { provider: 'test', iss: 'https://issuer.test', sub: 'owner' } });
+  const refused = (e) => {
+    assert.equal(e.code, DEFINITION_HOLDS_CREDENTIAL);
+    for (const text of [e.message, String(e.reason), String(e.stack), JSON.stringify(e)]) assert.ok(!text.includes(LATER), 'the refusal never carries the value');
+    return true;
+  };
+  await assert.rejects(bus.broker.request(owner, { verb: 'hire.resolve.console', args: { id: raised.id, choice: 'yes', digest: raised.hire.digest } }), refused);
+  // Nothing was written.
+  assert.deepEqual(readFileSync(o.file), before);
+  assert.equal(writer.read('acme').revision, revision);
+  assert.ok(!Object.hasOwn(writer.read('acme').document.roles, 'scout'));
+  // The decision was not consumed: a second approval meets the same check, not decision-closed.
+  await assert.rejects(bus.broker.request(owner, { verb: 'hire.resolve.console', args: { id: raised.id, choice: 'yes', digest: raised.hire.digest } }), refused);
+  assert.deepEqual(readFileSync(o.file), before);
+  // A hire with clean text, raised and approved on the same bus, is written as before.
+  const clean = await bus.broker.request(chief, { verb: 'hire.raise', args: { op: 'hire', level: 'org', name: 'helper', role: { inline: { ...inline, instructions: 'Read and report.\n' } }, route: { harness: 'pi', model: 'glm-5.3-flash' }, reason: 'Need help' } });
+  assert.equal((await bus.broker.request(owner, { verb: 'hire.resolve.console', args: { id: clean.id, choice: 'yes', digest: clean.hire.digest } })).choice, 'yes');
+  assert.ok(Object.hasOwn(writer.read('acme').document.roles, 'helper'));
+  onlyInOrganization(join(o.root, 'config/businesses'), LATER);
+});
+
+test('org-defscan: the boot copy snapshot\'s definitions (the root agents file\'s) are checked at start and at issue', async (t) => {
+  // A4: a root definition reaches an organization through the boot copy snapshot, which every reload
+  // re-applies. Its text is in no organization file, so the start and issue checks read the snapshot.
+  const LATER = 'fake_later_token_0123456789';
+  const snapshot = (instructions) => ({ org: 'acme', root: 'ok', rootAgents: {}, copies: {},
+    definitions: { rooted: { ...entryFromTemplate(readTemplate(REPO_ROLES, 'coder')), instructions } } });
+  const startWith = (o, copies, b = o.boot()) => startBroker({ dataRoot: o.f.dataRoot, businesses: b.businesses, organization: b.organization, copies });
+  // Held at start: the start refuses, naming the snapshot's definition and key.
+  const held = org(t);
+  refusedWithout(await outcome(startWith(held, snapshot(`Root copy ${SENTINEL}\n`))), 'boot copy definitions.rooted instructions holds a credential this bus holds');
+  // Not held at start: the bus starts, then issuing that text refuses and the store is as it was.
+  const o = org(t, (entry) => entry, { held: 'fake_boot_token_5555555555' });
+  const bus = await startWith(o, snapshot(`Root copy ${LATER}\n`));
+  t.after(() => bus.close());
+  assert.throws(() => verbs(o, bus).issue(LATER), (e) => issueRefused(e, LATER, 'organization acme boot copy definitions.rooted instructions holds the credential being issued'));
+  assert.ok(!holds(bus, LATER));
+  assert.equal(state(bus), 'valid');
+  assert.equal(verbs(o, bus).issue('fake_clean_token_4444444444').state, 'valid');
+});
@@ -0,0 +1,74 @@
+// #1873 T1: the definition writes on the bus. Only the business's human at the cli reaches them,
+// and the writer runs the credential store's held-secret check on what it would write.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { appendFileSync, chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { DEFINITION_BUS_KEYS } from '../src/broker.mjs';
+import { startBroker } from '../src/runtime.mjs';
+import { DEFINITION_BUS_VERBS } from '../../organization/src/definition-verbs.mjs';
+import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
+
+const TOKEN = 'fixture-held-token-t1-5c0e9a';
+const SCOUT = { role: { tools: ['read'], network: 'none', authority: { withinRole: [], crossRole: [] }, credentials: [] }, instructions: 'Read and report.\n' };
+
+function files(dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? files(join(dir, e.name)) : e.isFile() ? [join(dir, e.name)] : []);
+}
+
+test('T1 the broker checks the same four definition verbs the runtime maps', () => {
+  assert.deepEqual(Object.keys(DEFINITION_BUS_KEYS).sort(), Object.keys(DEFINITION_BUS_VERBS).sort());
+});
+
+test('T1 definition writes: the human at the cli writes, every other caller refuses, and a held token never lands', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'mosaic-def-bus-'));
+  const rolesDir = rolesCopy(root);
+  const doc = businessDoc(root, 'demo');
+  const file = writeJson(join(root, 'businesses/demo.json'), { ...doc, plugins: { ...doc.plugins, harness: ['pi'] } });
+  const data = join(root, 'data');
+  mkdirSync(data, { mode: 0o700 });
+  const token = join(root, 'held.token');
+  writeFileSync(token, TOKEN, { mode: 0o600 });
+  chmodSync(token, 0o600);
+  const bus = await startBroker({ dataRoot: data, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true }, roles: {
+    chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
+    coder: { authority: { withinRole: [], crossRole: [] }, credentials: { gitea: { file: token, rotateBy: '2099-01-01' } } },
+  } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
+  const b = bus.broker;
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const revision = () => b.request(human, { verb: 'limits' }).revision;
+  const invent = (name) => ({ verb: 'definition.invent', args: { revision: revision(), name, definition: SCOUT } });
+
+  // An agent, a reader and the tester never reach the writer.
+  const before = readFileSync(file);
+  const agent = b.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi', address: 'coder-run' });
+  for (const cap of [agent, b.bindReader({ business: 'demo' })]) assert.throws(() => b.request(cap, invent('scout')), /human-required/);
+  assert.throws(() => b.request(b.bindTester({ business: 'demo' }), invent('scout')), /tester-refused/);
+  // Unknown and missing arguments refuse; an actor can't be forged through them.
+  assert.throws(() => b.request(human, { verb: 'definition.invent', args: { ...invent('scout').args, actor: 'mallory' } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'definition.remove', args: { revision: revision(), name: 'scout' } }), /invalid-request/);
+  assert.deepEqual(readFileSync(file), before);
+
+  // The human's invent commits, as the human, with a receipt that carries no role text.
+  const receipt = b.request(human, invent('scout'));
+  assert.deepEqual({ ...receipt, revision: 0, transaction: 0 }, { verb: 'invent', organization: 'demo', definition: 'scout', rev: 1, revision: 0, transaction: 0 });
+  assert.equal(JSON.parse(readFileSync(file, 'utf8')).definitions.scout.instructions, SCOUT.instructions);
+  const last = JSON.parse(readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').at(-1));
+  assert.equal(last.actor, 'jason');
+  assert.equal(last.state, 'committed');
+  // A writer refusal passes by its code.
+  assert.throws(() => b.request(human, invent('scout')), /definition-exists/);
+
+  // The bus refuses a request that carries the held token, and the writer refuses a template whose
+  // contract carries it (the import request itself holds no token). Neither writes.
+  const written = readFileSync(file);
+  assert.throws(() => b.request(human, { verb: 'definition.invent', args: { revision: revision(), name: 'leak', definition: { ...SCOUT, instructions: `Use ${TOKEN}.\n` } } }),
+    (e) => e.code === 'credential-leak' && !e.message.includes(TOKEN));
+  appendFileSync(join(rolesDir, 'coder.md'), `\nUse ${TOKEN} for the forge.\n`);
+  assert.throws(() => b.request(human, { verb: 'definition.import', args: { revision: revision(), template: 'coder' } }),
+    (e) => e.code === 'invalid-request' && !e.message.includes(TOKEN) && !String(e.stack).includes(TOKEN));
+  assert.deepEqual(readFileSync(file), written);
+  for (const path of [...files(data), ...files(join(root, 'businesses'))]) assert.ok(!readFileSync(path).includes(TOKEN), path);
+});
@@ -38,13 +38,14 @@ export async function fakeGiteaApi(t, dir, { version = '1.27.1', admin = 'mosaic
    issued: [],
    // A user and, with `scopes`, one token named `tokenName`. Returns the user and that token or null.
    addUser(login, { is_admin = false, prohibit_login = false, full_name = login, email = `${login}@example.test`, scopes = null, tokenName = 'test' } = {}) {
-      const u = { id: nextId++, login, email, full_name, is_admin, prohibit_login, tokens: [] };
+      const u = { id: nextId++, login, email, full_name, is_admin, prohibit_login, tokens: [], orgs: [] };
      users.set(lower(login), u);
      return { user: u, token: scopes ? api.addToken(login, tokenName, scopes) : null };
    },
-    addToken(login, name, scopes) {
+    // #1873 CB2: `expires` (an ISO instant) is reported as the token's expires_at.
+    addToken(login, name, scopes, { expires = null } = {}) {
      const u = users.get(lower(login));
-      const tok = { id: nextId++, name, sha1: fakeToken(), scopes: [...scopes].sort() };
+      const tok = { id: nextId++, name, sha1: fakeToken(), scopes: [...scopes].sort(), expires };
      u.tokens.push(tok);
      api.issued.push(tok.sha1);
      return tok;
@@ -96,7 +97,10 @@ export async function fakeGiteaApi(t, dir, { version = '1.27.1', admin = 'mosaic
    if (!who) return [401, { message: 'unauthorized' }];
    const me = who.user;
    if (method === 'GET' && path === '/api/v1/user') return [200, userJson(me)];
-    if (method === 'GET' && path === '/api/v1/token') return [200, { id: who.token.id, name: who.token.name, scopes: who.token.scopes }];
+    // Gitea 1.27 names the token's owner; #1873 CB2's verifier needs it.
+    if (method === 'GET' && path === '/api/v1/token')
+      return [200, { id: who.token.id, name: who.token.name, scopes: who.token.scopes, user: { id: me.id, login: me.login }, ...(who.token.expires ? { expires_at: who.token.expires } : {}) }];
+    if (method === 'GET' && path === '/api/v1/user/orgs') return [200, (me.orgs ?? []).map((name, i) => ({ id: 1000 + i, username: name })), (me.orgs ?? []).length];
    if (method === 'GET' && path === '/api/v1/user/repos') {
      const all = reachable(me);
      const limit = Number(query.get('limit') ?? 30);
@@ -6,6 +6,8 @@
 // keys are real local ssh-keygen pairs in the scratch store, and no ssh connection is made. Decisions a
 // test needs outside the human's yes go in by SQL as fixtures.
 import test from 'node:test';
+import {autonomyHost} from '../src/autonomy-host.mjs';
+import { hireServiceFixture, fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
@@ -74,7 +76,7 @@ function makeBusiness(url) {
  };
 }

-async function setup(t) {
+async function setup(t,autonomy=null) {
  const dir = mkdtempSync(join(tmpdir(), 'g281-'));
  t.after(() => rmSync(dir, { recursive: true, force: true }));
  const gitea = await fakeGiteaApi(t, join(dir, 'tls'));
@@ -156,7 +158,7 @@ async function setup(t) {
    return { revision: REV };
  };
  const make = () =>
-    new Broker({
+    new Broker({hires:hireServiceFixture,autonomy,
      store,
      businesses: { demo: structuredClone(doc) },
      secretCheck: (value) => credentials.assertClean(value),
@@ -184,7 +186,7 @@ async function setup(t) {
    store
      .all("SELECT actor_role, subject, body FROM events WHERE business='demo' AND kind='action.allowed' ORDER BY seq")
      .map((e) => ({ ...e, body: JSON.parse(e.body) }))
-      .filter((e) => e.body.action === action);
+      .filter((e) => e.body.action === action && e.body.operation !== 'decision.raise');
  // The bus's step G messages to the human: no decision, so no grant notice.
  const inbox = () =>
    store.all("SELECT body FROM messages WHERE business='demo' AND from_role='_bus' AND to_role='human' AND decision IS NULL ORDER BY rowid").map((r) => r.body);
@@ -232,7 +234,8 @@ async function setup(t) {
        adminSha256: adminSha256(grantApi.adminMeta('demo') ?? meta),
      },
    });
-  const fire = (name) => call('chief', 'instance.fire', { name, reason: 'the work is done' });
+  const hireConsole=fixtureConsole(broker);
+  const fire = name => approveFixtureFire(broker,hireConsole,name);
  // A delete as the launcher's pass runs it: the human's request, the take, then lifecycleDelete. A
  // refused delete closes the request with its code, as the launcher does.
  const remove = (instance) => {
@@ -304,7 +307,7 @@ function allRevoked(f, hosts = ['web1', 'web2']) {
 test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three', async (t) => {
  const f = await setup(t);
  await threeGrants(f);
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.equal(out.done, false);
  assert.match(out.job, UUID);
  assert.deepEqual(out.revoking, ['host:web1', 'host:web2', 'gitea']);
@@ -313,7 +316,7 @@ test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers
  assert.equal(more.length, 0);
  assert.equal(revoking.body.job, out.job);
  assert.deepEqual(revoking.body.grants, out.revoking);
-  assert.equal(revoking.actor_role, 'chief');
+  assert.equal(revoking.actor_role, null);
  assert.equal(revoking.subject, 'coder');
  await f.broker.grantsIdle();
  // Each host as hosts.revoke records it, with fire: true, line first so the close says removed.
@@ -340,7 +343,7 @@ test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers
  assert.deepEqual(done.body.grants.map((x) => x.grant), ['host:web1', 'host:web2', 'gitea']);
  assert.deepEqual(done.body.grantsLeft, []);
  assert.match(done.body.transaction, /^t-/);
-  assert.equal(done.actor_role, 'chief');
+  assert.equal(done.actor_role, null);
  assert.deepEqual(f.org.log.filter(([op]) => op === 'instance.fire'), [['instance.fire', 'coder']]);
  assert.ok(!f.doc.launch.instances.includes('coder'));
  // No step G message for a job that completed.
@@ -480,7 +483,7 @@ test('row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked
  const f = await setup(t);
  await threeGrants(f);
  f.failing.add('web2');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await f.broker.grantsIdle();
  const [refused, ...more] = f.grantEvents().filter((e) => e.action === 'grant.revoke.refused');
  assert.equal(more.length, 0);
@@ -510,7 +513,7 @@ test('row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked
  assert.equal(f.state('coder', 'gitea'), 'valid');
  // B back: the repeat revokes only B and Gitea.
  f.failing.delete('web2');
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
  assert.deepEqual(repeat.revoking, ['host:web2', 'gitea']);
  await f.broker.grantsIdle();
  const [done] = f.allowed('fire.done');
@@ -529,7 +532,7 @@ test('row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the
  const tag3 = f.tag('coder', 'web3');
  assert.equal(manual.hostLineLeft, tag3);
  f.failing.delete('web3');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['host:web1', 'line:web3']);
  await f.broker.grantsIdle();
  assert.equal(f.lines.web3.has(tag3), false);
@@ -552,7 +555,7 @@ test('row 281 T4b (Q1): with C unreachable, the fire completes and names the lin
  f.failing.add('web3');
  await f.call('human', 'hosts.revoke', { agent: 'coder', host: 'web3', reason: 'web3 is down' });
  const tag3 = f.tag('coder', 'web3');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['host:web1', 'line:web3']);
  await f.broker.grantsIdle();
  assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 0);
@@ -568,7 +571,7 @@ test("row 281 T5: Gitea's admin token can't be checked: the job refuses with the
  const f = await setup(t);
  await f.approveGitea('coder');
  const off = f.gitea.rule((e) => e.method === 'GET' && e.path === '/api/v1/version', { status: 500, json: {} });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['gitea']);
  await f.broker.grantsIdle();
  off();
@@ -597,7 +600,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
  const helperDeletes = () => f.gitea.requests.filter(tokenDelete('demo-helper')).length;
  const before = helperDeletes();
  const offCoder = f.gitea.rule(tokenDelete('demo-coder'), { status: 500, json: {} });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await f.broker.grantsIdle();
  const [refused] = f.grantEvents().filter((e) => e.action === 'grant.revoke.refused');
  assert.equal(refused.grant, 'gitea');
@@ -608,7 +611,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
  assert.equal(f.allowed('fire.done').length, 0);
  // Gitea back for coder only. The helper's DELETE still fails, so a business-wide sweep would show.
  offCoder();
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
  assert.deepEqual(repeat.revoking, ['gitea']);
  await f.broker.grantsIdle();
  const [done] = f.allowed('fire.done');
@@ -627,7 +630,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
 test('row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied', async (t) => {
  const f = await setup(t);
  const id = f.fixtureHost('coder', 'web1');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['host:web1']);
  await f.broker.grantsIdle();
  const [r] = f.revoked('coder', (e) => e.host === 'web1');
@@ -644,7 +647,7 @@ test('row 281 T6 (sage-2574): a host decision approved before the fire and run a
 test('row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write', async (t) => {
  const f = await setup(t);
  const id = f.fixtureGitea('coder');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['gitea']);
  await f.broker.grantsIdle();
  const [r] = f.revoked('coder', (e) => e.method === 'gitea');
@@ -689,7 +692,7 @@ test('row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea ex
  const gd = await f.raiseGitea('coder');
  f.call('human', 'decision.resolve', { id: gd.id, choice: 'yes' });
  await until(() => reached);
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['host:web1', 'gitea']);
  await until(() => f.ended(host.id));
  assert.equal(f.ended(host.id).code, 'revoked');
@@ -714,7 +717,7 @@ test('row 281 T6d (B1): undecided host and Gitea decisions are in the set, and a
  const f = await setup(t);
  const host = await f.raiseHost('coder', 'web1');
  const gd = await f.raiseGitea('coder');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.deepEqual(out.revoking, ['host:web1', 'gitea']);
  await f.broker.grantsIdle();
  assert.equal(f.allowed('fire.done').length, 1);
@@ -736,14 +739,14 @@ test('row 281 T6e (B1): a grant raise refuses instance-fired while firing and af
  await f.approveHost('coder', 'web1');
  // Firing with no job: step B refused, so fire.stopped stands with no fire.done.
  f.org.fireError = Object.assign(new Error('refused'), { code: 'credential-revoke-failed' });
-  f.fire('coder');
+  await f.fire('coder');
  await f.broker.grantsIdle();
  assert.equal(f.allowed('fire.failed').length, 1);
  await rejects(() => f.raiseHost('coder', 'web2'), 'instance-fired');
  await rejects(() => f.raiseGitea('coder'), 'instance-fired');
  // After fire.done: delisted.
  f.org.fireError = null;
-  assert.match(f.fire('coder').transaction, /^t-/);
+  assert.match((await f.fire('coder')).transaction, /^t-/);
  await rejects(() => f.raiseHost('coder', 'web2'), 'instance-fired');
  await rejects(() => f.raiseGitea('coder'), 'instance-fired');
  // A rehire lists the name again.
@@ -761,7 +764,7 @@ test('row 281 T6e (B1): a grant raise refuses instance-fired while firing and af

 test('row 281 T7: an instance with no grant fires as today, synchronously, with the same events', async (t) => {
  const f = await setup(t);
-  const out = f.fire('helper');
+  const out = await f.fire('helper');
  assert.deepEqual(Object.keys(out).sort(), ['cancelled', 'request', 'revision', 'runs', 'taken', 'transaction']);
  assert.match(out.transaction, /^t-/);
  // Recorded before the verb answered: no job.
@@ -781,9 +784,9 @@ test('row 281 T9 (B3): one step G per agent; the manual verbs refuse while it ru
  await f.approveHost('coder', 'web1');
  await f.approveGitea('coder');
  f.held.add('web1:remove');
-  f.fire('coder');
+  await f.fire('coder');
  await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`));
-  assert.equal(code(() => f.fire('coder')), 'fire-in-progress');
+  await assert.rejects(f.fire('coder'),{code:'fire-in-progress'});
  assert.equal(f.remove('coder').code, 'grants-revoking');
  assert.equal(f.allowed('grants.revoking').length, 0);
  assert.equal(f.allowed('fire.revoking').length, 1);
@@ -820,7 +823,7 @@ test('row 281 T10 (B2): the fire and the delete answer while their jobs are held
  // The verbs answer before the event loop turns, so before any part of a job has run.
  let turned = false;
  setImmediate(() => (turned = true));
-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
  const deleted = f.remove('ops');
  assert.equal(turned, false);
  assert.equal(fired.done, false);
@@ -844,7 +847,7 @@ test("row 281 T11 (C1): a fire's job completes after the chief's run ends and pr
  const f = await setup(t);
  await f.approveHost('coder', 'web1');
  f.held.add('web1:remove');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`));
  f.broker.endLaunch({ business: 'demo', run: 'chief-run', reason: 'test' });
  f.sw.state = { version: 1, halted: true, generation: GENERATION };
@@ -855,7 +858,7 @@ test("row 281 T11 (C1): a fire's job completes after the chief's run ends and pr
  assert.match(done.body.transaction, /^t-/);
  const [used, ...more] = f.allowed('role.fire');
  assert.equal(more.length, 0);
-  assert.equal(used.actor_role, 'chief');
+  assert.equal(used.actor_role, null);
  assert.equal(used.body.transaction, done.body.transaction);
  assert.ok(!f.doc.launch.instances.includes('coder'));
  assert.equal(f.allowed('fire.failed').length, 0);
@@ -867,12 +870,12 @@ test("row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the
  await f.approveHost('coder', 'web1');
  // N7: the writer's own credential-revoke-failed, which step G's key revokes can't clear.
  f.org.fireError = Object.assign(new Error('refused'), { code: 'credential-revoke-failed' });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await f.broker.grantsIdle();
  const [failed, ...more] = f.allowed('fire.failed');
  assert.equal(more.length, 0);
  assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'credential-revoke-failed']);
-  assert.equal(failed.actor_role, 'chief');
+  assert.equal(failed.actor_role, null);
  const [message] = f.inbox();
  for (const s of [out.job, 'host:web1', 'step B', 'credential-revoke-failed']) assert.ok(message.includes(s), s);
  assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 0);
@@ -882,7 +885,7 @@ test("row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the
  // The grant was revoked before step B.
  assert.equal(f.hostRow('coder', 'web1'), undefined);
  f.org.fireError = null;
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
  assert.equal(repeat.job, undefined);
  assert.match(repeat.transaction, /^t-/);
  assert.equal(f.allowed('fire.done').length, 1);
@@ -900,7 +903,7 @@ test('row 281 T13 (N4): a restart records each held job interrupted once, with o
  assert.equal(f.allowed('grants.revoked.done').length, 1);
  f.held.add('web1:remove');
  f.held.add('web2:remove');
-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
  assert.equal(f.remove('ops').code, 'grants-revoking');
  const deleteJob = f.allowed('grants.revoking').at(-1).body.job;
  await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`) && f.sent.includes(`remove web2 ${f.tag('ops', 'web2')}`));
@@ -930,7 +933,7 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
  const d = await f.raiseHost('coder', 'web1');
  // N1: hosts.remove doesn't check open decisions, so the decision outlives its host.
  assert.deepEqual(await f.call('human', 'hosts.remove', { host: 'web1' }), { host: 'web1', removed: true });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  assert.match(out.job, UUID);
  assert.deepEqual(out.revoking, ['host:web1']);
  await f.broker.grantsIdle();
@@ -946,7 +949,7 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
  f.call('human', 'decision.resolve', { id: d.id, choice: 'no' });
  await f.broker.grantsIdle();
  assert.equal(f.ended(d.id), undefined);
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
  assert.equal(repeat.job, undefined);
  assert.match(repeat.transaction, /^t-/);
  assert.equal(f.allowed('fire.done').length, 1);
@@ -961,7 +964,7 @@ test("row 239 T4: a refusal after the writer's revoke is named -revoked, in the
  const f = await setup(t);
  await f.approveHost('coder', 'web1');
  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await f.broker.grantsIdle();
  const [failed] = f.allowed('fire.failed');
  assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'revision-conflict-revoked']);
@@ -987,7 +990,7 @@ test("row 239 T4b: an unmarked step B refusal keeps its code, and the notice say
  const f = await setup(t);
  await f.approveHost('coder', 'web1');
  f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
  await f.broker.grantsIdle();
  const [failed] = f.allowed('fire.failed');
  assert.deepEqual([failed.body.job, failed.body.code], [out.job, 'revision-conflict']);
@@ -995,3 +998,24 @@ test("row 239 T4b: an unmarked step B refusal keeps its code, and the notice say
  assert.ok(message.includes('(revision-conflict). The instance is still firing.'), message);
  assert.ok(!message.includes('may already be revoked'), message);
 });
+
+for(const expired of [false,true])test(`AU hire inverse waits for grant removal and refuses late publication (expired: ${expired})`,async t=>{
+ const host=autonomyHost({hires:{reverse:async(id,decision,caller)=>caller.fire({id:decision,level:'org',name:'coder',revision:REV,digest:'a'.repeat(64)})},reload:()=>true});
+ const f=await setup(t,host);await f.approveHost('coder','web1');
+ const decision=grantDecision(f.store,{action:'role.hire',route:'pm',close:{op:'resolved',by:'pm-run',choice:'yes',via:'broker'}});
+ const at=new Date().toISOString(),deadline=new Date(Date.now()+3600000).toISOString();
+ f.store.run("INSERT INTO events(id,at,business,kind,subject,body) VALUES(?,?,?,'action.allowed',?,?)",decision,at,'demo',decision,JSON.stringify({operation:'autonomy.notice',decision,decisionClass:'authority',reverseUntil:deadline}));
+ f.held.add('web1:remove');
+ const owner=fixtureConsole(f.broker),pending=f.broker.request(owner,{verb:'decision.reverse.console',args:{id:decision}});
+ // Attach the rejection handler before letting the asynchronous revoke complete.
+ const outcome=pending.then(value=>({value}),error=>({error}));
+ await until(()=>f.sent.some(s=>s.startsWith('remove web1')));
+ assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,0);assert.ok(f.doc.launch.instances.includes('coder'));
+ const clock=Date.now;
+ try {
+  if(expired)Date.now=()=>Date.parse(deadline)+1;
+  f.held.delete('web1:remove');const result=await outcome;await f.broker.grantsIdle();
+  if(expired){assert.equal(result.error?.code,'reverse-window-closed');assert.ok(f.doc.launch.instances.includes('coder'));}
+  else{assert.equal(result.error,undefined);assert.equal(result.value.committed,true);assert.match(result.value.transaction,/^t-/);assert.equal(f.store.get("SELECT count(*) n FROM events WHERE json_extract(body,'$.operation')='autonomy.reverse'").n,1);assert.ok(!f.doc.launch.instances.includes('coder'));}
+ }finally{Date.now=clock;f.held.clear();}
+});
@@ -0,0 +1,143 @@
+// D3 (P0-4, readiness-1111): an organization on the fixture model provider, with no model proxy
+// configured, changes routes and thinking, takes limits.set and starts a hire. The real catalogue
+// service runs here (no modelCatalogue stand-in), so a fixture-only organization reads ready
+// without a proxy client. A thinking-only change saves while the catalogue is unavailable, a
+// change that needs the proxy still refuses, and removing cliproxy (the Routing page's Disable)
+// makes the next save apply.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { busOrganization } from '../src/organization-context.mjs';
+import { startBroker } from '../src/runtime.mjs';
+import { createModelCatalogue } from '../src/model-catalogue.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { resolveInstance } from '../../organization/src/resolve.mjs';
+import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
+import { FIXTURE_ENTRY, FIXTURE_KEY_NAME } from '../../plugins/model-provider/fixture/index.mjs';
+import { approveTemplateHire } from './hire-fixtures.mjs';
+
+function busForm(root, rolesDir, id = 'demo') {
+  const b = loadBusiness(id, { dir: root, rolesDir });
+  const resolved = {};
+  for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: systemFor(root), business: b, instance });
+  return busOrganization(b, resolved);
+}
+
+async function setup(t, providers = ['fixture'], edit = () => {}) {
+  const root = mkdtempSync(join(tmpdir(), 'd3-fixture-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = businessDoc(root, 'demo');
+  doc.plugins = { harness: ['pi'], 'model-provider': providers };
+  doc.launch.models[FIXTURE_KEY_NAME] = { ...FIXTURE_ENTRY };
+  doc.roles.coder.vars = { harness: 'pi', model: FIXTURE_KEY_NAME, thinking: 'off', 'limits.network': 'none' };
+  // The audit's instance: the assistant on the fixture route.
+  doc.roles.assistant = { definition: 'assistant', vars: { harness: 'pi', model: FIXTURE_KEY_NAME, thinking: 'off' } };
+  edit(doc);
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  // No proxy option: the runtime has no model proxy client and no proxy lock.
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: busForm(root, rolesDir) }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  t.after(() => bus.close());
+  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const ask = (verb, args) => Promise.resolve().then(() => bus.broker.request(human, { verb, args }));
+  const saved = () => JSON.parse(readFileSync(file, 'utf8'));
+  return { root, rolesDir, file, bus, ask, saved };
+}
+const route = (thinking, model = FIXTURE_KEY_NAME) => ({ harness: 'pi', model, thinking, fallback: null });
+// readiness-1111 evidence patch-low.json: `mosaic limits set --file patch-low.json`.
+const patch = (revision, thinking) => ({ revision, assistants: { assistant: { definition: 'assistant', vars: { harness: 'pi', model: FIXTURE_KEY_NAME, thinking }, tracker: null } } });
+
+test('D3 a fixture-only organization with no model proxy reads a ready catalogue and saves a thinking change and a fixture route', async t => {
+  const f = await setup(t);
+  const view = await f.ask('routes');
+  assert.equal(view.catalogue.status, 'ready');
+  assert.deepEqual(view.catalogue.models.map(m => m.key), [FIXTURE_KEY_NAME]);
+  const thinking = await f.ask('routes.set', { revision: view.revision, routes: { coder: route('low') } });
+  assert.ok(thinking.transaction);
+  assert.equal(f.saved().roles.coder.vars.thinking, 'low');
+  // A fixture route change: the reviewer moves onto the fixture model.
+  const moved = await f.ask('routes.set', { revision: thinking.revision, routes: { reviewer: route('off') } });
+  assert.ok(moved.transaction);
+  assert.equal(f.saved().roles.reviewer.vars.model, FIXTURE_KEY_NAME);
+});
+
+test('D3 limits.set takes the audit thinking patch on a fixture-only organization with no model proxy', async t => {
+  const f = await setup(t);
+  const { revision } = await f.ask('limits');
+  const result = await f.ask('limits.set', patch(revision, 'low'));
+  assert.ok(result.transaction);
+  assert.equal(f.saved().roles.assistant.vars.thinking, 'low');
+});
+
+test('D3 hire start on a fixture-only organization with no model proxy writes the hire', async t => {
+  const f = await setup(t);
+  const hired = await approveTemplateHire(f.bus.broker, f.rolesDir, { name: 'sec-1', definition: 'chief-information-security-officer', model: FIXTURE_KEY_NAME });
+  assert.ok(hired.transaction);
+  assert.equal(f.saved().roles['sec-1'].vars.model, FIXTURE_KEY_NAME);
+});
+
+test('D3 with cliproxy enabled and no model proxy, a thinking change saves, a proxy model refuses, and removing cliproxy lets a route change save', async t => {
+  const f = await setup(t, ['fixture', 'cliproxy']);
+  let view = await f.ask('routes');
+  assert.equal(view.catalogue.status, 'unavailable');
+  // Thinking only: same harness, model key and entry, so no catalogue is asked.
+  const thinking = await f.ask('routes.set', { revision: view.revision, routes: { coder: route('low') } });
+  assert.equal(f.saved().roles.coder.vars.thinking, 'low');
+  const limits = await f.ask('limits');
+  await f.ask('limits.set', patch(limits.revision, 'medium'));
+  assert.equal(f.saved().roles.assistant.vars.thinking, 'medium');
+  // A route change truly needs the catalogue, which the absent proxy makes unavailable.
+  const before = readFileSync(f.file, 'utf8');
+  view = await f.ask('routes');
+  await assert.rejects(f.ask('routes.set', { revision: view.revision, routes: { reviewer: route('off') } }), { code: 'model-catalogue-unavailable' });
+  await assert.rejects(f.ask('routes.set', { revision: view.revision, routes: { reviewer: route('off', 'zai-not-offered') } }), { code: 'model-catalogue-unavailable' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.ok(thinking.transaction);
+  // Disable model proxy catalogue: plugins.set without cliproxy.
+  const settings = await f.ask('plugins');
+  await f.ask('plugins.set', { revision: settings.revision, plugins: { 'model-provider': ['fixture'] } });
+  view = await f.ask('routes');
+  assert.equal(view.catalogue.status, 'ready');
+  await f.ask('routes.set', { revision: view.revision, routes: { reviewer: route('off') } });
+  assert.equal(f.saved().roles.reviewer.vars.model, FIXTURE_KEY_NAME);
+});
+
+test('D3 the catalogue asks a module that needs no proxy even with no proxy client, and a module that asks the proxy reads unavailable', async () => {
+  let names = ['fixture'];
+  const service = createModelCatalogue({ client: () => null, settings: () => ({ 'model-provider': names }) });
+  const ready = await service.read('demo', { fresh: true });
+  assert.equal(ready.status, 'ready');
+  assert.deepEqual(ready.models.map(m => [m.key, m.available]), [[FIXTURE_KEY_NAME, true]]);
+  names = ['cliproxy'];
+  assert.equal((await service.read('demo', { fresh: true })).status, 'unavailable');
+  names = ['fixture', 'cliproxy'];
+  const both = await service.read('demo', { fresh: true });
+  assert.equal(both.status, 'unavailable');
+  assert.ok(both.models.every(m => m.available === false));
+});
+
+// D3 review (finding 1): Disable can't make a move between two model-proxy models apply, which is
+// why the Routing page names Disable only for a move onto a model from another listed module.
+test('D3 a move between model-proxy models refuses before and after cliproxy is removed, and writes nothing', async t => {
+  const proxyEntry = model => ({ provider: 'proxy', model, module: 'cliproxy', upstream: 'claude' });
+  const f = await setup(t, ['fixture', 'cliproxy'], doc => {
+    doc.launch.models['claude-a'] = proxyEntry('claude-a');
+    doc.launch.models['claude-b'] = proxyEntry('claude-b');
+    doc.roles.reviewer.vars = { ...doc.roles.reviewer.vars, harness: 'pi', model: 'claude-a', thinking: 'off' };
+  });
+  const before = readFileSync(f.file, 'utf8');
+  let view = await f.ask('routes');
+  await assert.rejects(f.ask('routes.set', { revision: view.revision, routes: { reviewer: route('off', 'claude-b') } }), { code: 'model-catalogue-unavailable' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  const settings = await f.ask('plugins');
+  await f.ask('plugins.set', { revision: settings.revision, plugins: { 'model-provider': ['fixture'] } });
+  const disabled = readFileSync(f.file, 'utf8');
+  view = await f.ask('routes');
+  assert.equal(view.catalogue.status, 'ready');
+  await assert.rejects(f.ask('routes.set', { revision: view.revision, routes: { reviewer: route('off', 'claude-b') } }), { code: 'model-provider-unavailable' });
+  assert.equal(readFileSync(f.file, 'utf8'), disabled);
+  assert.notEqual(disabled, before);
+});
@@ -66,7 +66,7 @@ test('REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for i
    const raise = { action, ...(action === 'role.revoke' ? { target: 'reviewer' } : {}) };
    assert.deepEqual(routed(f, f.raise(raise)), { class: 'gated', route_to: 'human' }, action);
    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f), domain: 'technical' })), { class: 'gated', route_to: action === 'policy.change' ? 'chief' : 'cto' }, action);
-    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f) })), { class: 'gated', route_to: action === 'git.merge.protected' ? 'cto' : 'chief' }, action);
+    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f) })), { class: 'gated', route_to: ['git.merge.protected','prd.approve'].includes(action) ? 'cto' : 'chief' }, action);
  }
 });

@@ -0,0 +1,240 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+
+test('A4 direct instance.hire and instance.fire refuse and cannot write', t => {
+  const root = mkdtempSync(join(tmpdir(), 'a4-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  let writes = 0;
+  const b = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['role.hire','role.fire'], crossRole: [] } } }, launch: { by: 'chief', instances: [] } } }, organization: () => { writes++; } });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  for (const verb of ['instance.hire', 'instance.fire']) assert.throws(() => b.request(chief, { verb, args: { name: 'scout', definition: 'coder', reason: 'Need help' } }), { code: 'decision-required' });
+  assert.equal(writes, 0);
+});
+
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { readFileSync, mkdirSync } from 'node:fs';
+const INLINE = { tools: ['read'], network: 'none', authority: { withinRole: [], crossRole: [] }, credentials: [], instructions: 'Read and report sk-test-NOT-A-SECRET-1234.' };
+const SUBJECT={provider:'test',iss:'https://issuer.test',sub:'owner'};
+function fixture(t) {
+  const root=mkdtempSync(join(tmpdir(),'a4-bus-')), rolesDir=rolesCopy(root);
+  const file=writeJson(join(root,'businesses/demo.json'),{...businessDoc(root,'demo'),plugins:{harness:['pi']}});
+  const storeRoot=join(root,'data');mkdirSync(storeRoot,{mode:0o700});
+  const writer=organizationWriter({dir:root,rolesDir}),store=new Store(storeRoot);
+  const service=hireDecisions({writer,rolesDir,dataRoot:storeRoot,configDir:root,assertClean:()=>{}});
+  const loaded=()=>{const doc=loadBusiness('demo',{dir:root,rolesDir});return {...doc,roles:Object.fromEntries(Object.entries(doc.roles).map(([n,e])=>[n,{...doc.definitions[e.definition],...e}]))};};
+  let writes=0;
+  const b=new Broker({store,businesses:{demo:loaded()},hires:{...service,apply:async(...args)=>{writes++;const r=await service.apply(...args);b.reloadBusiness('demo',loaded());return r;}}});
+  const owner=b.bindConsole({business:'demo',human:'jason',subject:SUBJECT});
+  const member=rights=>b.bindHireConsole({business:'demo',actor:'member',subject:{...SUBJECT,sub:'member'},rights});
+  const caps={owner,chief:b.bindLaunch({business:'demo',role:'chief',run:'chief-run',harness:'pi'}),coder:b.bindLaunch({business:'demo',role:'coder',run:'coder-run',harness:'pi'})};
+  b.request(caps.chief,{verb:'role.claim'});b.request(caps.coder,{verb:'role.claim'});
+  const call=(cap,verb,args={})=>b.request(cap,{verb,args});
+  const request=extra=>({op:'hire',level:'org',name:'scout',role:{inline:INLINE},route:{harness:'pi',model:'claude-opus-5-5'},reason:'Need help',...extra});
+  const raise=extra=>call(caps.chief,'hire.raise',request(extra));
+  t.after(()=>{store.close();rmSync(root,{recursive:true,force:true});});
+  const reloadChief=authority=>{const doc=loaded();doc.roles.chief.authority=authority;b.reloadBusiness('demo',doc);};
+  return {root,rolesDir,b,store,file,writer,service,owner,member,caps,call,request,raise,reloadChief,writes:()=>writes};
+}
+test('A4 only the chief raises; forged flagged lines refuse without a record',async t=>{
+  const {call,caps,request,store}=fixture(t);
+  await assert.rejects(call(caps.coder,'hire.raise',request()),{code:'role-not-chief'});
+  await assert.rejects(call(caps.chief,'hire.raise',request({flagged:[]})),{code:'invalid-request'});
+  assert.equal(store.get('SELECT count(*) n FROM decisions').n,0);
+});
+test('A4 approve is digest bound and consumed once; generic decide never resolves hire, fire or change',async t=>{
+  const {raise,call,owner,writes,store,file,b,caps}=fixture(t);
+  const d=await raise();const p=await call(owner,'hire.preview.console',{id:d.id});
+  assert.ok(!JSON.stringify(p).includes('sk-test-NOT-A-SECRET-1234'));
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:'0'.repeat(64)}),{code:'decision-stale'});
+  for(const action of ['role.hire','role.fire','role.change']) {
+    if(action!==d.action)store.run('INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',action,'2026-01-01T00:00:00.000Z','demo','chief','chief-run','gated',action,'human','Question?',JSON.stringify([{key:'yes',text:'Yes'},{key:'no',text:'No'}]),'no',0);
+    assert.throws(()=>call(owner,'decision.resolve.console',{id:action===d.action?d.id:action,choice:'yes',digest:p.digest}),{code:'hire-resolution-required'});
+    const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+    assert.throws(()=>call(human,'decision.resolve',{id:action===d.action?d.id:action,choice:'yes'}),{code:'hire-resolution-required'});
+  }
+  const before=readFileSync(file);
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest});
+  assert.equal(writes(),1);assert.notDeepEqual(readFileSync(file),before);
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest}),{code:'decision-closed'});
+  assert.equal(writes(),1);
+  for(const row of [...store.all('SELECT * FROM decisions'),...store.all('SELECT * FROM events')])assert.ok(!JSON.stringify(row).includes('sk-test-NOT-A-SECRET-1234'));
+});
+test('A4 denied and expired decisions leave organization bytes untouched',async t=>{
+  const {raise,call,owner,file,writes}=fixture(t);
+  const before=readFileSync(file),d=await raise();
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'no',digest:d.hire.digest});
+  const e=await raise(); const original=Date.now;
+  try{Date.now=()=>original()+8*86400000;await assert.rejects(call(owner,'hire.resolve.console',{id:e.id,choice:'yes',digest:e.hire.digest}),{code:'decision-expired'});}finally{Date.now=original;}
+  assert.deepEqual(readFileSync(file),before);assert.equal(writes(),0);
+});
+test('A4 members with org.hire refuse flagged or credential grants; decide alone refuses all hires',async t=>{
+  const {raise,call,member}=fixture(t);
+  const plain=await raise();
+  await assert.rejects(call(member(['decide']),'hire.resolve.console',{id:plain.id,choice:'yes',digest:plain.hire.digest}),{code:'right-required'});
+  const flagged=await raise({role:{inline:{...INLINE,tools:['read','bash']}}});
+  const credential=await raise({role:{inline:{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  for(const d of [flagged,credential])await assert.rejects(call(member(['org.hire']),'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest}),{code:'hire-owner-required'});
+  await call(member(['org.hire']),'hire.resolve.console',{id:plain.id,choice:'yes',digest:plain.hire.digest});
+});
+test('A4 human Console start raises and resolves one recorded decision with computed lines',async t=>{
+  const {call,owner,request,store,writes}=fixture(t);
+  const r=await call(owner,'hire.start.console',request({role:{inline:{...INLINE,tools:['read','bash']}}}));
+  assert.equal(r.op,'resolved');assert.equal(writes(),1);
+  const event=store.all("SELECT body FROM events WHERE json_extract(body,'$.operation')='decision.raise'").map(e=>JSON.parse(e.body))[0];
+  assert.deepEqual(event.hire.flagged,[{field:'tools',value:'bash',reasons:['above-chief']}]);
+  assert.equal(store.get('SELECT raised_by_role FROM decisions WHERE id=?',r.id).raised_by_role,'human');
+});
+test('A4 a stale organization digest never reaches the writer',async t=>{
+  const {raise,call,owner,writer,file,writes}=fixture(t);
+  const d=await raise(),old=writer.read('demo');
+  writeJson(file,{...old.document,vars:{...old.document.vars,'tracker.pollSeconds':61}});
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest}),{code:'decision-stale'});
+  assert.equal(writes(),0);
+});
+
+test('A4 approved credential role refuses launch until a binding is present',async t=>{
+  const {raise,call,owner,b,caps,writer,file,root,rolesDir}=fixture(t);
+  const d=await raise({role:{inline:{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest});
+  assert.throws(()=>b.request(b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true}),{verb:'instance.launch',args:{instance:'scout'}}),{code:'credential-unbound'});
+  // Binding implementation is outside A4. The existing file shape supplies its metadata here.
+  const doc=writer.read('demo').document;
+  doc.roles.scout.credentials={gitea:{store:true,rotateBy:'2099-01-01'}};
+  writeJson(file,doc);
+  const loaded=loadBusiness('demo',{dir:root,rolesDir});
+  b.reloadBusiness('demo',{...loaded,roles:Object.fromEntries(Object.entries(loaded.roles).map(([n,e])=>[n,{...loaded.definitions[e.definition],...e}]))});
+  assert.doesNotThrow(()=>b.request(b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true}),{verb:'instance.launch',args:{instance:'scout'}}));
+});
+test('A4 refusals and records never carry invalid role text',async t=>{
+  const {raise,store}=fixture(t);
+  await assert.rejects(raise({role:{inline:{...INLINE,authority:{withinRole:['sk-test-NOT-A-SECRET-1234'],crossRole:[]}}}}),e=>{
+    assert.ok(!JSON.stringify(e).includes('sk-test-NOT-A-SECRET-1234'));return true;
+  });
+  assert.ok(!JSON.stringify(store.all('SELECT * FROM events')).includes('sk-test-NOT-A-SECRET-1234'));
+});
+
+test('A4 a human may mark a hire seen, and the chief may withdraw its own proposal',async t=>{
+  const {raise,call,b,caps,writes}=fixture(t),d=await raise();
+  const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+  assert.equal(call(human,'decision.seen',{id:d.id}).op,'seen');
+  assert.equal(call(caps.chief,'decision.withdraw',{id:d.id}).op,'withdrawn');
+  assert.equal(writes(),0);
+});
+
+test('A4 Console previews and consumes only the exact narrowed grants and route',async t=>{
+  const {raise,call,owner,writer,store}=fixture(t);
+  const d=await raise({role:{inline:{...INLINE,tools:['read','bash'],credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  const adjust={role:{tools:['read']},credentials:[],route:{harness:'pi',model:'claude-sonnet-5-5'}};
+  const p=await call(owner,'hire.preview.console',{id:d.id,adjust});
+  assert.notEqual(p.digest,d.hire.digest);assert.deepEqual(p.flagged,[]);assert.deepEqual(p.credentialLines,[]);
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest}),{code:'decision-stale'});
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest,adjust});
+  const doc=writer.read('demo').document,entry=doc.definitions[doc.roles.scout.definition.slice(4)];
+  assert.deepEqual(entry.role.tools,['read']);assert.deepEqual(entry.role.credentials,[]);
+  const consume=JSON.parse(store.get("SELECT body FROM events WHERE json_extract(body,'$.operation')='hire.consume'").body);
+  assert.equal(consume.hire.digest,p.digest);assert.deepEqual(consume.hire.credentialLines,[]);
+});
+
+test('A4 Console lists template hashes without role text, under org.hire',async t=>{
+ const {call,owner,member}=fixture(t);
+ const list=await call(owner,'hire.templates.console');
+ assert.ok(list.templates.some(x=>x.name==='coder'&&/^[a-f0-9]{64}$/.test(x.sha256)));
+ assert.ok(list.templates.every(x=>Object.keys(x).sort().join(',')==='name,sha256'));
+ assert.throws(()=>call(member(['decide']),'hire.templates.console'),{code:'right-required'});
+});
+
+test('A4 chief proposals require current role.hire for hire/change and role.fire for fire',async t=>{
+ const f=fixture(t);
+ f.reloadChief({withinRole:['message.send'],crossRole:[]});
+ for(const op of ['hire','change','fire'])for(const verb of ['hire.raise','decision.raise']) {
+  const hire=f.request({op});
+  await assert.rejects(f.call(f.caps.chief,verb,verb==='decision.raise'?{action:`role.${op}`,hire}:hire),{code:'not-authorized'});
+ }
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+ f.reloadChief({withinRole:['role.hire'],crossRole:[]});
+ assert.ok((await f.raise()).id);
+ assert.ok((await f.raise({op:'change',name:'coder'})).id);
+ const fire={op:'fire',level:'org',name:'coder',reason:'Finished'};
+ await assert.rejects(f.call(f.caps.chief,'hire.raise',fire),{code:'not-authorized'});
+ f.reloadChief({withinRole:['role.fire'],crossRole:[]});
+ assert.ok((await f.call(f.caps.chief,'hire.raise',fire)).id);
+ await assert.rejects(f.raise(),{code:'not-authorized'});
+});
+
+test('A4 chief authority is checked again after asynchronous proposal preparation',async t=>{
+ const f=fixture(t),pending=f.raise();
+ f.reloadChief({withinRole:['message.send'],crossRole:[]});
+ await assert.rejects(pending,{code:'not-authorized'});
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+});
+
+test('A4 a member start needing owner approval refuses before saving a decision',async t=>{
+ const f=fixture(t),cap=f.member(['org.hire']),before=readFileSync(f.file);
+ for(const inline of [{...INLINE,tools:['read','bash']},{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}])
+  await assert.rejects(f.call(cap,'hire.start.console',f.request({role:{inline}})),{code:'hire-owner-required'});
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+ assert.deepEqual(readFileSync(f.file),before);
+ assert.equal((await f.call(cap,'hire.start.console',f.request())).op,'resolved');
+});
+
+test('A4 inbox and decision reads expire unopened hires once without changing configuration',async t=>{
+ const f=fixture(t),d=await f.raise({role:{inline:{...INLINE,tools:['read','bash']}}}),before=readFileSync(f.file);
+ const human=f.b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+ const original=Date.now;
+ try {
+  Date.now=()=>original()+8*86400000;
+  await assert.rejects(f.call(f.member(['org.hire']),'hire.preview.console',{id:d.id}),{code:'decision-expired'});
+  assert.deepEqual(f.call(human,'inbox'),[]);
+  const recent=f.call(human,'decisions',{list:'recent'});
+  assert.equal(recent[0].closed.by,'expiry');
+  const another=await f.raise();
+  Date.now=()=>original()+16*86400000;
+  assert.deepEqual(f.call(human,'inbox'),[]);
+  f.call(human,'decisions',{list:'recent'});
+  assert.equal(f.store.get("SELECT count(*) n FROM decision_events WHERE decision=? AND by='expiry'",another.id).n,1);
+ } finally {Date.now=original;}
+ assert.deepEqual(readFileSync(f.file),before);assert.equal(f.writes(),0);
+});
+test('AU a distinct authority resolver applies a plain near-loop hire, while flagged and credential hires stay human',async t=>{
+  const f=fixture(t),doc=JSON.parse(readFileSync(f.file,'utf8'));
+  doc.definitions={resolver:{rev:1,role:{tools:['read'],network:'none',authority:{withinRole:['decision.resolve.technical','decision.resolve.authority'],crossRole:[]},credentials:[]},instructions:'Resolve independent decisions.'}};
+  doc.roles.cto={definition:'org:resolver'};
+  doc.plugins['limit-check']=['token-limit'];doc.launch.limits={tokens:{providers:{zai:{limit:100000,since:'2026-01-01T00:00:00.000Z'}}}};
+  doc.autonomy={authority:'near the loop',authorityResolver:'cto',notices:true};writeJson(f.file,doc);
+  const live=loadBusiness('demo',{dir:f.root,rolesDir:f.rolesDir});
+  const business={...live,roles:Object.fromEntries(Object.entries(live.roles).map(([n,e])=>[n,{...live.definitions[e.definition],...e}]))};
+  business.roles.cto.authority={withinRole:['decision.resolve.authority'],crossRole:[]};f.b.reloadBusiness('demo',business);
+  const resolver=f.b.bindLaunch({business:'demo',role:'cto',run:'cto-run',harness:'pi'});f.call(resolver,'role.claim');
+  const d=await f.raise();assert.equal(d.route_to,'cto');
+  await assert.rejects(Promise.resolve().then(()=>f.call(f.caps.chief,'decision.resolve',{id:d.id,choice:'yes'})),{code:'not-resolver'});
+  await f.call(resolver,'decision.resolve',{id:d.id,choice:'yes'});
+  assert.equal(f.writes(),1);assert.equal(JSON.parse(readFileSync(f.file)).roles.scout.hireDecision,d.id);
+  for(const change of [{name:'flagged',role:{inline:{...INLINE,tools:['bash']}}},{name:'credential',role:{inline:{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}}}]) {
+    const decision=await f.raise(change);assert.equal(decision.route_to,'human');
+  }
+});
+
+test('AU R5 a change naming the authority resolver stays with a person; no agent resolves itself',async t=>{
+ const f=fixture(t),doc=JSON.parse(readFileSync(f.file,'utf8'));
+ doc.definitions={judge:{rev:1,role:{tools:['read'],network:'none',authority:{withinRole:['decision.resolve.authority'],crossRole:[]},credentials:[]},instructions:'Resolve independent authority decisions.'}};
+ doc.roles.judge={definition:'org:judge',vars:{harness:'pi',model:'claude-opus-5-5'}};
+ doc.plugins['limit-check']=['token-limit'];doc.launch.limits={tokens:{providers:{zai:{limit:100000,since:'2026-01-01T00:00:00.000Z'}}}};
+  doc.autonomy={authority:'near the loop',authorityResolver:'judge',notices:true};writeJson(f.file,doc);
+ const loaded=loadBusiness('demo',{dir:f.root,rolesDir:f.rolesDir});
+ f.b.reloadBusiness('demo',{...loaded,roles:Object.fromEntries(Object.entries(loaded.roles).map(([n,e])=>[n,{...loaded.definitions[e.definition],...e}]))});
+ const judge=f.b.bindLaunch({business:'demo',role:'judge',run:'judge-run',harness:'pi'});f.call(judge,'role.claim');
+ const d=await f.raise({op:'change',name:'judge',role:{inline:{...INLINE,authority:{withinRole:['decision.resolve.authority'],crossRole:[]},instructions:'Narrow this resolver'}}});
+ assert.ok(d.hire.flagged.some(x=>x.value==='decision.resolve.authority'));assert.equal(d.route_to,'human');
+ await assert.rejects(Promise.resolve().then(()=>f.call(judge,'decision.resolve',{id:d.id,choice:'yes'})));
+ assert.equal(f.writes(),0);
+});
@@ -0,0 +1,14 @@
+// Trusted proposal service stand-in for executor-only tests. Authorization and real writers are
+// covered by hire-decisions.test.mjs; these tests isolate the existing grant/fire executors.
+export const hireServiceFixture = {
+  prepare: (_business,args,{id,expiresAt}) => ({id,op:args.op,level:args.level,name:args.name,revision:'b'.repeat(64),flagged:[],credentialLines:[],digest:'a'.repeat(64),expiresAt}),
+  check: () => {},
+};
+export const fixtureConsole = (broker,business='demo') => broker.bindConsole({business,human:'jason',subject:{provider:'test',iss:'https://issuer.test',sub:'owner'}});
+export const approveFixtureFire = async (broker,cap,name) => {const {id,op,choice,...result}=await broker.request(cap,{verb:'hire.start.console',args:{op:'fire',level:'org',name,reason:'The work is done'}});if(result.done===false)delete result.transaction;return result;};
+export const ownerConsole = (broker,business='demo') => broker.bindConsole({business,human:'jason',subject:{provider:'test',iss:'https://issuer.test',sub:'owner'}});
+export async function approveTemplateHire(broker,rolesDir,{business='demo',name,definition,reason='Fixture hire',model='claude-opus-5-5',...extra}) {
+  const {readTemplate}=await import('../../organization/src/definitions.mjs');
+  const source=readTemplate(rolesDir,definition);
+  return broker.request(ownerConsole(broker,business),{verb:'hire.start.console',args:{op:'hire',level:'org',name,role:{template:definition,sha256:source.sha256},route:{harness:'pi',model},reason,...extra}});
+}
@@ -12,15 +12,15 @@ export const HUMAN_YES = { op: 'resolved', by: 'jason', choice: 'yes', via: 'cli

 // A credential.mint decision with `grant` in its raise body. `close` is the decision_events row, or null
 // for an open decision.
-export function grantDecision(store, { business = 'demo', action = 'credential.mint', route = 'human', domain = 'delivery', grant, close = HUMAN_YES }) {
+export function grantDecision(store, { business = 'demo', raiser = 'chief', action = 'credential.mint', route = 'human', domain = 'delivery', grant, close = HUMAN_YES }) {
  const id = randomUUID();
  store.run(
    'INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',
-    id, AT, business, 'chief', 'chief-run', 'gated', action, route, 'Grant?', OPTIONS, 'yes', 0,
+    id, AT, business, raiser, raiser+'-run', 'gated', action, route, 'Grant?', OPTIONS, 'yes', 0,
  );
  store.run(
    "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'action.allowed',?,?,?,?)",
-    randomUUID(), AT, business, 'chief', 'chief-run', id,
+    randomUUID(), AT, business, raiser, raiser+'-run', id,
    JSON.stringify({ decision: id, action, operation: 'decision.raise', ...(domain === null ? {} : { domain }), approvalChoice: 'yes', ...(grant ? { grant } : {}) }),
  );
  if (close)
@@ -6,6 +6,7 @@
 // use fixtures: the evidence and the gitea_grants row go in by SQL, as gitea-grant.test.mjs does for
 // decisions. Tokens are made up or the fake's, and only ever compared.
 import test from 'node:test';
+import { hireServiceFixture, fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 import assert from 'node:assert/strict';
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -68,7 +69,7 @@ function world(t, options) {
  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
  const business = makeBusiness({ ...options, root });
  const held = new Set();
-  const broker = new Broker({ store, businesses: { acme: business }, giteaKeys: { held: (b, a) => held.has(b + '/' + a) } });
+  const broker = new Broker({hires:hireServiceFixture, store, businesses: { acme: business }, giteaKeys: { held: (b, a) => held.has(b + '/' + a) } });
  return { store, business, broker, held, choose: () => broker.libraryFetchCredential('acme') };
 }

@@ -138,7 +139,7 @@ async function verbWorld(t, opts = {}) {
    }
    return { revision: REV };
  };
-  broker = new Broker({
+  broker = new Broker({hires:hireServiceFixture,
    store, businesses: { acme: structuredClone(doc) }, secretCheck: (value) => credentials.assertClean(value), organization,
    processing: { read: () => SWITCH }, giteaGrant: grantApi, giteaKeys: giteaKeys({ credentials, storeRoot }),
  });
@@ -174,7 +175,7 @@ async function verbWorld(t, opts = {}) {
    assert.ok(events().some((e) => e.action === 'grant.revoked' && e.agent === 'chief'));
  };
  const fire = async () => {
-    await broker.request(boss, { verb: 'instance.fire', args: { name: 'chief', reason: 'the work is done' } });
+    await approveFixtureFire(broker,fixtureConsole(broker,'acme'),'chief');
    await until(() => !doc.launch.instances.includes('chief'));
    await broker.grantsIdle();
    assert.equal(row(), undefined, 'the fire\'s step G deleted the row (row 281)');
@@ -196,7 +197,7 @@ test('C2-03b T6: the slot before any chief evidence, then the listed chief\'s li
  assert.deepEqual(w.choose(), { kind: 'slot' }, 'a seat grant is not the chief\'s: the chief entry keeps the fallback');
  grant(w.store, 'chief', { user: 'chief-bot' });
  assert.deepEqual(w.choose(), { kind: 'chief', agent: 'chief', user: 'chief-bot' });
-  assert.deepEqual(new Broker({ store: w.store, businesses: { acme: w.business } }).libraryFetchCredential('acme'), REFUSED,
+  assert.deepEqual(new Broker({hires:hireServiceFixture, store: w.store, businesses: { acme: w.business } }).libraryFetchCredential('acme'), REFUSED,
    'a bus with no grant store refuses rather than guess');
  assert.throws(() => w.broker.libraryFetchCredential('other'), { code: 'unknown-business' });
  assert.equal(LIBRARY_FETCH_FIX, 'add the chief of staff, or grant the library through C2-21');
@@ -1,3 +1,4 @@
+import { fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 // Row 194 (#1692, brief item 8, row 199 D13, T20): fire and delete revoke the agent's credentials
 // after the writer's checks and before the write. Fire revokes each service and keeps the store
 // directory. Delete calls remove (sage-1593). A failed revoke stops the verb with
@@ -54,7 +55,8 @@ async function setup(t, { drop = [], seed = null } = {}) {
  const chief = bus.broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
  bus.broker.request(chief, { verb: 'role.claim' });
  const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  const fire = (name) => bus.broker.request(chief, { verb: 'instance.fire', args: { name, reason: 'the work is done' } });
+  const hireConsole=fixtureConsole(bus.broker);
+  const fire = name => approveFixtureFire(bus.broker,hireConsole,name);
  const agentDir = (agent) => join(root, 'secrets', 'agents', 'demo', agent);
  const plant = (agent, service) => {
    mkdirSync(agentDir(agent), { recursive: true, mode: 0o700 });
@@ -85,12 +87,12 @@ test('T20 fire: a revoke that fails stops the fire with the file unchanged; one
  // The revoke can't unlink the token, so it fails before the write: the file still lists coder.
  const before = f.bytes();
  chmodSync(f.agentDir('coder'), 0o500);
-  assert.equal(f.code(() => f.fire('coder')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('coder'),{code:'credential-revoke-failed'});
  chmodSync(f.agentDir('coder'), 0o700);
  assert.equal(f.bytes(), before);
  assert.ok(JSON.parse(before).launch.instances.includes('coder'));

-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
  assert.equal(fired.delisted, true);
  assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: ['vikunja'] });
  assert.ok(!JSON.parse(f.bytes()).launch.instances.includes('coder'));
@@ -109,7 +111,7 @@ test('T20 fire: an instance already delisted still has its tokens revoked and th
  doc.launch.instances = doc.launch.instances.filter((name) => name !== 'rev-2');
  writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
  const before = f.bytes();
-  const fired = f.fire('rev-2');
+  const fired = await f.fire('rev-2');
  assert.equal(fired.delisted, false);
  assert.equal(fired.transaction, null);
  assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: [] });
@@ -122,10 +124,10 @@ test('T20 fire: with no entry in the running bus, a token on disk refuses and an
  const f = await setup(t, { drop: ['rev-2'] });
  f.plant('rev-2', 'gitea');
  const before = f.bytes();
-  assert.equal(f.code(() => f.fire('rev-2')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('rev-2'),{code:'credential-revoke-failed'});
  assert.equal(f.bytes(), before);
  rmSync(join(f.agentDir('rev-2'), 'gitea'));
-  const fired = f.fire('rev-2');
+  const fired = await f.fire('rev-2');
  assert.equal(fired.delisted, true);
  assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: [] });
 });
@@ -198,11 +200,11 @@ test('row 281 T1 fire: a host.<id> or granted gitea file in the store refuses st
  const f = await setup(t);
  f.plant('coder', 'host.web1');
  const before = f.bytes();
-  assert.equal(f.code(() => f.fire('coder')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('coder'),{code:'credential-revoke-failed'});
  assert.equal(f.bytes(), before);
  assert.deepEqual(readdirSync(f.agentDir('coder')), ['host.web1']);
  rmSync(join(f.agentDir('coder'), 'host.web1'));
-  assert.equal(f.fire('coder').delisted, true);
+  assert.equal((await f.fire('coder')).delisted, true);
 });

 // T1, the start: a host_grants record whose key file is gone (what a delete left before this row). The
@@ -1,3 +1,5 @@
+import {readTemplate} from '../../organization/src/definitions.mjs';
+import { approveTemplateHire, ownerConsole } from './hire-fixtures.mjs';
 // #655 isolated STATIC fixture: actual managed fromSession caller + runtime/writer/controller.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -25,10 +27,10 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
 // Available before any acquired resource/setup can fail; no later f/launcher TDZ.
 const launchLog=()=>{const file=launchLogFile(join(root,'data'),'acme');return fs.existsSync(file)?fs.readFileSync(file,'utf8').trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)):[];};
 t.after(async()=>{const failures=[];for(const g of gates)g.release();try{await waitFor(()=>active.size===0,'owned operations did not settle',5000);}catch{failures.push('owned-operation-close');}for(const close of [...closers].reverse()){try{await close();}catch{failures.push('owned-close');}}try{server?.closeAllConnections();if(server?.listening)await new Promise((resolve,reject)=>server.close(e=>e?reject(e):resolve()));}catch{failures.push('owned-server-close');}try{checkHistory({logs,proxyReceipts,trace});}catch{failures.push('value-free-receipts');}try{checkHistory({launch:launchLog()});}catch{failures.push('owned-launch-log-guard');}if(stderr)process.stderr.write=stderr;try{fs.rmSync(root,{recursive:true,force:true});}catch{failures.push('owned-root-close');}if(failures.length)throw new AggregateError(failures.map(code=>Error(code)),'owned managed fixture cleanup failed');});
- const f=fixture(root,'acme',doc=>{doc.plugins={...doc.plugins,harness:['pi']};for(const role of Object.values(doc.roles))role.vars={...role.vars,harness:'pi'};doc.roles.chief.vars.model='claude-opus-5-5';doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};if(listed)doc.launch.instances.push('aide');if(keep)doc.launch.keep=['aide'];if(retired)doc.retired=['alpha'];if(noHire)doc.launch.noHire=['aide'];return doc;});
+ const f=fixture(root,'acme',doc=>{doc.plugins={...doc.plugins,harness:['pi']};for(const role of Object.values(doc.roles))role.vars={...role.vars,harness:'pi'};doc.roles.chief.vars.model='claude-opus-5-5';doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};if(listed)doc.launch.instances.push('aide');if(keep)doc.launch.keep=['aide'];if(retired)doc.retired=['alpha'];if(noHire)doc.launch.noHire=['aide'];if(!listed)delete doc.roles.aide;return doc;});
 // The established scratch aide pattern only; repository roles/policy stay untouched.
 for(const name of ['aide','helper']){fs.writeFileSync(join(f.roles,name+'.md'),'# Scratch aide\n\n## Authority\n');writeJson(join(f.roles,name+'.json'),{roleVersion:2,name,title:'Aide',contract:name+'.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});}
- const chiefFile=join(f.roles,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide','helper']});
+ const chiefFile=join(f.roles,'chief-of-staff.json');
 const env={PATH:process.env.PATH,HOME:process.env.HOME,TMPDIR:process.env.TMPDIR,MOSAIC_CONFIG:f.config,MOSAIC_ROLES_DIR:f.roles};
 const configDir=join(root,'config'),prefix=`msk-${id(configDir)}-`,sentinel=prefix+'sentinel-'+randomBytes(32).toString('base64url');history.add(sentinel);
 const state={keys:[sentinel],calls:[],refuseProbe,counts:{GET:0,PUT:0,PROBE:0},puts:[],failRemoval:false};
@@ -110,7 +112,7 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
 const file=join(configDir,'businesses','acme.json');
 const hold=(method='GET',ordinal=state.counts[method]+1)=>{let release;const promise=new Promise(r=>{release=r;});const gate={method,ordinal,seen:false,used:false,cancelled:false,promise,release};gates.push(gate);return {ordinal,seen:()=>gate.seen,entered:()=>waitFor(()=>gate.seen,'owned HTTP gate not reached',5000),release,cancel:()=>{gate.cancelled=true;release();}};};
 const outcome=promise=>{const box={settled:false};box.promise=track(Promise.resolve(promise).then(value=>{box.settled=true;box.ok=true;box.value=value;return box;},error=>{box.settled=true;box.ok=false;box.code=error.code??'unexpected-error';return box;}));return box;};
- const hire=(name='aide',extra={},cap=chief)=>{const called={value:false};const box=outcome(Promise.resolve().then(()=>{const operation=bus.broker.request(cap,{verb:'instance.hire',args:{name,definition:'aide',reason:'fixture ownership',...extra}});called.value=true;return operation;}));Object.defineProperty(box,'invoked',{get:()=>called.value});return box;};
+ const hire=(name='aide',extra={},cap=chief)=>{const called={value:false};const box=outcome(Promise.resolve().then(()=>{const operation=(async()=>{const definition=extra.definition??'aide';const d=await bus.broker.request(cap,{verb:'hire.raise',args:{op:'hire',level:'org',name,role:{template:definition,sha256:readTemplate(f.roles,definition).sha256},route:{harness:'pi',model:'claude-opus-5-5'},reason:'fixture ownership',...(extra.vars?{vars:extra.vars}:{})}});return bus.broker.request(ownerConsole(bus.broker,'acme'),{verb:'hire.resolve.console',args:{id:d.id,choice:'yes',digest:d.hire.digest}});})();called.value=true;return operation;}));Object.defineProperty(box,'invoked',{get:()=>called.value});return box;};
 const record=(name='aide')=>bus.credentials.modelRecord('acme/'+name);
 const snapshot=()=>{const journal=join(configDir,'businesses','.history','acme','changes.jsonl');return {membership:id(fs.readFileSync(file)),journal:fs.existsSync(journal)?id(fs.readFileSync(journal)):null,credentials:id(JSON.stringify(bus.credentials.status())),model:record()?id(JSON.stringify(record())):null,remote:id(JSON.stringify(state.keys)),calls:state.calls.length};};
 return {root,f,state,trace,proxyReceipts,logs,launcher,bus,chief,record,hold,outcome,hire,snapshot,file,launchLog,expectedKeyId:()=>expectedKeyId,valueFree,
@@ -123,7 +125,7 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
  assertModelAbsent:name=>{assert.equal(bus.credentials.modelRecord('acme/'+name)===null,true);assert.equal(fs.existsSync(join(configDir,'secrets','agents','acme',name,'model')),false);},
  rotateBound:async()=>{const before=record();bus.credentials.writeModel('acme/aide',{...before,rotateBy:new Date(Date.now()-86400_000).toISOString().slice(0,10)});await waitFor(()=>record()?.retiring.some(r=>r.keyId===before.keyId),'original runtime sweep rotates bound generation');return before.keyId;},
  explicitEnd:()=>bus.broker.request(chief,{verb:'role.revoke',args:{role:'aide',reason:'fixture explicit end'}}),
-  fire:()=>outcome(Promise.resolve().then(()=>bus.broker.request(chief,{verb:'instance.fire',args:{name:'aide',reason:'fixture explicit fire'}}))),
+  fire:()=>outcome(Promise.resolve().then(()=>bus.broker.request(ownerConsole(bus.broker,'acme'),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'aide',reason:'fixture explicit fire'}}))),
  runDirectories:()=>fs.existsSync(runsDir(f.dataRoot,'acme'))?fs.readdirSync(runsDir(f.dataRoot,'acme')).map(name=>join(runsDir(f.dataRoot,'acme'),name)):[],
  sessions:()=>readSessions(f.dataRoot),send:body=>bus.broker.request(human,{verb:'message.send',args:{to:'aide',body,class:'REQUEST'}}),
  reply:sent=>waitFor(()=>bus.broker.request(human,{verb:'message.receive'}).find(m=>m.in_reply_to===sent.id),'real managed reply observed'),
@@ -38,9 +38,8 @@ test('655 actual launch own preflight generation and bound consumer survive conc

 for(const [label,options,args,code] of [
 ['retired name',{retired:true},{name:'alpha'},'organization-instance-retired'],
- ['listed duplicate vars',{}, {vars:{model:'claude-opus-5-5'}},'organization-instance-exists'],
- ['fired mismatched legal definition',{listed:false},{definition:'helper'},'organization-instance-exists'],
- ['fired matching definition with vars',{listed:false},{vars:{model:'claude-opus-5-5'}},'organization-instance-exists'],
+ ['listed duplicate vars',{}, {vars:{model:'claude-opus-5-5'}},'invalid-request'],
+ ['fired matching definition with vars',{listed:false},{vars:{model:'claude-opus-5-5'}},'invalid-request'],
 ])test('655 shared validation '+label+' has no credential effects',{timeout:30000},async t=>{
 const f=await ownershipFixture(t,options),before=f.snapshot(),{name='aide',...extra}=args;await refused(f.hire(name,extra),code);
 assert.deepEqual(f.snapshot(),before,'shared hire refusal precedes credential registration or proxy I/O');f.valueFree();
@@ -49,7 +48,7 @@ for(const [label,options,args,code] of [
 for(const [label,options,extra,code] of [
 ['kept target',{keep:true},{},'instance-kept'],
 ['noHire definition',{noHire:true},{},'definition-not-hireable'],
- ['ineligible definition',{}, {definition:'security-reviewer'},'definition-not-hireable'],
+ ['duplicate with another definition',{}, {definition:'security-reviewer'},'organization-instance-exists'],
 ['invalid vars',{}, {vars:{harness:'pi'}},'invalid-request'],
 ])test('655 existing Broker '+label+' refusal remains before model effects',{timeout:30000},async t=>{
 const f=await ownershipFixture(t,options),before=f.snapshot();await refused(f.hire('aide',extra),code);assert.deepEqual(f.snapshot(),before);f.valueFree();
@@ -59,9 +58,9 @@ test('655 existing nonchief actor refusal remains before shared checks and model
 const f=await ownershipFixture(t),cap=f.wrongActor(),before=f.snapshot();await refused(f.hire('aide',{},cap),'role-not-chief');assert.deepEqual(f.snapshot(),before);f.valueFree();
 });

-test('655 valid fired matching definition rehire publishes before queued acquisition',{timeout:30000},async t=>{
+test('655 valid new hire publishes before queued acquisition',{timeout:30000},async t=>{
 const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();const p=f.preflight();assert.equal(f.listed('aide'),false);
- put.release();await done(h);assert.equal(h.ok,true);assert.equal(typeof h.value.transaction,'string');await done(p);assert.equal(p.ok,true);assert.equal(f.listed('aide'),true);assert.equal(p.value.key===f.record().key,true);assert.equal(await f.healthy(p.value.key),200);f.valueFree();
+ put.release();await done(h);assert.equal(h.ok,true);assert.equal(typeof h.value.transaction,'string');await done(p);assert.equal(p.code,'unknown-role','no admission before membership publication');assert.equal(f.listed('aide'),true);const admitted=await done(f.preflight());assert.equal(admitted.ok,true);assert.equal(admitted.value.key===f.record().key,true);assert.equal(await f.healthy(admitted.value.key),200);f.valueFree();
 });

 test('655 preexisting admitted generation and retiring metadata survive duplicate failure',{skip:unavailable,timeout:30000},async t=>{
@@ -74,22 +73,22 @@ test('655 captured revision is checked after controller queue before generation
 const f=await ownershipFixture(t),gate=f.hold('GET'),p=f.preflight('chief');await gate.entered();const h=f.hire('alpha');
 // A following same-business operation proves H established its pending slot,
 // rather than an arbitrary sleep before the external owner revision change.
- await refused(f.hire('beta'),'organization-busy');f.bumpRevision();gate.release();await done(p);assert.equal(p.ok,true);await refused(h,'revision-conflict');
+ await refused(f.hire('beta'),'organization-busy');f.bumpRevision();gate.release();await done(p);assert.equal(p.ok,true);await refused(h,'decision-stale');
 assert.equal(f.state.counts.PUT,1,'queued stale hire does not issue a generation');f.assertModelAbsent('alpha');assert.equal(f.listed('alpha'),false);f.valueFree();
 });

 test('655 genuine new generation revision failure cleans before queued acquisition receives a key',{timeout:30000},async t=>{
 const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();
 const failedGeneration=f.state.puts[0].find(k=>!k.includes('-sentinel-'));assert.ok(failedGeneration,'real first issuance payload observed');
- const p=f.preflight();f.bumpRevision();put.release();await refused(h,'revision-conflict');await done(p);
- const valid=p.ok&&p.value.key!==failedGeneration&&f.record()?.key===p.value.key&&f.state.keys.includes(p.value.key)&&!f.state.keys.includes(failedGeneration);
- assert.equal(valid,true,'queued acquisition receives a valid post-cleanup generation');assert.equal(f.listed('aide'),false);assert.equal(await f.healthy(p.value.key),200);f.valueFree();
+ const p=f.preflight();f.bumpRevision();put.release();await refused(h,'decision-stale');await done(p);
+ assert.equal(p.code,'unknown-role','an unpublished agent cannot acquire a model key');
+ assert.equal(f.state.keys.includes(failedGeneration),false,'failed generation was removed');f.assertModelAbsent('aide');assert.equal(f.listed('aide'),false);f.valueFree();
 });

 test('655 failed cleanup retains revoking intent and refuses queued admission',{timeout:30000},async t=>{
 const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();const p=f.preflight();f.bumpRevision();f.state.failRemoval=true;put.release();
- await refused(h,'revision-conflict');await done(p);assert.equal(f.record()?.state,'revoking','failed removal keeps durable nonlaunchable intent');
- assert.equal(!p.ok&&p.code==='proxy-key-revoking',true,'queued admission refuses retained revoking intent');assert.equal(f.listed('aide'),false);assert.equal(fs.existsSync(join(f.root,'config','secrets','agents','acme','aide','model')),true);f.valueFree();
+ await refused(h,'decision-stale');await done(p);assert.equal(f.record()?.state,'revoking','failed removal keeps durable nonlaunchable intent');
+ assert.equal(!p.ok&&p.code==='unknown-role',true,'unpublished membership refuses admission while model record retains revoking intent');assert.equal(f.listed('aide'),false);assert.equal(fs.existsSync(join(f.root,'config','secrets','agents','acme','aide','model')),true);f.valueFree();
 });

 test('655 no-launch remains before own preflight and grants no consumer or stop authority',{timeout:30000},async t=>{
@@ -1,3 +1,6 @@
+import {materializeCopies,withCopies} from '../../organization/src/agent-copies.mjs';
+import {loadRootAgents} from '../../organization/src/agent-levels.mjs';
+import { approveTemplateHire, ownerConsole } from './hire-fixtures.mjs';
 // P2: real private Credentials, fake loopback management/model server. No live config.
 import test from 'node:test';
 import assert from 'node:assert/strict';
@@ -173,7 +176,7 @@ test('proxy-stop-failed: old proxy key and retiring record survive a failed grac
  stopped = true; await overdue.sweep(); assert.equal(f.state.keys.includes(first.key), false);
 });

-async function bootBusiness(f, binding = {}) {
+async function bootBusiness(f, {copyLevel = null,...binding} = {}) {
  const rolesDir = rolesCopy(f.root), system = systemFor(f.root), doc = businessDoc(f.root, 'demo');
  // Aide is needed because shipped chief hireable:[] and security-reviewer has review.verdict outside HIRE_ALLOWED.
  fs.writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
@@ -181,23 +184,26 @@ async function bootBusiness(f, binding = {}) {
    roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
    authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],
  });
-  const chiefFile = join(rolesDir, 'chief-of-staff.json');
-  writeJson(chiefFile, { ...JSON.parse(fs.readFileSync(chiefFile, 'utf8')), hireable: ['aide'] });
+
  doc.plugins = { ...doc.plugins, harness: ['pi'] };
  doc.roles['sec-1'] = { definition: 'security-reviewer' }; doc.launch.instances.push('sec-1');
+  const copyEntry={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5'}};
+  if(copyLevel==='project')doc.projects.stack.agents={aide:copyEntry};
+  if(copyLevel==='root')writeJson(join(f.configDir,'agents.json'),{agentsVersion:1,agents:{aide:copyEntry}});
+  const copies=copyLevel?materializeCopies({orgId:'demo',doc,rolesDir,root:loadRootAgents(f.configDir,{rolesDir})}):null;
  const file = writeJson(join(f.configDir, 'businesses', 'demo.json'), doc);
  fs.writeFileSync(join(f.configDir, 'secrets', 'proxy-management.key'), 'fx331-manage', { mode: 0o600 });
-  const business = loadBusiness('demo', { dir: f.configDir, rolesDir }), resolved = {};
+  const business = copies?withCopies(doc,file,{rolesDir,snapshot:copies}):loadBusiness('demo', { dir: f.configDir, rolesDir }), resolved = {};
  for (const instance of Object.keys(business.roles)) resolved[instance] = resolveInstance({ system, business, instance });
  fs.mkdirSync(join(f.root, 'data'), { mode: 0o700 });
  // Fresh mkdtemp fixture + exclusive mkdir above: no prior session registry can exist.
  new Registry(join(f.root, 'data'));
  const bus = await startBroker({ dataRoot: join(f.root, 'data'), businesses: { demo: busOrganization(business, resolved) },
-    organization: { dir: f.configDir, rolesDir, system }, proxy: { port: Number(new URL(f.baseUrl).port), binary: '/fixture-unused' }, ...binding });
+    copies, organization: { dir: f.configDir, rolesDir, system }, proxy: { port: Number(new URL(f.baseUrl).port), binary: '/fixture-unused' }, ...binding });
  f.closers.push(() => bus.close());
  const chief = bus.broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
  bus.broker.request(chief, { verb: 'role.claim' });
-  const fire = () => bus.broker.request(chief, { verb: 'instance.fire', args: { name: 'sec-1', reason: 'fixture fire' } });
+  const fire = () => bus.broker.request(ownerConsole(bus.broker), { verb: 'hire.start.console', args: { op:'fire',level:'org',name: 'sec-1', reason: 'fixture fire' } });
  const listed = () => JSON.parse(fs.readFileSync(file, 'utf8')).launch.instances.includes('sec-1');
  return { bus, chief, fire, listed, file, rolesDir, system };
 }
@@ -233,7 +239,7 @@ test('proxy-revoke-revision-conflict: racing organization write keeps record, ne
 });
 test('bus hire issues and confirms implicit model key before publishing new membership', async t => {
  const f = await fixture(t); const b = await bootBusiness(f); const calls = f.state.calls.length;
-  const result = await b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } });
+  const result = await approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'});
  assert.equal(typeof result.transaction, 'string');
  assert.equal(JSON.parse(fs.readFileSync(b.file, 'utf8')).launch.instances.includes('sec-new'), true);
  assert.equal(b.bus.credentials.modelRecord('demo/sec-new')?.state, 'valid');
@@ -242,7 +248,7 @@ test('bus hire issues and confirms implicit model key before publishing new memb
 test('proxy-key-issue-failed: bus hire failure publishes neither membership nor model file', async t => {
  const f = await fixture(t); const b = await bootBusiness(f); f.state.failPut = true;
  const before = fs.readFileSync(b.file, 'utf8');
-  await assert.rejects(b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } }), failCode('proxy-key-issue-failed'));
+  await assert.rejects(approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'}), failCode('proxy-key-issue-failed'));
  assert.equal(fs.readFileSync(b.file, 'utf8'), before); assert.equal(b.bus.credentials.modelRecord('demo/sec-new') === null, true);
 });
 test('proxy-open: removing sentinel after boot refuses the next launch before models probe', async t => {
@@ -252,7 +258,7 @@ test('proxy-open: removing sentinel after boot refuses the next launch before mo
 });
 test('newly hired role can use runtime preflight without a broker restart', async t => {
  const f = await fixture(t); const b = await bootBusiness(f);
-  await b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } });
+  await approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'});
  const proxy = await b.bus.modelPreflight({ business: 'demo', role: 'sec-new' });
  assert.equal(proxy.baseUrl, f.baseUrl); assert.equal(f.state.keys.includes(proxy.key), true);
 });
@@ -328,3 +334,22 @@ test('beta bus registers while alpha bus runs and alpha key stays accepted', asy
  assert.ok(f.state.keys.some(value => value.startsWith(`mso-${hash(f.configDir)}-beta-sentinel-`)));
  assert.equal((await alpha.bus.modelPreflight({ business: 'demo', role: 'sec-1' })).key, key);
 });
+
+for(const level of ['root','project'])test(`A4 ${level} fire removes its implicit model key before publication`,async t=>{
+  const f=await fixture(t),b=await bootBusiness(f,{copyLevel:level});
+  const instance=level==='root'?'aide':'aide.stack';
+  const issued=await b.bus.modelPreflight({business:'demo',role:instance});
+  assert.ok(issued.key);
+  await b.bus.broker.request(ownerConsole(b.bus.broker),{verb:'hire.start.console',args:{op:'fire',level,...(level==='project'?{project:'stack'}:{}),name:'aide',reason:'Copy work finished'}});
+  assert.equal(f.state.keys.includes(issued.key),false,'remote generation is revoked');
+  assert.equal(b.bus.credentials.modelRecord('demo/'+instance),null,'private generation is removed');
+  const human=b.bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+  assert.throws(()=>b.bus.broker.request(human,{verb:'instance.launch',args:{instance}}));
+});
+
+test('AU resolver guard runs inside the model revocation queue before any remote or local effect',async t=>{
+ const f=await fixture(t);await f.manager.reconcile();await f.manager.ensure('demo/coder');
+ const before=f.credentials.modelRecord('demo/coder'),calls=f.state.calls.length;
+ await assert.rejects(f.manager.prepareRevoke('demo/coder',()=>{throw Object.assign(new Error('not-resolver'),{code:'not-resolver'});}),{code:'not-resolver'});
+ assert.deepEqual(f.credentials.modelRecord('demo/coder'),before);assert.equal(f.state.calls.length,calls);
+});
@@ -1,3 +1,4 @@
+import { approveTemplateHire } from './hire-fixtures.mjs';
 // #651 actual runtime + organization.hire publication with orphan private records.
 // In-process trusted Broker, real SQLite/organization writer/HTTP; not process IPC.
 import test from 'node:test';
@@ -16,7 +17,7 @@ async function hireFixture(t,{revoking=false}={}){
 const rolesDir=rolesCopy(f.root),system=systemFor(f.root),doc=businessDoc(f.root,'demo');
 // Scratch aide: shipped chief hireable:[] and review.verdict is outside HIRE_ALLOWED.
 fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
- const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});doc.plugins={...doc.plugins,harness:['pi']};
+ const chiefFile=join(rolesDir,'chief-of-staff.json');doc.plugins={...doc.plugins,harness:['pi']};
 const file=writeJson(join(f.configDir,'businesses','demo.json'),doc);fs.writeFileSync(join(f.configDir,'secrets','proxy-management.key'),'fx651-manage',{mode:0o600});
 const business=loadBusiness('demo',{dir:f.configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});
 const dataRoot=join(f.root,'data');fs.mkdirSync(dataRoot,{mode:0o700});
@@ -27,7 +28,7 @@ async function hireFixture(t,{revoking=false}={}){
 assert.equal(f.state.keys.includes(issued.key),false,'runtime boot reconciled omitted orphan');assert.equal(bus.credentials.modelRecord('demo/orphan')===null,true,'orphan remains unregistered before hire');
 const cap=bus.broker.bindLaunch({business:'demo',role:'chief',run:'orphan-hire-chief',harness:'pi'});bus.broker.request(cap,{verb:'role.claim'});
 const listed=()=>JSON.parse(fs.readFileSync(file,'utf8')).launch.instances.includes('orphan'),observed=[];f.state.observePut=()=>observed.push(listed());f.state.calls=[];
- const hire=()=>bus.broker.request(cap,{verb:'instance.hire',args:{name:'orphan',definition:'aide',reason:'fixture orphan hire'}});
+ const hire=()=>approveTemplateHire(bus.broker,rolesDir,{name:'orphan',definition:'aide'});
 return {...f,bus,issued,file,log,listed,observed,hire};
 }
 test('L3b runtime hire publishes orphan only after fresh remote confirmation',async t=>{
@@ -1,3 +1,5 @@
+import { readTemplate } from '../../organization/src/definitions.mjs';
+import { ownerConsole } from './hire-fixtures.mjs';
 // #654 isolated real runtime/writer/controller with owned HTTP request gates.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -22,7 +24,7 @@ export async function pendingFixture(t,{twoBusinesses=false}={}){
 const configDir=join(root,'config'),dataRoot=join(root,'data'),rolesDir=rolesCopy(root),system=systemFor(root);fs.mkdirSync(dataRoot,{mode:0o700});
 const doc=businessDoc(root,'demo');doc.plugins={...doc.plugins,harness:['pi']};
 // Existing row331 scratch aide pattern only; repository role authority unchanged.
- fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});
+ fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
 const ids=twoBusinesses?['demo','other']:['demo'],files={},businesses={};for(const name of ids){const document={...structuredClone(doc),id:name};files[name]=writeJson(join(configDir,'businesses',name+'.json'),document);const business=loadBusiness(name,{dir:configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});businesses[name]=busOrganization(business,resolved);}
 fs.mkdirSync(join(configDir,'secrets'),{recursive:true,mode:0o700});fs.writeFileSync(join(configDir,'secrets','proxy-management.key'),'fx654-manage',{mode:0o600});fs.mkdirSync(join(dataRoot,'bus-host'),{recursive:true,mode:0o700});writeJson(sessionsFile(dataRoot),{sessionsVersion:SESSIONS_VERSION,sessions:[]});
 const sentinel=`msk-${hash(configDir).slice(0,12)}-sentinel-${randomBytes(32).toString('base64url')}`;state.keys.push(sentinel);history.add(sentinel);
@@ -44,7 +46,7 @@ export async function pendingFixture(t,{twoBusinesses=false}={}){
 const holdNext=(method='GET')=>{assert.equal(state.nextGate,null,'only one owned HTTP hold armed');const g={method,entered:deferred(),release:deferred()};gates.push(g);state.nextGate=g;return {entered:()=>bounded(g.entered.promise,'owned lifecycle HTTP boundary not observed'),release:()=>g.release.resolve()};};
 const listed=(business,name)=>JSON.parse(fs.readFileSync(files[business],'utf8')).launch.instances.includes(name);
 const snapshot=business=>{const journal=join(configDir,'businesses','.history',business,'changes.jsonl');return {membership:hash(fs.readFileSync(files[business])),publicationJournal:fs.existsSync(journal)?hash(fs.readFileSync(journal)):null,modelStatus:hash(JSON.stringify(bus.credentials.status())),remote:hash(JSON.stringify(state.keys)),calls:state.calls.length};};
- const hire=(business,name,definition='aide',cap=chief[business])=>track(Promise.resolve().then(()=>bus.broker.request(cap,{verb:'instance.hire',args:{name,definition,reason:'fixture pending hire'}})));
+ const hire=(business,name,definition='aide',cap=chief[business])=>track(Promise.resolve().then(()=>(async()=>{const d=await bus.broker.request(cap,{verb:'hire.raise',args:{op:'hire',level:'org',name,role:{template:definition,sha256:readTemplate(rolesDir,definition).sha256},route:{harness:'pi',model:'claude-opus-5-5'},reason:'fixture pending hire'}});return bus.broker.request(ownerConsole(bus.broker,business),{verb:'hire.resolve.console',args:{id:d.id,digest:d.hire.digest,choice:'yes'}});})()));
 const busy=async promise=>{const result=await bounded(promise.then(()=>({code:'unexpected-success'}),e=>({code:e.code??'unexpected-error'})),'same-business refusal not observed');assert.equal(result.code,'organization-busy','second same-business lifecycle call refuses exact pending code');};
 return {root,configDir,dataRoot,rolesDir,bus,state,receipts,chief,holdNext,listed,snapshot,hire,busy,valueFree,
  healthy:async(business,name)=>{const value=await bus.modelPreflight({business,role:name});const record=bus.credentials.modelRecord(business+'/'+name);assert.equal(value.key===record.key,true);assert.equal(state.keys.includes(record.key),true,'published member retains confirmed model credential');},
@@ -1,3 +1,4 @@
+import {ownerConsole} from './hire-fixtures.mjs';
 // #656 STATIC isolated fixtures. No real config/key/proxy; no production seam.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -74,7 +75,7 @@ export async function revocationFixture(t,{runtime=false,onRoot=()=>{},missingBo
 syncBuiltinESMExports();restoreFs=()=>{Object.assign(fs,original);syncBuiltinESMExports();};
 const record=()=>c.modelRecord(instance),exists=path=>{try{original.lstatSync(path);return true;}catch(error){if(error.code==='ENOENT')return false;throw error;}};
 const seed=({matchingTmp=true,retiring=0,valid=false}={})=>{const current=key(),old=Array.from({length:retiring},()=>({key:key(),issuedAt:'2026-10-23T00:00:00.000Z',retireAt:'2099-01-01T00:00:00.000Z'})).map(r=>({...r,keyId:id(r.key)}));const value={key:current,keyId:id(current),issuedAt:'2026-10-24T00:00:00.000Z',rotateBy:'2099-01-01',state:valid?'valid':'revoking',...(valid?{}:{revokingAt:'2026-10-25T00:00:00.000Z'}),retiring:old};state.keys.push(current,...old.map(r=>r.key));c.writeModel(instance,value);if(matchingTmp){fs.copyFileSync(file,temporary);fs.chmodSync(temporary,0o600);}removedTmp=false;return value;};
- const lifecycle=how=>track((async()=>{if(how==='fire')return await bus.broker.request(chief,{verb:'instance.fire',args:{name:'aide',reason:'fixture recognized tmp'}});const revision=writer.read('demo').revision;const request=bus.broker.request(human,{verb:'instances.set',args:{revision,instance:'aide',op:'delete'}});const route={business:'demo',request:request.request},take=bus.lifecycleTake(route);assert.equal(take.go,true,'real trusted delete request is taken');try{const result=await bus.lifecycleDelete(route);bus.lifecycleDone({...route,transaction:result.transaction});return result;}catch(error){bus.lifecycleDone({...route,refusal:error.code??'outcome-unknown'});throw error;}})());
+ const lifecycle=how=>track((async()=>{if(how==='fire')return await bus.broker.request(ownerConsole(bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'aide',reason:'fixture recognized tmp'}});const revision=writer.read('demo').revision;const request=bus.broker.request(human,{verb:'instances.set',args:{revision,instance:'aide',op:'delete'}});const route={business:'demo',request:request.request},take=bus.lifecycleTake(route);assert.equal(take.go,true,'real trusted delete request is taken');try{const result=await bus.lifecycleDelete(route);bus.lifecycleDone({...route,transaction:result.transaction});return result;}catch(error){bus.lifecycleDone({...route,refusal:error.code??'outcome-unknown'});throw error;}})());
 const writeSessions=entries=>writeJson(sessionsFile(dataRoot),{sessionsVersion:SESSIONS_VERSION,sessions:entries});
 const ownRun=async({wrongTicks=false,wrongKey=false,publish=true}={})=>{
  const spawnOwn=async()=>{const handle=spawn('/usr/bin/sleep',['60'],{stdio:'ignore'}),closed=new Promise(resolve=>handle.once('close',resolve));const owned={handle,closed};children.push(owned);await once(handle,'spawn');const ticks=startTimeOf(handle.pid);assert.equal(typeof ticks,'string');return {...owned,ticks,exit:async()=>{if(handle.exitCode===null&&handle.signalCode===null)handle.kill('SIGTERM');await bounded(closed,'owned stand-in exit timeout');}};};
@@ -12,6 +12,8 @@ import { fixture } from './spec-fixtures.mjs';
 test('Broker keeps the sandbox client import closure: only the listed imports, no lazy project import', () => {
  const source = readFileSync(new URL('../src/broker.mjs', import.meta.url), 'utf8');
  assert.deepEqual([...source.matchAll(/^import .*;$/gm)].map(m => m[0]), [
+    "import { autonomyEvent, decisionResolution } from './autonomy-state.mjs';",
+    "import { autonomyClass, authorityBudgetCovered, checkAutonomy, decisionAutonomy, resolverSubject } from '../../organization/src/autonomy.mjs';",
    // Rows330/331: pure verb/refusal vocabulary, never the host management implementation.
    "import { ownRails } from '../../organization/src/rails.mjs';",
    "import { refusalGuidance } from './refusals.mjs';",
@@ -41,11 +43,12 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
    // Row 236 (#1742, #436b) reads giteaName and parseGiteaUrl for the Gitea grant path.
    // FED R3 r5 (row 274, #414) reads covers, a user's grant check, from it.
    // Row 219 reads THREAD_DEFINITIONS from the same vocabulary for creative thread admission.
-    "import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';",
+    "import { pluginName, ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';",
  ]);
  assert.doesNotMatch(source, /\bimport\s*\(/);
  assert.doesNotMatch(readFileSync(new URL('../src/proxy-page-vocabulary.mjs', import.meta.url), 'utf8'), /\bimport\b/);
-  assert.doesNotMatch(readFileSync(new URL('../src/landing.mjs', import.meta.url), 'utf8'), /\bimport\b/);
+  assert.doesNotMatch(readFileSync(new URL('../src/autonomy-state.mjs', import.meta.url), 'utf8'), /\bimport\b/);
+  assert.doesNotMatch(readFileSync(new URL('../../organization/src/autonomy.mjs', import.meta.url), 'utf8'), /\bimport\b/);
  assert.doesNotMatch(readFileSync(new URL('../../organization/src/vocabulary.mjs', import.meta.url), 'utf8'), /\bimport\b/);
  assert.doesNotMatch(readFileSync(new URL('../../plugins/src/kinds.mjs', import.meta.url), 'utf8'), /\bimport\b/);
 });
@@ -0,0 +1,109 @@
+// #1873 bus side of the Console proxy setup: proxy.init with a bus-generated key, the owner-only
+// proxy.fence.clear verb, and a lock clear that re-proves restart evidence before it clears.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { createProxyLock } from '../src/proxy-lock.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { validManagementKey } from '../../model-proxy/src/common.mjs';
+
+const role = { authority: { withinRole: ['message.send'], crossRole: [] } };
+const code = name => error => error.code === name;
+function fixture(t, { proxyInit = null, proxyFenceClear = null } = {}) {
+  const store = new Store(fs.mkdtempSync(join(tmpdir(), 'ps-bus-')));
+  t.after(() => store.close());
+  const b = new Broker({ store, proxyInit, proxyFenceClear, businesses: { demo: { id: 'demo', human: 'owner', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true }, roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder: role } } } });
+  return {
+    store, b,
+    human: b.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true }),
+    tester: b.bindTester({ business: 'demo' }), reader: b.bindReader({ business: 'demo' }),
+    agent: b.bindLaunch({ business: 'demo', role: 'coder', run: 'ps-run', harness: 'pi' }),
+  };
+}
+const events = store => JSON.stringify(store.all('SELECT body FROM events'));
+const bodies = store => store.all('SELECT body FROM events').map(r => JSON.parse(r.body));
+
+test('proxy.init generate:true makes a valid key on the bus, hands it only to init, and never returns or records it', async t => {
+  const seen = [];
+  const f = fixture(t, { proxyInit: async args => { seen.push(args); return { port: args.port ?? 18432, binary: '/fixture' }; } });
+  const result = await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true, port: 18440, rotateGraceMinutes: 5 } });
+  assert.deepEqual(result, { port: 18440, binary: '/fixture' });
+  assert.equal(seen.length, 1);
+  assert.deepEqual(Object.keys(seen[0]).sort(), ['key', 'port', 'rotateGraceMinutes']);
+  assert.equal(validManagementKey(seen[0].key), true);
+  assert.match(seen[0].key, /^[A-Za-z0-9_-]{64}$/, '48 CSPRNG bytes as base64url');
+  assert.equal(JSON.stringify(result).includes(seen[0].key), false);
+  assert.equal(events(f.store).includes(seen[0].key), false);
+  assert.deepEqual(bodies(f.store).filter(b => b.call === 'proxy.init'), [{ call: 'proxy.init', port: 18440, generated: true }]);
+  await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true } });
+  assert.notEqual(seen[1].key, seen[0].key, 'each init generates a fresh key');
+});
+
+test('proxy.init generate refuses agents and testers, and refuses a key with generate or generate other than true', async t => {
+  let calls = 0;
+  const f = fixture(t, { proxyInit: async () => { calls++; return { port: 18432, binary: '/fixture' }; } });
+  for (const cap of [f.agent, f.tester]) assert.throws(() => f.b.request(cap, { verb: 'proxy.init', args: { generate: true } }), code('human-required'));
+  assert.throws(() => f.b.request(f.reader, { verb: 'proxy.init', args: { generate: true } }), code('read-only'));
+  for (const args of [{ generate: true, key: 'ps-sentinel-key-0001' }, { generate: false }, { generate: 'yes' }, {}])
+    assert.throws(() => f.b.request(f.human, { verb: 'proxy.init', args }), code('invalid-request'), JSON.stringify(args));
+  assert.equal(calls, 0);
+  assert.equal(events(f.store).includes('ps-sentinel-key-0001'), false);
+  // The same verb the refusals guard does run for the owner.
+  await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true } });
+  assert.equal(calls, 1);
+});
+
+test('proxy.fence.clear is owner-only, passes the evidence through, and records only the pid', async t => {
+  const seen = [];
+  const evidence = { unit: 'mosaic-proxy.service', confirmed: true, before: { pid: 1 }, after: { pid: 2 }, observedAt: new Date(0).toISOString() };
+  const f = fixture(t, { proxyFenceClear: async args => { seen.push(args); return { cleared: true, evidence: { after: { pid: 2 } } }; } });
+  for (const cap of [f.agent, f.tester]) assert.throws(() => f.b.request(cap, { verb: 'proxy.fence.clear', args: { evidence } }), code('human-required'));
+  assert.throws(() => f.b.request(f.reader, { verb: 'proxy.fence.clear', args: { evidence } }), code('read-only'));
+  assert.throws(() => f.b.request(f.human, { verb: 'proxy.fence.clear', args: {} }), code('invalid-request'));
+  assert.throws(() => f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence, restarted: true } }), code('invalid-request'));
+  assert.equal(seen.length, 0);
+  assert.deepEqual(await f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence } }), { cleared: true, evidence: { after: { pid: 2 } } });
+  assert.deepEqual(seen, [{ evidence }]);
+  assert.deepEqual(bodies(f.store).filter(b => b.call === 'proxy.fence.clear'), [{ call: 'proxy.fence.clear', cleared: true, pid: 2 }]);
+});
+
+test('proxy.fence.clear maps a refusal to its proxy code and a missing runtime to not-configured', async t => {
+  const f = fixture(t, { proxyFenceClear: async () => { throw Object.assign(Error('/home/x detail'), { code: 'proxy-restart-unconfirmed' }); } });
+  await assert.rejects(f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence: {} } }), e => e.code === 'proxy-restart-unconfirmed' && !e.message.includes('/home/x'));
+  const g = fixture(t);
+  assert.throws(() => g.b.request(g.human, { verb: 'proxy.fence.clear', args: { evidence: {} } }), code('not-configured'));
+});
+
+test('a lock clear with verify: the fence an uncertain write set clears only on proof, and the receipt holds the evidence', async t => {
+  const dir = fs.mkdtempSync(join(tmpdir(), 'ps-lock-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const lock = createProxyLock({ stateDir: dir, identity: 'instance-one' });
+  await assert.rejects(lock.run(async () => { lock.fence({ org: 'acme', op: 'apikey.add' }); throw Error('outcome unknown'); }));
+  assert.throws(() => lock.assertCertain(), code('proxy-uncertain'));
+  let read = 0;
+  await assert.rejects(lock.clear({ restarted: true, read: async () => { read++; }, verify: () => { throw Object.assign(Error('no'), { code: 'proxy-restart-unconfirmed' }); } }), code('proxy-restart-unconfirmed'));
+  assert.equal(read, 0, 'an unproved restart never reads or clears');
+  assert.throws(() => lock.assertCertain(), code('proxy-uncertain'));
+  const seenFence = [];
+  const result = await lock.clear({ restarted: true, read: async () => { read++; }, verify: previous => { seenFence.push(previous); return { after: { pid: 42 } }; } });
+  assert.deepEqual(result, { cleared: true, evidence: { after: { pid: 42 } } });
+  assert.equal(seenFence[0].org, 'acme'); assert.equal(seenFence[0].op, 'apikey.add');
+  lock.assertCertain();
+  const receipt = fs.readFileSync(join(dir, 'mosaic-keys.receipts.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).at(-1);
+  assert.deepEqual(receipt.evidence, { after: { pid: 42 } });
+  assert.equal(receipt.previous.org, 'acme');
+});
+
+test('every #1873 refusal code has a refusal-table entry with a next step', () => {
+  for (const c of ['proxy-admin-busy', 'proxy-key-transport', 'proxy-key-mismatch', 'proxy-restart-required', 'proxy-restart-unconfirmed', 'proxy-init-lock-held', 'proxy-init-lock-absent', 'proxy-unit-missing', 'proxy-unit-unhealthy', 'proxy-unit-failed', 'proxy-unit-exists', 'proxy-unit-path', 'proxy-unit-usage', 'proxy-install-missing', 'proxy-install-invalid', 'proxy-fetch-hash']) {
+    const entry = REFUSALS[c];
+    assert.ok(entry, c);
+    assert.equal(typeof entry.nextStep, 'string', c);
+    assert.ok(entry.nextStep.length > 20, c);
+    assert.equal(/\/(home|mnt|srv|tmp)\//.test(entry.nextStep), false, `${c} names no absolute path`);
+  }
+});
@@ -1,3 +1,4 @@
+import {approveTemplateHire,ownerConsole} from './hire-fixtures.mjs';
 // Row 194 (#1692, D3, T14): after every write that commits, the broker takes the business as a
 // restart would load it, so a created instance binds with no restart. A definition change on a
 // running instance refuses, and a file whose credential references changed isn't reloaded.
@@ -149,8 +150,6 @@ test('T19 a credentialed create answers restart true; issue works only after a r
 // A, from the file, so the kept instance keeps its claim and isn't left firing.
 test('T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A', async (t) => {
  const f = await setup(t);
-  const roleFile = join(f.rolesDir, 'chief-of-staff.json');
-  writeFileSync(roleFile, JSON.stringify({ ...JSON.parse(readFileSync(roleFile, 'utf8')), hireable: ['chief-information-security-officer'] }, null, 2));
  mkdirSync(join(f.root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
  const chief = bind(f.bus, 'chief');
  f.bus.broker.request(chief, { verb: 'role.claim' });
@@ -162,21 +161,21 @@ test('T14 after a refused reload veto.set, instance.hire and instance.fire answe

  const added = f.ask('instances.set', { revision: f.revision(), instance: 'rev-2', op: 'add', definition: 'reviewer', tracker: { bot: 'bot-demo-rev-2', botId: 40 } });
  assert.equal(added.restart, true);
-  const hired = asChief('instance.hire', { name: 'sec-2', definition: 'chief-information-security-officer', reason: 'a security lead' });
-  assert.equal(hired.restart, true);
+  const hired = await approveTemplateHire(f.bus.broker,f.rolesDir,{name:'sec-2',definition:'chief-information-security-officer'});
+  assert.ok(hired.transaction);
  const kept = f.ask('veto.set', { revision: f.revision(), op: 'keep', name: 'reviewer' });
  assert.equal(kept.restart, true);
  assert.equal(f.reloads.length, 0, 'the running copy still has reviewer unkept');

  const before = readFileSync(f.file, 'utf8');
-  assert.equal(code(() => asChief('instance.fire', { name: 'reviewer', reason: 'the work is done' })), 'instance-kept');
+  await assert.rejects(f.bus.broker.request(ownerConsole(f.bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'reviewer',reason:'the work is done'}}),{code:'instance-kept'});
  assert.equal(readFileSync(f.file, 'utf8'), before);
  assert.deepEqual(f.ask('instances').instances.reviewer.running, run, 'step A never ran: the claim is held');
  assert.notEqual(code(() => f.ask('instance.launch', { instance: 'reviewer' })), 'instance-firing');

  const unkept = f.ask('veto.set', { revision: f.revision(), op: 'unkeep', name: 'reviewer' });
  assert.equal(unkept.restart, true);
-  const fired = asChief('instance.fire', { name: 'reviewer', reason: 'the work is done' });
+  const fired = await f.bus.broker.request(ownerConsole(f.bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'reviewer',reason:'the work is done'}});
  assert.equal(fired.restart, true);
  assert.equal(JSON.parse(readFileSync(f.file, 'utf8')).launch.instances.includes('reviewer'), false);
 });
@@ -90,7 +90,7 @@ const ask = (x, state, extra = {}) => x.call('pm', 'request.question', { request
  options: [{ key: 'web', text: 'Web' }, { key: 'cli', text: 'CLI' }], ...extra });

 test('the console verb list includes the artifact read and existing owner controls', () => {
-  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
+  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'autonomy.get.console', 'autonomy.set.console', 'autonomy.review.console', 'decision.confirm.console', 'decision.reverse.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'hire.preview.console', 'hire.resolve.console', 'hire.start.console', 'hire.templates.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
    'request.get.console', 'request.projects.console', 'request.answer.console', 'request.attach.console', 'request.cancel.console']);
 });

@@ -96,6 +96,9 @@ test('row 65 runtime: harnessLevels answers each module in the tree, and null fo
  assert.deepEqual(levels('pi'), ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
  assert.deepEqual(levels('claude-code'), ['low', 'medium', 'high', 'xhigh', 'max']);
  for (const name of ['cursor', '', '../pi']) assert.equal(levels(name), null, name);
+  // AU (#1873): each module's own countsAccount answer, read once with its levels.
+  assert.deepEqual([levels.countsAccount('pi'), levels.countsAccount('claude-code')], [false, true]);
+  for (const name of ['cursor', '', '../pi']) assert.equal(levels.countsAccount(name), null, name);
  assert.deepEqual(logged, []);
 });

@@ -7,7 +7,7 @@ import { Broker } from '../src/broker.mjs';
 import { initProject, readSpec, writeRecord, listProjectFiles, readProjectFile, writeHumanFile, ProjectError } from '../../project/src/index.mjs';
 export const git = (repo, ...args) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'maintenance.auto=false', '-c', 'gc.auto=0', '-C', repo, ...args], { encoding: 'utf8' }).trim();
 const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
-export async function fixture(t, { adapter = true, roles = {}, arbiters = { technical: 'chief', delivery: 'chief' }, access = null } = {}) {
+export async function fixture(t, { adapter = true, roles = {}, arbiters = { technical: 'chief', delivery: 'chief' }, access = null, autonomyHost = null } = {}) {
  const root = mkdtempSync(join(tmpdir(), 'bus-spec-'));
  const store = new Store(root);
  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
@@ -20,7 +20,7 @@ export async function fixture(t, { adapter = true, roles = {}, arbiters = { tech
      ...roles,
    } };
  const { repo, commit } = await initProject({ business, project: 'stack', dataRoot: root });
-  const broker = new Broker({ store, businesses: { demo: business }, access, project: adapter ? {
+  const broker = new Broker({ store, businesses: { demo: business }, access, autonomy: autonomyHost, project: adapter ? {
    readSpec: context => readSpec({ ...context, dataRoot: root }),
    writeRecord: context => writeRecord({ ...context, dataRoot: root }),
    listFiles: context => listProjectFiles({ ...context, dataRoot: root }),
@@ -546,3 +546,18 @@ test('review: saturated and adjacent positions refuse without a write', async (t
  assert.equal(syncCode(() => f.person('tasks.edit', {task_ref:'task:1', group:'adjacent', position:10})), 'task-position-full');
  assert.equal(f.store.get('SELECT count(*) n FROM store_tasks').n, before + 2);
 });
+
+test('AU near cross-role task scope restores prior fields and refuses overwriting a later edit',async t=>{
+ const f=await org(t);f.broker.reloadBusiness('acme',business('acme',{autonomy:{'cross-role':'near the loop',notices:true}}));
+ const owner=f.broker.bindConsole({business:'acme',human:'jason',subject:{provider:'test',iss:'https://issuer.test',sub:'owner'}});
+ const made=f.person('tasks.create',{title:'Before',requirement:'REQ-TASK-1'});
+ const d=f.approve('coder','task.scope.change',made.task_ref);
+ await f.call('coder','task.scope.change',{task_ref:made.task_ref,title:'After',decision:d});
+ const reversed=await f.broker.request(owner,{verb:'decision.reverse.console',args:{id:d}});
+ assert.equal(reversed.reversed,true);assert.equal(f.read()[0].fields.title,'Before');
+ const later=f.approve('coder','task.scope.change',made.task_ref);
+ await f.call('coder','task.scope.change',{task_ref:made.task_ref,title:'Second',decision:later});
+ f.person('tasks.edit',{task_ref:made.task_ref,title:'Owner edit'});
+ await assert.rejects(f.broker.request(owner,{verb:'decision.reverse.console',args:{id:later}}),{code:'decision-stale'});
+ assert.equal(f.read()[0].fields.title,'Owner edit');
+});
@@ -385,7 +385,7 @@ test('R3 r4: the chief\'s hire refuses an instance named user with the code it g
  caps.chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi', address: 'chief' });
  b.request(caps.chief, { verb: 'role.claim' });
  const hire = (name) => code('chief', 'instance.hire', { name, definition: 'coder', reason: 'more hands' });
-  for (const name of ['human', 'tester', 'user']) assert.equal(hire(name), 'invalid-request', name);
+  for (const name of ['human', 'tester', 'user']) assert.equal(hire(name), 'decision-required', name);
  // A name that isn't reserved passes the name check and refuses later, for want of role files.
  assert.notEqual(hire('helper'), 'invalid-request');
 });
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/agent-copies.mjs (rename design r2, stage B).
+export * from "../../organization/src/agent-copies.mjs";
@@ -0,0 +1,2 @@
+// Compatibility path for organization autonomy policy.
+export * from "../../organization/src/autonomy.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/config-dir-trust.mjs (rename design r2, stage B).
+export * from "../../organization/src/config-dir-trust.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/copy-bindings.mjs (rename design r2, stage B).
+export * from "../../organization/src/copy-bindings.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/definition-verbs.mjs (rename design r2, stage B).
+export * from "../../organization/src/definition-verbs.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/definitions.mjs (rename design r2, stage B).
+export * from "../../organization/src/definitions.mjs";
@@ -0,0 +1 @@
+export * from "../../organization/src/hire-decisions.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/repo-remote.mjs (rename design r2, stage B).
+export * from "../../organization/src/repo-remote.mjs";
@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/system-config-problem.mjs (rename design r2, stage B).
+export * from "../../organization/src/system-config-problem.mjs";
@@ -28,6 +28,9 @@ mosaic inbox [--business <id>] [--json]
 mosaic inbox --read <id>... | --read-all [--business <id>]
 mosaic decide <decision> <option> [--note <text>] [--yes] [--business <id>]
 mosaic tasks [--business <id>] [--json]
+mosaic tasks create --title <text> --requirement <REQ-X-N> [--project <name>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+mosaic tasks edit task:<n> --expect <digest> [--title <text>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+mosaic tasks archive task:<n> --expect <digest> --business <id> [--json]
 mosaic agents [--business <id>] [--json] [--tester]
 mosaic trail <task|decision> [--business <id>] [--json]
 mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>]
@@ -298,9 +301,16 @@ mosaic bus start <business> [--pm]
                                the host; run by the unit, not by hand.
                                --pm also launches the business's PM
 mosaic bus stop                 SIGTERM to the recorded host, then wait
+mosaic bus restart              stop, then start with the recorded options
+mosaic bus recover              clear a dead host's locks, with a receipt
 mosaic bus status [--json]      host state file, socket, writer.lock
 ```

+`bus start`, `bus stop`, `bus restart` and `bus recover`, and `console start`,
+`console stop` and `console restart`, refuse inside an agent run (exit 3,
+agent-guard #1873). They check the environment they are given and their own
+process environment. `bus status` and `console status` stay open to agents.
+
 `bus start` does the following:

 1. It reads the system config through `scripts/mosaic-config.mjs validate`,
@@ -1269,8 +1279,15 @@ its checkout; `mosaic org project repo init ID PROJECT --local-only
 URL` selects remote mode instead. These commands never push or overwrite an
 existing repository. Local-only acceptance records the risk of losing the only
 copy. Read back with `mosaic org queue show ID [--json]` or `mosaic org project
-repo show ID PROJECT [--json]`. See `packages/organization/README.md` for the
-layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
+repo show ID PROJECT [--json]`. `mosaic org project repo set ID PROJECT
+(--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json]`
+changes a project's repository later; it is refused with `project-repo-bound`
+(exit 2) while an approved or active copy binding names the project. A remote is https or ssh; its checkout's
+`origin` is set and checked once with `git ls-remote`, without credentials, and
+the receipt says `reachable`, `needs-credential` or `unreachable`. An ssh check
+does not verify the host key and says so. A copy
+credential binding supplies credentials for https Gitea remotes only. See
+`packages/organization/README.md` for the URL rules, layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
 if both are supplied they must name the same ID.

 `mosaic org delete ID --confirm ID --if-revision N [--json]` stops the
@@ -1290,6 +1307,54 @@ mean a bus start is still in progress; if a process crashed and left its lock,
 inspect it before removing it and resuming. Moves use rename and therefore
 require the source and deleted folder to be on the same filesystem.

+`mosaic org archive` and `mosaic org delete` stop the organization bus, so like
+`bus stop` they refuse inside an agent run (exit 3, agent-guard #1873), after
+their usage checks and before any config is read.
+
+`mosaic org restore ID --if-revision N` makes the organization active and starts
+its bus, as `mosaic bus start ID --dev-local-owner --detach` does (E1, P1-4). It
+makes that verb's checks before the restore, so a stamped build or an instance
+that refuses `--dev-local-owner` refuses the restore before anything changes
+(exit 3). Starting a bus is a human action, so inside an agent run `org restore`
+refuses like `bus start` (exit 3) before any config is read. The receipt's `bus`
+names the outcome: `started` with the host pid, or `failed` with the message and
+the verb that starts it (after `mosaic bus recover ID` when a host that died left a
+stale lock). A bus that does not start leaves the restore in place;
+the command prints the receipt and exits 3. `org restore ID --if-revision N
+--no-bus` restores without starting the bus, as before, and stays open to agents.
+
+The hire form and the autonomy panel from a terminal (E2, #1873, P1-3):
+
+```
+mosaic org role-templates ORG [--json]
+mosaic org hire|change ORG --name NAME --template TEMPLATE --harness H --model M [--thinking T] [--level org|project|root] [--project P] --reason TEXT [--json]
+mosaic org fire ORG --name NAME [--level org|project|root] [--project P] --reason TEXT [--json]
+mosaic org autonomy ORG [--json]
+mosaic org autonomy ORG set --revision REV [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours 1-168] [--authority-resolver NAME|""] [--json]
+mosaic org autonomy ORG review cross-role|merge|policy|authority [--json]
+```
+
+Each sends the page's own request to the running Console's org route, as
+`org reload` does, so the Console runs the same owner, `--send`, origin, body
+and session checks and the same bus verbs. `hire` and `change` read the role
+templates first and send the chosen template's name and sha256. `autonomy set`
+needs the 64-hex `--revision` that `mosaic org autonomy ORG` prints and sends every
+setting the panel sends, changing only the named ones; a stale revision is
+refused `revision-conflict`. `--authority-resolver ""` clears the resolver, as
+emptying the panel's field does, and `--reverse-window-hours` takes 1 to 168.
+These verbs need a named instance whose Console runs with `--dev-local-owner`;
+the default instance is refused with exit 3. A Console refusal exits 3 with its code and
+message, an answer that never came exits 1, an unknown template exits 2. All of
+these verbs, reads included, refuse inside an agent run (exit 3) after their
+usage checks (exit 4) and before any config is read.
+
+`mosaic tasks create|edit|archive` are the task board's three writes. The
+arguments pass the board's own check, then go to the bus as the person
+(`tasks.create`, `tasks.edit`, `tasks.archive`), so the bus runs its human,
+field, digest and archive checks. Edit and archive need the task's digest from
+`mosaic tasks --json` as `--expect`; a stale one is refused `task-conflict`
+(exit 2) and nothing is written. They refuse inside an agent run.
+
 System types are installed plug-ins. `mosaic org system-types installed` prints
 module metadata; `mosaic org system-types enabled ID` prints an organization's enabled
 ids. The owner changes the enabled list through the existing organization file
@@ -1304,8 +1369,10 @@ inactive. Project settings changes are append-only and require human proof.
 `mosaic accounts` administers the instance-level accounts store locally, as the
 effective uid owning the config directory. It requires a human shell, rejects `--tester`,
 and takes no business selector or bus connection. It has no organization rights
-verbs. Console sign-in, sessions and membership evaluation are later Phase M
-slices; these commands alone do not turn accounts mode on.
+verbs. Console OIDC sign-in re-reads these accounts on every request. A disabled
+account or changed authentication generation loses account authority immediately;
+a legacy access.json root grant is checked independently. Organization membership
+evaluation follows in later Phase M slices.

 ```sh
 mosaic accounts init --name Operator
@@ -1327,3 +1394,11 @@ organization (including archived organizations) or any registry entry lacks its
 owner metadata during creation, and removes its memberships in
 the same write. List reports rollback rows needing repair; its JSON omits invite
 bindings and hashes. Receipts record effective process uid and verb and omit subjects and secrets.
+
+Managed accounts instances use the system units from `scripts/case2-unit.sh`.
+The selected uid must use a non-login shell, be the only member of its primary
+group, and own its config directory and data root. The shared Case 1/Case 2
+installer writes `<dataRoot>/.deployed` as mode 0444 naming the instance.
+`webui-service.sh` refuses accounts and deployed instances because its user
+manager runs under a human or development seat uid. The receipt uid identifies
+the invoking process; it does not attribute a human or resist tampering by that uid.
@@ -154,11 +154,13 @@ function pidAlive(pid) {
  }
 }

+// Names the lock by label: its path sits beside the access file in the config
+// directory, and a refusal never quotes a host path (PR #1916).
 function lockRefusal(lock) {
  const pid = lockPid(lock);
  if (pid !== null && pidAlive(pid)) return BUSY;
-  if (pid === null) return `refused: lock ${lock} is unreadable or not a pid; if no write is running, remove it by hand and try again`;
-  return `refused: lock ${lock} is left by pid ${pid}, which is not running; if no write is running, remove it by hand and try again`;
+  if (pid === null) return `refused: access file lock is unreadable or not a pid; if no write is running, remove it by hand and try again`;
+  return `refused: access file lock is left by pid ${pid}, which is not running; if no write is running, remove it by hand and try again`;
 }

 function takeLock(lock, fs) {
@@ -37,8 +37,10 @@ function parse(args) {
 function owns(user, owner, providers) {
  return user.subjects.some(s => s.provider === owner.provider && s.sub === owner.sub && providers.find(p => p.id === s.provider)?.issuer === owner.iss);
 }
-function readOwner(root) {
-  const owner = readJsonFile(join(root, 'owner.json'), 'organization owner', st => {
+// The registry checked `id` against the id pattern, so the label may name it; the
+// root is a host path and never reaches a refusal (PR #1916).
+function readOwner(root, id) {
+  const owner = readJsonFile(join(root, 'owner.json'), `organization owner of ${id}`, st => {
    if (st.uid !== process.geteuid() || (st.mode & 0o777) !== 0o600) throw new CliError('refused: unsafe organization owner', 3);
  });
  rejectUnknownKeys(owner, ['provider', 'iss', 'sub'], 'organization owner');
@@ -92,7 +94,7 @@ export async function accountsCommand(args, io, deps) {
        // writing owner.json, so any missing owner must block removal too.
        for (const entry of Object.values((await readRegistryLocked(registry)).orgs)) {
          let owner;
-          try { owner = readOwner(entry.root); }
+          try { owner = readOwner(entry.root, entry.id); }
          catch (e) { if (/not found/.test(e.message)) throw new CliError(`refused: org-create-in-progress: ${entry.id} has no owner metadata`, 3); throw e; }
          if (owns(user, owner, providers)) throw new CliError(`refused: user-owns-org: ${entry.id}`, 3);
        }
@@ -37,9 +37,10 @@ function write(dataRoot, status, event) {
  appendFileSync(bootEventsFile(dataRoot), `${JSON.stringify(event)}\n`, { mode: 0o600 });
 }

-// A start refused: keeps the time of the last good load from the status it replaces.
-export function recordBootRefused(dataRoot, { business, file, reason, at = new Date().toISOString() }) {
-  const prior = readBootStatus(dataRoot);
+// A start refused: keeps the time of the last good load from the status it replaces. `prior` is the
+// status from before this start, for a refusal that comes after the start recorded its load (org-defscan:
+// the broker's held-secret check on the definitions).
+export function recordBootRefused(dataRoot, { business, file, reason, at = new Date().toISOString(), prior = readBootStatus(dataRoot) }) {
  const lastGood = prior?.ok ? prior.at : prior?.lastGood ?? null;
  const text = String(reason).slice(0, REASON_MAX);
  write(dataRoot, { ok: false, at, business, file, reason: text, lastGood }, { event: "bus.boot.refused", at, business, file, reason: text });
@@ -8,6 +8,7 @@
 // host (src/host.mjs) the systemd unit mosaic-bus@<business> runs; with
 // --pm it also launches the business's PM (src/launcher.mjs).

+import { assertBuildStart, assertDevInstance } from './deployment.mjs';
 import { readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -17,6 +18,7 @@ import { interviewCommand, INTERVIEW_USAGE, northStarCommand, NORTH_STAR_USAGE }
 import { resolveThread, threadCommand, threadMembers, threadsCommand, THREAD_TALK_USAGE, THREAD_USAGE, THREADS_USAGE } from "./thread.mjs";
 import { sessionCommand, SESSION_USAGE } from "./session.mjs";
 import { limitsCommand, LIMITS_USAGE } from "./limits.mjs";
+import { pluginInstallCommand } from "./plugin-install.mjs";
 import { pluginsCommand, PLUGINS_USAGE } from "./plugins.mjs";
 import { proxyCommand } from "./model-proxy.mjs";
 import { credentialsCommand, CREDENTIALS_USAGE } from "./credentials.mjs";
@@ -35,6 +37,7 @@ import { bootConfig, loadSystem, orgPaths, socketPath } from "./config.mjs";
 import { bootLine, readBootStatus, recordBootOk, recordBootRefused } from "./boot-status.mjs";
 import { businessFilePath, configDir } from "../../organization/src/index.mjs";
 import { busExit, humanTransport, refuseInsideAgent, testerTransport } from "./transport.mjs";
+import { definitionsCommand } from "./org-definitions.mjs";
 import { formatAgents, formatDecision, formatInbox, formatTasks, formatTrail, shortId } from "./format.mjs";
 import { hostStatus, readHostState, startHost, stopHost } from "./host.mjs";
 import { createLauncher } from "./launcher.mjs";
@@ -52,6 +55,7 @@ import { agentsRootCommand, AGENTS_ROOT_USAGE, projectAgentsCommand, PROJECT_AGE
 import { ORG_CONFIG, runConfigCommand } from "../../organization/src/config-command.mjs";
 import { devCommand, DEV_USAGE, fixtureLaunchEnv, fixtureLauncherOptions } from "./dev-fixture.mjs";
 import { runCommand, RUN_USAGE } from "./run-evidence.mjs";
+import { tasksWriteCommand, TASKS_WRITE_OPS, TASKS_WRITE_USAGE } from "./tasks-write.mjs";

 export const USAGE = `usage:
  ${ACCOUNTS_USAGE}
@@ -60,7 +64,8 @@ export const USAGE = `usage:
  ${LIMITS_USAGE}
  ${PLUGINS_USAGE}
  ${CREDENTIALS_USAGE}
-  mosaic proxy fetch | fence status [--json] | fence clear --proxy-restarted | init [--port N] [--business ID] [--rotate-grace-minutes N] [--first-output-seconds N]
+  mosaic proxy fetch | status [--json] | fence status [--json] | fence clear --proxy-restarted | fence clear --restart [--business ID] | init [--generate-key] [--port N] [--business ID] [--rotate-grace-minutes N] [--first-output-seconds N]
+  mosaic proxy unit render|install|start|stop|restart|status [--json] | init-lock status|clear
  ${HOSTS_USAGE}
  ${GRANTS_USAGE}
  ${ORG_INSTANCES_USAGE}
@@ -78,6 +83,7 @@ export const USAGE = `usage:
  mosaic inbox --read <id>... | --read-all [--business <id>]
  mosaic decide <decision> <option> [--note <text>] [--yes] [--business <id>]
  mosaic tasks [--business <id>] [--json] [--tester]
+  ${TASKS_WRITE_USAGE}
  mosaic agents [--business <id>] [--json] [--tester]
  mosaic trail <task|decision> [--business <id>] [--json] [--tester]
  mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>] [--tester]
@@ -219,7 +225,7 @@ function callFor(parsed, io, deps) {
 // Only the converted project/thread surface uses a channel. Management stays on callFor.
 function channelCallFor(parsed, io, deps) {
  const call = callFor(parsed, io, deps);
-  const channel = createChannelCaller({ name: "cli", call,
+  const channel = createChannelCaller({ name: "cli", call, dataRoot:(deps.system ?? loadSystem({env:io.env})).dataRoot,
    log: entry => io.stderr.write(`mosaic: channel module refused (${entry.code})\n`),
  });
  return Object.assign(async (verb, args = {}) => {
@@ -516,7 +522,8 @@ async function processingCommand(verb, rest, io, deps) {
    if (!result || typeof result !== 'object' || (typeof result.halted !== 'boolean' && !result.invalid))
      throw new CliError('processing outcome unknown; use mosaic processing status before trying again', 1);
    if (verb === 'halt' && result.quiescent !== true)
-      throw new CliError(`halt gate is on for instance ${system.dataRoot}; ${result.remaining ?? 'unknown'} stops unconfirmed. Use mosaic processing status`, 1);
+      // #1873: the refusal names the instance, never its data root; a count that is not a count is unknown.
+      throw new CliError(`halt gate is on for this instance; ${Number.isSafeInteger(result.remaining) && result.remaining >= 0 ? result.remaining : 'unknown'} stops unconfirmed. Use mosaic processing status`, 1);
    if (parsed.flags.has('--json')) { io.stdout.write(JSON.stringify(result, null, 2) + '\n'); return; }
    const status = verb === 'resume' ? 'resumed' : result.halted ? 'halted' : result.invalid ? 'uninitialized' : 'running';
    io.stdout.write(`processing ${status} for instance ${system.dataRoot}\n`);
@@ -565,10 +572,21 @@ function organizationContext(io, deps) {
  return { configDir: dir, dataRoot: system.dataRoot, instance, env: io.env, system };
 }

+// agent-guard (#1873): the bus and Console lifecycle verbs (start, stop, restart, recover) refuse
+// inside an agent run, before any read, with refuseInsideAgent's refusal (exit 3). This process's
+// own environment is checked as well as the one the command was given, so a sanitized io.env does
+// not hide a marker (D1 security re-check P1). Status verbs stay open to agents. A person keeps
+// these verbs in a human shell, and the Console's Restart bus and Restart Console controls.
+function refuseAgentRun(io) {
+  refuseInsideAgent(process.env);
+  refuseInsideAgent(io.env);
+}
+
 async function consoleCommand(rest, io, deps) {
  const [sub, ...args] = rest;
  if (sub === "stop") {
    if (args.length) throw usage("console stop takes no arguments");
+    refuseAgentRun(io);
    io.stdout.write(`${JSON.stringify(await consoleStop(organizationContext(io, deps), { warn: s => io.stderr.write(s) }))}\n`);
    return;
  }
@@ -581,7 +599,7 @@ async function consoleCommand(rest, io, deps) {
  // and trail checks (org-console.mjs consoleRestart); an agent run is refused before any read.
  if (sub === "restart") {
    if (args.length) throw usage("console restart takes no arguments");
-    refuseInsideAgent(io.env);
+    refuseAgentRun(io);
    io.stdout.write(`${JSON.stringify(await consoleRestart(organizationContext(io, deps), deps.consoleRequest ?? {}))}\n`);
    return;
  }
@@ -594,6 +612,9 @@ async function consoleCommand(rest, io, deps) {
  const names = Object.hasOwn(parsed.values, "--dev-allow-host") ? [parsed.values["--dev-allow-host"]] : [];
  let lan;
  try { lan = devLanOptions({ devOwner, bind, names }); } catch (err) { throw usage(err.message); }
+  // D1, agent-guard: an agent run never starts a Console, dev-local-owner or not (org-console.mjs
+  // consoleStart checks again). Usage errors above come first; devLanOptions reads nothing.
+  refuseAgentRun(io);
  const receipt = await consoleStart(organizationContext(io, deps), { devLocalOwner: devOwner, detach: parsed.flags.has("--detach"), port: parsed.values["--port"] ?? "auto", ...(lan ? { bind: lan.bind, allowHosts: lan.allowHosts } : {}), warn: s => io.stderr.write(s) });
  io.stdout.write(`${JSON.stringify(receipt)}\n`);
  if (!parsed.flags.has("--detach")) {
@@ -614,8 +635,13 @@ async function bus(rest, io, deps) {
    const parsed = parse(args, { flags: ["--pm", "--no-launch", "--dev-local-owner", "--detach", "--internal-host"] });
    if (parsed.positional.length !== 1) throw usage("bus start takes one organization");
    if (parsed.flags.has("--no-launch") && parsed.flags.has("--pm")) throw usage("bus start takes --pm or --no-launch, not both");
+    // agent-guard: --internal-host too. The host a Console or a person starts runs it with that
+    // process's environment (org-bus.mjs busStart), which carries no agent marker.
+    refuseAgentRun(io);
+    assertBuildStart({ devOwner: parsed.flags.has("--dev-local-owner") });
    if (parsed.flags.has("--dev-local-owner")) devOwnerInstance(io.env);
    const ctx = organizationContext(io, deps);
+    if (parsed.flags.has("--dev-local-owner")) assertDevInstance(ctx.system, io.env);
    const businessId = parsed.positional[0];
    if (!parsed.flags.has("--internal-host")) {
      const receipt = await busStart(ctx, businessId, { detach: parsed.flags.has("--detach"), devLocalOwner: parsed.flags.has("--dev-local-owner"), pm: parsed.flags.has("--pm"), noLaunch: parsed.flags.has("--no-launch") });
@@ -646,9 +672,14 @@ async function bus(rest, io, deps) {
        throw e;
      }
      if (instance) boot.consoleOwners = [...(boot.consoleOwners ?? []), DEV_OWNER];
+      const priorBoot = readBootStatus(org.root);
      try { recordBootOk(org.root, { business: businessId, file }); } catch { /* status is advisory */ }
      const binding = readNotifyConfig(org.root, businessId);
-      const host = await startHost({ boot, business: businessId, notifier: binding ? { binding } : null, refuseStale: true, options: { devLocalOwner: Boolean(instance), pm: parsed.flags.has("--pm"), noLaunch: !launches } });
+      const host = await startHost({ boot, business: businessId, notifier: binding ? { binding } : null, refuseStale: true, options: { devLocalOwner: Boolean(instance), pm: parsed.flags.has("--pm"), noLaunch: !launches } }).catch((e) => {
+        // org-defscan: the broker refused a definition that holds a credential it holds; the load was not good after all.
+        if (e.code === "definition-holds-credential") try { recordBootRefused(org.root, { business: businessId, file, reason: e.message, prior: priorBoot }); } catch { /* the refusal still throws */ }
+        throw e;
+      });
      try {
        // A dev fixture serves only the organizations that use it; their launches carry no provider credential.
        const orgDoc = instance ? JSON.parse(readFileSync(file, "utf8")) : undefined;
@@ -658,7 +689,7 @@ async function bus(rest, io, deps) {
        // tracker gets (the bus runtime makes the same choice, runtime.mjs trackerOf).
        const taskModule = boot.businesses?.[businessId]?.plugins?.["task-tracker"];
        const tracker = Boolean(boot.trackers?.[businessId]) || taskModule === undefined || taskModule === "store";
-        const launcher = createLauncher({ host, system: { ...system, instanceRoot: system.dataRoot, dataRoot: org.root }, env: launchEnv, tracker, launches, ...(instance ? fixtureLauncherOptions({ system, env: launchEnv, instance, doc: orgDoc }) : {}), ...(deps.launcher ?? {}) });
+        const launcher = createLauncher({ host, system: { ...system, instanceRoot: system.dataRoot, dataRoot: org.root }, env: launchEnv, tracker, launches, copies: boot.copies ?? null, ...(instance ? fixtureLauncherOptions({ system, env: launchEnv, instance, doc: orgDoc }) : {}), ...(deps.launcher ?? {}) });
        await launcher.listen();
        if (instance) io.stdout.write(`DEV LOCAL OWNER MODE: console owner local-dev accepted (named instance ${instance})\n`);
        if (instance && parsed.flags.has("--pm")) io.stdout.write('DEV LOCAL OWNER MODE: launched agents run as this OS user and can reach the loopback Console as owner; use this instance for UI testing only\n');
@@ -692,6 +723,9 @@ async function bus(rest, io, deps) {
  if (["stop", "restart", "status", "recover"].includes(sub)) {
    const parsed = parse(args, { flags: sub === "status" ? ["--json"] : [] });
    if (parsed.positional.length !== 1) throw usage(`bus ${sub} takes one organization`);
+    // D2 security review: recovery clears host state, so an agent run is refused before any read.
+    // agent-guard: stop and restart too; status stays open to agents.
+    if (sub !== "status") refuseAgentRun(io);
    if (sub === "recover") devOwnerInstance(io.env);
    const ctx = organizationContext(io, deps), id = parsed.positional[0];
    const result = sub === "stop" ? await busStop(ctx, id) : sub === "restart" ? await busRestart(ctx, id) : sub === "recover" ? await busRecover(ctx, id) : await busStatus(ctx, id);
@@ -733,10 +767,14 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
  // builds; `org validate FILE` stays orgCommand's draft check.
  if (verb === 'org' && rest[0] === 'config') return orgConfig(rest.slice(1), io);
  if (verb === 'org' && ["instances", "instance", "veto"].includes(rest[0])) return orgInstancesCommand(rest, io, (p) => callFor(p, io, deps));
+  // #1873 T1: definition writes go through the organization's bus, as the human.
+  if (verb === 'org' && rest[0] === 'definitions') return definitionsCommand(rest.slice(1), io, { ...deps, callFor: (p) => callFor(p, io, deps) });
  if (verb === 'org') return orgCommand(rest, io, deps);
  // A2 (#1873): the owner's root and project agent levels. `mosaic agents` without `root` stays the bus read.
  if (verb === "agents" && rest[0] === "root") return agentsRootCommand(rest.slice(1), io);
  if (verb === "project" && rest[0] === "agents") return projectAgentsCommand(rest.slice(1), io);
+  // E2 (#1873, P1-3): the task board's create, edit and archive, as the person (tasks-write.mjs).
+  if (verb === "tasks" && TASKS_WRITE_OPS.includes(rest[0])) return tasksWriteCommand(rest, io, (p) => callFor(p, io, deps));
  if (["inbox", "decide", "tasks", "agents", "trail"].includes(verb)) return human(verb, rest, io, deps);
  if (verb === "project" && rest[0] === "north-star") return northStarCommand(rest.slice(1), io, (p) => callFor(p, io, deps));
  if (verb === "project" && rest[0] === "interview") return interviewCommand(rest.slice(1), io);
@@ -756,9 +794,13 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
  if (verb === 'accounts') return accountsCommand(rest, io, { system: deps.system ?? loadSystem({ env: io.env }), configDir: deps.accountsConfigDir });
  if (verb === "limits") return limitsCommand(rest,io,p=>callFor(p,io,deps));
  if (verb === "usage") return usageCommand(rest, io, p => callFor(p, io, deps));
+  if (verb === "plugins" && ["install","list","remove"].includes(rest[0])) {
+    refuseInsideAgent(io.env);
+    return pluginInstallCommand(rest,io,{system:deps.system ?? loadSystem({env:io.env}),dir:deps.accountsConfigDir});
+  }
  if (verb === "plugins") return pluginsCommand(rest, io, (p) => callFor(p, io, deps));
  // Row 199 (#1697): issue and rotate read the token on stdin.
-  if (verb === "proxy") return proxyCommand(rest, io, { system: () => deps.system ?? loadSystem({ env: io.env }), callFor: p => callFor(p, io, deps), prompt: deps.promptProxyKey });
+  if (verb === "proxy") return proxyCommand(rest, io, { system: () => deps.system ?? loadSystem({ env: io.env }), callFor: p => callFor(p, io, deps), prompt: deps.promptProxyKey, ...(deps.proxyAdmin ? { admin: deps.proxyAdmin } : {}) });
  if (verb === "credentials") return credentialsCommand(rest, io, (p) => callFor(p, io, deps));
  // Row 234 (#1740, r6 E4): the host records.
  if (verb === "hosts") return hostsCommand(rest, io, (p) => callFor(p, io, deps));
@@ -10,6 +10,11 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { managedState } from "../../organization/src/project-bootstrap.mjs";
 import { BusinessError, accessFilePath, configDir, loadAccess, loadBusiness, loadProject, projectFilePath, resolveInstance, systemVars } from "../../organization/src/index.mjs";
+import { loadRootAgents } from "../../organization/src/agent-levels.mjs";
+import { materializeCopies, withCopies } from "../../organization/src/agent-copies.mjs";
+import { organizationWriter } from "../../organization/src/organization.mjs";
+import { systemConfigProblem } from "../../organization/src/system-config-problem.mjs";
+import { businessFilePath } from "../../organization/src/organization-config.mjs";
 import { busOrganization } from "../../bus/src/organization-context.mjs";
 import { BusError } from "../../bus/src/broker.mjs";
 import { CliError } from "./errors.mjs";
@@ -37,13 +42,40 @@ export function orgPaths(root) {
    threads: join(root, "threads"), hostDir };
 }

+// #1873: mosaic-config's stderr can quote the config's path, the data root or a config value, so
+// it is never relayed. An instance refusal keeps its code and the instance names, which passed
+// the instance pattern; a missing config keeps its bootstrap hint; anything else reads as
+// `mosaic org config` reads it: a known field and its constraint, the config named by label.
+const INSTANCE = "[a-z][a-z0-9]{1,15}";
+function instanceProblem(problem, label) {
+  const body = problem.replace(/^mosaic-config: /, "");
+  let m = new RegExp(`^instance-root-mismatch: .+ is claimed by instance (${INSTANCE})(?:, not (${INSTANCE})|; select it with --instance \\1)$`).exec(body);
+  if (m) return `instance-root-mismatch: the data root is claimed by instance ${m[1]}${m[2] ? `, not ${m[2]}` : `; select it with --instance ${m[1]}`}`;
+  m = new RegExp(`^instance-root-unclaimed: .+ holds no instance\\.json naming (${INSTANCE}) \\(scripts/bootstrap\\.sh --instance \\1 claims a new root\\)$`).exec(body);
+  if (m) return `instance-root-unclaimed: the data root holds no instance.json naming ${m[1]} (scripts/bootstrap.sh --instance ${m[1]} claims a new root)`;
+  if (body.startsWith("instance-root-unclaimed: ")) return "instance-root-unclaimed: the data root's instance.json is not a readable, valid marker";
+  m = new RegExp(`^instance-config-mismatch: --instance (${INSTANCE}) names `).exec(body);
+  if (m) return `instance-config-mismatch: --instance ${m[1]} names its own config, but MOSAIC_CONFIG names another`;
+  if (body.startsWith("instance-config-mismatch: ")) return "instance-config-mismatch: --instance names its own config, but MOSAIC_CONFIG names another";
+  if (body.startsWith("instance-name-invalid: ")) return `instance-name-invalid: an instance name must match /^${INSTANCE}$/`;
+  if (body.startsWith("configuration not found: ")) {
+    m = new RegExp(`\\(run (scripts/bootstrap\\.sh(?: --instance ${INSTANCE})?) to create it\\)$`).exec(body);
+    return `configuration not found: ${label}${m ? ` (run ${m[1]} to create it)` : ""}`;
+  }
+  return null;
+}
+
 export function loadSystem({ env = process.env, instance = null } = {}) {
  const proc = spawnSync(process.execPath, [join(REPO, "scripts", "mosaic-config.mjs"), "validate", ...(instance === null ? [] : ["--instance", instance])], {
    encoding: "utf8",
    maxBuffer: 1024 * 1024,
    env,
  });
-  if (proc.status !== 0) throw new CliError(`system config problem (mosaic-config exit ${proc.status}): ${proc.stderr.trim()}`, 3);
+  if (proc.status !== 0) {
+    const label = instance !== null && instance !== "dev" ? `the config of instance ${instance}` : env.MOSAIC_CONFIG ? "the system config MOSAIC_CONFIG names" : "the default system config";
+    const known = instanceProblem(String(proc.stderr ?? "").trim(), label);
+    throw new CliError(known ? `system config problem (mosaic-config exit ${proc.status}): ${known}` : systemConfigProblem(proc, env, label), 3);
+  }
  try {
    return JSON.parse(proc.stdout);
  } catch {
@@ -86,7 +118,7 @@ function trackerFor(system, b, warn, dataRoot) {
    if (dataRoot && managedState({ dataRoot, business: b.id, project: id, entry }) === 'reserved') continue;
    if (!existsSync(projectFilePath(entry.root))) continue;
    const project = loadProject(entry.root);
-    if (project.id !== id) throw new CliError(`project file ${project.file} has id ${project.id}, but business ${b.id} declares it as ${id}`, 3);
+    if (project.id !== id) throw new CliError(`project file of project ${id} has id that does not match the declared project key`, 3);
    const vars = resolveInstance({ system, business: b, project, instance: first }).vars;
    if (vars["tracker.project"] !== undefined) named.push({ id, vars });
  }
@@ -123,17 +155,20 @@ function accessFor(system, env, warn) {
  try {
    context = accessContextFor(system, env);
  } catch (e) {
-    warn(`access.json is present but its context can't be read, so no granted user binds: ${e.message}`);
+    // #1873: the error's message can quote a path; only a plain code is relayed.
+    const code = typeof e?.code === "string" && /^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(e.code) ? ` (${e.code})` : "";
+    warn(`access.json is present but its context can't be read, so no granted user binds${code}`);
    return null;
  }
  // sage-3153: one line at boot when the loader refuses the file, so the owner sees why no user
-  // binds. The loader's messages can quote the file, so the line names only the path and a code
-  // from its exit code: 4 is a file it could not open as a regular file, anything else invalid.
+  // binds. The loader's messages can quote the file, so the line names only the file, by label, and
+  // a code from its exit code: 4 is a file it could not open as a regular file, anything else
+  // invalid. #1873: no host path.
  try {
    loadAccess(file, context);
  } catch (e) {
    const code = e instanceof BusinessError && e.exitCode !== 4 ? "access-invalid" : "access-unreadable";
-    warn(`access file refused at boot (${code}), no granted user binds until it is fixed: ${file}`);
+    warn(`access file refused at boot (${code}), no granted user binds until it is fixed: access.json in the config directory`);
  }
  return { file, context };
 }
@@ -144,10 +179,29 @@ export const consoleOwners = (sso) =>
 // The `{op: 'boot'}` config for packages/bus/src/process.mjs, for one
 // business. The host holds a reader capability for the notifier and binds
 // launches later through bindLaunch, so `launches` starts empty.
+// #1873 A3: the organization's root and project agent copies, read once here. The root file is read
+// through loadRootAgents and the organization file through the organization's own writer; the
+// snapshot is plain data that the broker and the launcher re-apply to every later read of the
+// organization file, so a root file change takes effect at the next boot only. A root file that
+// refuses hides the root level (design section 6): no root copy, and the organization still boots.
+export function copiesAtBoot({ businessId, env = process.env, warn = () => {}, dataRoot = null }) {
+  const dir = configDir(env), roles = rolesDir(env);
+  loadBusiness(businessId, { dir, rolesDir: roles, dataRoot });
+  const { document } = organizationWriter({ dir, rolesDir: roles, dataRoot }).read(businessId);
+  let root = null;
+  try { root = loadRootAgents(dir, { rolesDir: roles }); }
+  catch (error) {
+    if (!(error instanceof BusinessError)) throw error;
+    warn(`root agent file refused, so ${businessId} runs no root copies until it is fixed and the bus restarts: ${error.message}`);
+  }
+  const snapshot = materializeCopies({ orgId: businessId, doc: document, root, rolesDir: roles });
+  return { snapshot, business: withCopies(document, businessFilePath(businessId, dir), { rolesDir: roles, snapshot, dataRoot }) };
+}
+
 export function bootConfig({ system, businessId, orgRoot = system.dataRoot, env = process.env, warn = () => {} }) {
  return business(() => {
    const vars = systemVars(system);
-    const b = loadBusiness(businessId, { dir: configDir(env), rolesDir: rolesDir(env) });
+    const { snapshot, business: b } = copiesAtBoot({ businessId, env, warn, dataRoot:system.dataRoot });
    const resolved = {};
    for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: vars, business: b, instance });
    const config = {
@@ -158,6 +212,8 @@ export function bootConfig({ system, businessId, orgRoot = system.dataRoot, env
      organization: {dir:configDir(env),rolesDir:rolesDir(env),system:vars},
      launches: [],
      readers: [b.id],
+      // Present only when the organization has a copy, so a boot with none is the boot it was.
+      ...(Object.keys(snapshot.copies).length ? { copies: snapshot } : {}),
    };
    const tracker = trackerFor(vars, b, warn, orgRoot);
    if (tracker) {
@@ -0,0 +1,39 @@
+// D1 (#1873): the supervisor of a detached dev-local-owner Console. `mosaic console start
+// --dev-local-owner --detach` starts this process in its own session (org-console.mjs
+// detachedSupervisor). It starts the Console exactly as a foreground start does, with --supervised,
+// and relaunches it when the owner restarts it (F3). Its one stdout line is the start's reply:
+// { receipt, warnings } or { error, exitCode, warnings }. Later warnings go to stderr, the log.
+import { consoleStart } from './org-console.mjs';
+import { CliError } from './errors.mjs';
+
+const { configDir, dataRoot, instance, port, bind, allowHosts } = JSON.parse(process.argv[2]);
+const warnings = [];
+let started = false;
+const warn = s => { if (started) process.stderr.write(s); else warnings.push(s); };
+// The starting CLI can be gone before the reply (Ctrl-C, a wrapper's timeout). The Console is
+// started and its state names it, so a reply nobody reads is dropped and supervision goes on.
+process.stdout.on('error', () => {});
+const reply = value => new Promise(resolve => process.stdout.write(`${JSON.stringify(value)}\n`, () => resolve()));
+// A stop signal during the start (the CLI's start timeout signals this process group) is kept and
+// acted on once the start settles, so a failed start still releases the start lock.
+let stopAsked = false;
+const early = () => { stopAsked = true; };
+for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, early);
+let receipt;
+try {
+  receipt = await consoleStart({ configDir, dataRoot, instance, env: process.env }, { devLocalOwner: true, port, bind, allowHosts, warn });
+} catch (e) {
+  const exitCode = e instanceof CliError ? e.exitCode : 1;
+  if (!(e instanceof CliError)) process.stderr.write(`${e?.stack ?? e}\n`);
+  await reply({ ...(e instanceof CliError ? { error: e.message } : {}), exitCode, warnings });
+  process.exit(exitCode);
+}
+started = true;
+// A stop signal ends supervision cleanly, as in the foreground (cli.mjs consoleCommand).
+const stop = () => receipt.stop();
+for (const signal of ['SIGINT', 'SIGTERM']) { process.off(signal, early); process.on(signal, stop); }
+if (stopAsked) stop();
+await reply({ receipt, warnings });
+const code = await receipt.done;
+if (code !== 0) process.stderr.write(`mosaic: console stopped unexpectedly (${code})\n`);
+process.exit(code);
@@ -0,0 +1,60 @@
+// M3: executable and instance boundaries. Presence is checked with lstat, so
+// broken links and unreadable metadata never turn a deployed path into dev.
+import { constants, lstatSync, openSync, fstatSync, readFileSync, closeSync, writeFileSync, fchmodSync, mkdirSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+const configDir = (env = process.env) => dirname(resolve(env.MOSAIC_CONFIG || join(homedir(), '.config/mosaic-dev/config.json')));
+
+const CODE_ROOT = resolve(import.meta.dirname, '../../..');
+export function present(file) {
+  try { lstatSync(file); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; }
+}
+function metadata(file, label, check) {
+  let fd;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > 4096 || !check(st)) throw new Error('metadata refused');
+    return JSON.parse(readFileSync(fd, 'utf8'));
+  } catch { throw new Error(`${label} is missing or invalid`); }
+  finally { if (fd !== undefined) closeSync(fd); }
+}
+export function buildStamp(root = CODE_ROOT) {
+  const file = join(root, '.stack-build.json');
+  if (!present(file)) return null;
+  const doc = metadata(file, 'build stamp', st => !(st.mode & 0o222));
+  if (!doc || Object.keys(doc).length !== 1 || !/^[0-9a-f]{40}$/.test(doc.commit) || doc.commit !== basename(root)) throw new Error('build stamp does not name this copy commit');
+  return doc;
+}
+export function assertBuildStart({ serve = false, sso = false, devOwner = false, devBind = null, devNames = [] } = {}) {
+  const stamp = buildStamp();
+  if (stamp && (devOwner || devBind !== null || devNames.length)) throw new Error('stamped build refuses dev-local-owner and LAN flags');
+  if (stamp && serve && !sso) throw new Error('stamped build serve requires --sso');
+  return stamp;
+}
+export function assertDevInstance(system, env = process.env) {
+  if (present(join(configDir(env), 'accounts.json'))) throw new Error('--dev-local-owner refuses accounts.json');
+  if (system.console?.sso) throw new Error('--dev-local-owner refuses console.sso');
+  if (present(join(system.dataRoot, '.deployed'))) throw new Error('--dev-local-owner refuses .deployed');
+}
+const instanceName = dir => /^mosaic-([a-z][a-z0-9]{1,15})$/.exec(basename(dir))?.[1] ?? 'dev';
+export function assertDeployed(system, dir = configDir()) {
+  const doc = metadata(join(system.dataRoot, '.deployed'), '.deployed', st => (st.mode & 0o777) === 0o444 && st.uid === process.geteuid());
+  if (!doc || Object.keys(doc).length !== 1 || doc.instance !== instanceName(dir)) throw new Error('.deployed does not name this instance');
+}
+// Both managed host cases install through case2-install.sh. Existing metadata
+// must validate; an install never replaces it or follows a destination link.
+export function writeDeployment(system, dir = configDir()) {
+  // Default-instance bootstrap creates the config before its data directory.
+  mkdirSync(system.dataRoot, { recursive: true, mode: 0o700 });
+  const root = lstatSync(system.dataRoot);
+  if (!root.isDirectory() || root.uid !== process.geteuid() || (root.mode & 0o022)) throw new Error('.deployed data root must be an owned directory without public write');
+  const file = join(system.dataRoot, '.deployed');
+  if (present(file)) {
+    const doc = metadata(file, '.deployed', st => (st.mode & 0o777) === 0o444 && st.uid === process.geteuid());
+    if (!doc || Object.keys(doc).length !== 1 || doc.instance !== instanceName(dir)) throw new Error('.deployed does not name this instance');
+    return;
+  }
+  const fd = openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o444);
+  try { writeFileSync(fd, JSON.stringify({ instance: instanceName(dir) }) + '\n'); fchmodSync(fd, 0o444); } finally { closeSync(fd); }
+}
@@ -46,7 +46,7 @@ function noCredentials(env) {
 function ownedPrivate(path, directory) {
  const st = lstatSync(path);
  if (st.isSymbolicLink() || (directory ? !st.isDirectory() : !st.isFile()) || st.uid !== process.getuid() || (st.mode & 0o077))
-    throw refuse('fixture-state-unsafe', `${path} is not a private ${directory ? 'directory' : 'file'} of this user`);
+    throw refuse('fixture-state-unsafe', `${directory ? 'dev-fixture directory' : 'fixture file'} is not a private ${directory ? 'directory' : 'file'} of this user`);
 }

 // The recorded fixture, or null when there is none. Anything malformed refuses.
@@ -56,19 +56,19 @@ export function readFixture(dataRoot) {
  catch (e) { if (e.code === 'ENOENT') return null; throw e; }
  let fd;
  try { fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW); }
-  catch (e) { if (e.code === 'ENOENT') return null; throw refuse('fixture-state-unsafe', `${file} can't be opened (${e.code})`); }
+  catch (e) { if (e.code === 'ENOENT') return null; throw refuse('fixture-state-unsafe', `fixture.json can't be opened (${e.code})`); }
  let doc;
  try {
    const st = fstatSync(fd);
-    if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) throw refuse('fixture-state-unsafe', `${file} is not a private file of this user`);
+    if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) throw refuse('fixture-state-unsafe', 'fixture.json is not a private file of this user');
    doc = JSON.parse(readFileSync(fd, 'utf8'));
-  } catch (e) { if (e instanceof CliError) throw e; throw refuse('fixture-state-invalid', `${file} is not JSON`); }
+  } catch (e) { if (e instanceof CliError) throw e; throw refuse('fixture-state-invalid', 'fixture.json is not JSON'); }
  finally { closeSync(fd); }
  const m = LOOPBACK.exec(doc?.endpoint ?? '');
-  if (!m) throw refuse('fixture-endpoint-not-loopback', `${file} names an endpoint that is not http://127.0.0.1:<port>`);
+  if (!m) throw refuse('fixture-endpoint-not-loopback', 'fixture.json names an endpoint that is not http://127.0.0.1:<port>');
  if (doc.fixtureVersion !== 1 || doc.model !== 'deterministic' || Number(m[1]) !== doc.port || !Number.isSafeInteger(doc.pid) || doc.pid < 2
    || typeof doc.instance !== 'string' || JSON.stringify(doc.entry) !== JSON.stringify(FIXTURE_ENTRY))
-    throw refuse('fixture-state-invalid', `${file} is not a fixture record`);
+    throw refuse('fixture-state-invalid', 'fixture.json is not a fixture record');
  return doc;
 }

@@ -79,12 +79,13 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { closeSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, rmSync, statSync, symlinkSync, writeSync, chmodSync } from "node:fs";
 import { createServer } from "node:net";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { GIT_GRACE_MS, GIT_TIMEOUT_MS } from "../../seat/src/checkout.mjs";
 import { gitSocketPath } from "../../seat/src/session.mjs";
 import { gateEnv, isMosaicStack, rootHits, runGate } from "../../seat/src/landing.mjs";
 import { BUNDLE_MAX, dropLand, finishLand, FSCK, HAVE_MAX, prepareLand, publish, push, review, validBranch, workRef, WorkingError } from "../../seat/src/working.mjs";
 import { CliError } from "./errors.mjs";
+import { ID_PATTERN } from "../../organization/src/vocabulary.mjs";
 import { withProcessing } from '../../processing-control/src/effects.mjs';

 const HEADER_MAX = 4096;
@@ -385,7 +386,7 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env
      if (!p) throw new Refusal("unknown-project");
      mkdirSync(logs, { recursive: true, mode: 0o700 });
      prepared = await prepareLand({ ...where, root: p.root, taskRef: task_ref, commit: facts.commit, dir: logs, name: id, rootHits, message: (m) => landMessage(facts, m) });
-      if (!(await gate.classify(p.root, env))) throw new Refusal("gate-missing", `${p.root} isn't a mosaic-stack checkout with node_modules`);
+      if (!(await gate.classify(p.root, env))) throw new Refusal("gate-missing", `project ${facts.project} isn't a mosaic-stack checkout with node_modules`);
      symlinkSync(join(p.root, "node_modules"), join(prepared.worktree, "node_modules"));
    } catch (e) {
      if (prepared) await dropLand({ ...where, worktree: prepared.worktree }).catch((x) => log(`git socket: ${id}: ${x.message}`));
@@ -398,7 +399,9 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env
        const r = await gate.run({ worktree: prepared.worktree, logs, env: gateEnv(env), signal: AbortSignal.any([slot.abort.signal, scope.signal]) });
        scope.guard();
        if (r.aborted || slot.abort.signal.aborted) throw new Refusal("host-closing", "the host closed during the gate; nothing moved");
-        if (!r.ok) throw new Refusal("gate-failed", `${r.step} failed, see ${r.log}`);
+        // The detail reaches the role, so the log is named inside the bus host directory, never by
+        // host path (PR #1916); its file name only when it passes the id pattern.
+        if (!r.ok) throw new Refusal("gate-failed", `${r.step} failed, see land/${id}${ID_PATTERN.test(basename(r.log ?? "")) ? `/${basename(r.log)}` : ""} in the bus host directory`);
        await finishLand({ ...where, land: prepared, record: (m) => op({ op: "recordLand", ticket, land: { ...m, reviewed, base, patch_id } }) });
      } finally {
        await dropLand({ ...where, worktree: prepared.worktree }).catch((x) => log(`git socket: ${id}: ${x.message}`));
@@ -503,7 +506,7 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env

  async function listen() {
    if (existsSync(path)) {
-      if (!lstatSync(path).isSocket()) throw new CliError(`${path} exists and isn't a socket`, 3);
+      if (!lstatSync(path).isSocket()) throw new CliError("git socket path exists and isn't a socket", 3);
      rmSync(path);
    }
    server = createServer((socket) => {
@@ -54,10 +54,10 @@ function readState(file, found = () => {}) {
    state = JSON.parse(readFileSync(file, "utf8"));
  } catch (e) {
    if (e.code === "ENOENT") return null;
-    throw new CliError(`bus host state is unreadable: ${file}`, 3);
+    throw new CliError("bus host state is unreadable", 3);
  }
  if (!state || !Number.isSafeInteger(state.pid) || typeof state.startTime !== "string" || typeof state.business !== "string") {
-    throw new CliError(`bus host state is malformed: ${file}`, 3);
+    throw new CliError("bus host state is malformed", 3);
  }
  return { ...state, live: startTimeOf(state.pid) === state.startTime };
 }
@@ -94,7 +94,7 @@ export function claimHostLock(dataRoot, state, { found = () => {}, between = ()
      const prior = readState(file, found);
      if (!prior) continue;
      if (prior.live) throw new CliError(`a bus host already runs for ${prior.business} (pid ${prior.pid})`, 3);
-      if (refuseStale) throw new CliError(`stale bus host lock: ${file}`, 3);
+      if (refuseStale) throw new CliError("stale bus host lock", 3);
      between();
      try {
        renameSync(file, aside);
@@ -111,7 +111,7 @@ export function claimHostLock(dataRoot, state, { found = () => {}, between = ()
      }
      rmSync(aside, { force: true });
    }
-    throw new CliError(`${file} kept changing; no bus host started`, 3);
+    throw new CliError("bus host lock kept changing; no bus host started", 3);
  } finally {
    rmSync(tmp, { force: true });
  }
@@ -228,7 +228,10 @@ export async function startHost({ boot, business, notifier = null, options = nul
  if (ready?.ok !== true) {
    await ended(broker, 5000);
    release();
-    throw new CliError(`broker refused to start: ${typeof ready?.error === "string" ? ready.error : "startup-refused"}`, 3);
+    const code = typeof ready?.error === "string" ? ready.error : "startup-refused";
+    // org-defscan: the broker's reason names the definition and key that hold a credential, never the text.
+    const why = code === "definition-holds-credential" && typeof ready?.reason === "string" ? `: ${ready.reason.slice(0, 300)}` : "";
+    throw Object.assign(new CliError(`broker refused to start: ${code}${why}`, 3), code === "definition-holds-credential" ? { code } : {});
  }

  // Every step from here to host.json shares one failure path: it stops the
@@ -364,7 +367,12 @@ export async function startHost({ boot, business, notifier = null, options = nul
    close(1);
  });

-  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
+  // #1873 CB3: the copies the broker's boot proved live, names only; anything malformed counts as none.
+  const copyBound = {};
+  if (ready.copyBound && typeof ready.copyBound === "object" && !Array.isArray(ready.copyBound))
+    for (const [instance, services] of Object.entries(ready.copyBound))
+      if (Array.isArray(services) && services.every((s) => typeof s === "string")) copyBound[instance] = Object.freeze([...services]);
+  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, copyBound: Object.freeze(copyBound), pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
 }

 // `mosaic bus stop`: SIGTERM to the recorded host, after checking that the
@@ -120,7 +120,9 @@ function setArgs(parsed) {
    try {
      args.vars = JSON.parse(readFileSync(values["--vars"], "utf8"));
    } catch (error) {
-      throw new CliError(`--vars ${values["--vars"]}: ${error.message}`, 4);
+      // Name the flag and the error kind, never the file's path or bytes (PR #1916).
+      const code = typeof error?.code === "string" && /^E[A-Z0-9]+$/.test(error.code) ? error.code : "unreadable";
+      throw new CliError(`--vars file: ${error instanceof SyntaxError ? "not valid JSON" : code}`, 4);
    }
  }
  if (launch !== undefined) args.launch = launch;
@@ -143,9 +143,11 @@ import { createHash } from 'node:crypto';
 import { watchModelOutput } from './model-stall.mjs';
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
-import { configDir, loadBusiness, resolveInstance, systemVars } from "../../organization/src/index.mjs";
+import { configDir, resolveInstance, systemVars } from "../../organization/src/index.mjs";
 import { organizationWriter } from "../../organization/src/organization.mjs";
-import { businessFilePath, validateBusinessDocument } from "../../organization/src/organization-config.mjs";
+import { quietMessage } from "../../organization/src/org-registry.mjs";
+import { businessFilePath } from "../../organization/src/organization-config.mjs";
+import { copyOf, copyRefusal, loadWithCopies, projectRefusal, promoteCopies, withCopies } from "../../organization/src/agent-copies.mjs";
 import { selectModelProvider } from "../../plugins/src/model-provider-selection.mjs";
 import { THREAD_DEFINITIONS } from "../../organization/src/vocabulary.mjs";
 import { limitHit } from "../../organization/src/launch.mjs";
@@ -200,13 +202,24 @@ class Refusal extends Error {
  }
 }

+// #1873: a refusal's reason never quotes a host path. A Node system error's message names one,
+// so it reads as the call and its code (org-registry quietMessage). Any other message is the
+// host's own text or text relayed from a module (a preflight, the loader, a bundle or checkout
+// error); relay() replaces every absolute or home path and file: URL in it with "a host path".
+const HOST_PATH = /(^|[\s'"(=:,[<])(?:~?\/(?!\/)|file:)[^\s'"),\]>;]*/gi;
+export const relay = (text) => String(text).replace(HOST_PATH, (_, before) => `${before}a host path`);
+const reason = (e) => quietMessage(e, "a host file") ?? relay(e?.message ?? e);
+const relayed = (failed) => failed && (typeof failed.message === "string" ? { ...failed, message: relay(failed.message) } : failed);
+
 // A harness module runs with the host's authority, and anything it throws refuses the launch
-// and names the module rather than escaping the host.
+// and names the module rather than escaping the host. What it threw is named by its system code
+// or its class, never its message, which the host didn't write (#1873).
 function call(name, what, fn) {
  try {
    return fn();
  } catch (e) {
-    throw new Refusal("harness-failed", `harness ${name} ${what}: ${e.message}`);
+    const thrown = quietMessage(e, "a host file") ?? `threw ${/^[A-Za-z][A-Za-z0-9]{0,39}$/.test(String(e?.name)) ? e.name : "a value"} without a system code`;
+    throw new Refusal("harness-failed", `harness ${name} ${what}: ${thrown}`);
  }
 }

@@ -244,10 +257,16 @@ export function createLauncher({
  git = {},
  stopOptions = {},
  log = (l) => process.stderr.write(`mosaic-bus: ${l}\n`),
+  // #1873 A3: the root and project agent copies the bus booted with (config.mjs copiesAtBoot), or
+  // null. Every read of the organization file here re-applies this snapshot, never the root file.
+  copies = null,
 }) {
  if (testProxy !== null && system.proxy)
    throw Object.assign(new Error("testProxy skips P2 admission, so it is refused with system.proxy set"), { code: "test-proxy-refused" });
  const dataRoot = system.dataRoot;
+  // #1873 CB3: a copy the bus's boot proved live at its service launches as bound; the bus decides
+  // which, and admits each launch again on its own launch authority. The rest stay as booted.
+  if (copies && host.copyBound) copies = promoteCopies(copies, host.copyBound);
  function admission(generation = null) {
    try { return assertProcessing(dataRoot, generation); }
    catch (e) {
@@ -257,7 +276,8 @@ export function createLauncher({
  }
  // Row 64 (#1557): where a role's skills are read from; scripts/skill.sh activate fills it.
  const skillsDir = join(system.instanceRoot ?? dataRoot, "skills-enabled");
-  let b = loadBusiness(host.business, { dir: configDir(env), rolesDir: rolesDir(env) });
+  const loadOrg = () => loadWithCopies(host.business, { dir: configDir(env), rolesDir: rolesDir(env), dataRoot:system.instanceRoot ?? dataRoot, snapshot: copies?.org === host.business ? copies : null });
+  let b = loadOrg();
  const vars = systemVars(system);

  // Sessions an earlier host left in sessions.json: it died without ending
@@ -267,7 +287,8 @@ export function createLauncher({
  try {
    leftover = readSessions(dataRoot).filter((s) => s.business === b.id);
  } catch (e) {
-    throw new CliError(`${e.message}; check which sessions still run, then move the file aside`, 3);
+    // readSessions names the file by its place under the data root (#1873); anything else is unreadable.
+    throw new CliError(`${e?.name === "SeatError" ? e.message : "sessions file is unreadable"}; check which sessions still run, then move the file aside`, 3);
  }
  const registry = new Registry(dataRoot, { readOnly: !launches });
  // Row 269: earlier-host runs still live after recover(). check() sees each while it lives.
@@ -353,12 +374,19 @@ export function createLauncher({
    const admissionGeneration = admission().generation;
    let businessRevision;
    try {
-      const snapshot = organizationWriter({dir:configDir(env),rolesDir:rolesDir(env)}).read(host.business);
+      const snapshot = organizationWriter({dir:configDir(env),rolesDir:rolesDir(env),dataRoot:system.instanceRoot ?? dataRoot}).read(host.business);
      businessRevision = snapshot.revision;
-      b = validateBusinessDocument(snapshot.document, businessFilePath(host.business, configDir(env)), {rolesDir:rolesDir(env)});
+      b = withCopies(snapshot.document, businessFilePath(host.business, configDir(env)), {rolesDir:rolesDir(env), dataRoot:system.instanceRoot ?? dataRoot, snapshot: copies?.org === host.business ? copies : null});
    } catch(e){throw new Refusal("organization-refused",e.message);}
    if (!b.launch) throw new Refusal("launch-not-configured", `business ${b.id} has no launch block`);
-    if (!(pm ? instance === b.launch.by : b.launch.instances.includes(instance) || (human && Object.hasOwn(b.roles, instance)))) throw new Refusal("instance-not-listed");
+    // #1873 A3: an unbound or refused copy never launches. The message names the copy, its project
+    // and the missing service names or the refusal, never a value.
+    const copyRefused = copyRefusal(b, instance);
+    if (copyRefused) throw new Refusal(copyRefused.code, copyRefused.message);
+    // #1873 A3: a bound copy isn't on the chief's list. It launches when the human asks, or for a
+    // thread, which only a human or a granted user makes, naming the copy.
+    const boundCopy = copyOf(b, instance)?.state === "instance" && Object.hasOwn(b.roles, instance);
+    if (!(pm ? instance === b.launch.by : b.launch.instances.includes(instance) || (human && Object.hasOwn(b.roles, instance)) || (thread && boundCopy))) throw new Refusal("instance-not-listed");
    const threaded = THREAD_DEFINITIONS.includes(b.roles[instance]?.definition);
    if (threaded && !thread) throw new Refusal("thread-required", `${instance} runs only for a thread`);
    if (!threaded && thread) throw new Refusal("thread-not-allowed", `${instance} isn't a thread instance`);
@@ -368,18 +396,20 @@ export function createLauncher({
    // workspace and the thread's store, so no session of the instance starts while one lives.
    if (threaded && [...registry.sessions, ...leftover, ...survivors.filter(liveRun)].some((s) => s.business === b.id && s.instance === instance && !s.session))
      throw new Refusal("legacy-run-live", `a run of ${instance} with no session is still live`);
-    let resolved;
+    let resolved, definitionEntry;
    try {
-      resolved = resolveInstance({ system: vars, business: b, instance });
+      resolved = resolveInstance({ system: vars, business: b, instance, enforcePlugins:true, pluginRoot:system.instanceRoot ?? dataRoot });
+      // org-defscan (#1873): the entry the contract came from, taken before any await lets another check replace b.
+      definitionEntry = String(resolved.definition).startsWith("org:") ? b.definitions?.[resolved.definition] : undefined;
    } catch (e) {
-      throw new Refusal("unsupported-harness", e.message);
+      throw new Refusal(e.code === "plugin-disabled" ? "plugin-disabled" : "unsupported-harness", e.code === "plugin-disabled" ? e.plugin : relay(e.message));
    }
    // Resolve the business's current provider modules with a fresh loader; a refused
    // load never inherits a previous business's authority.
    const providerNames = b.plugins?.['model-provider'] ?? [];
    const providerModules = new Map();
    if (providerNames.length) {
-      const loader = makeLoader({ log: entry => record({ ...entry, instance }) });
+      const loader = makeLoader({ dataRoot:system.instanceRoot ?? dataRoot, log: entry => record({ ...entry, instance }) });
      const loaded = await loader.load({ 'model-provider': providerNames });
      if (loaded.refused.length) throw new Refusal('model-provider-unavailable', 'model provider module refused');
      for (const { name, module } of loader.snapshot('model-provider')) providerModules.set(name, module);
@@ -395,17 +425,23 @@ export function createLauncher({
        return sessionModel(resolved, b.launch.models, which, { proxy: Boolean(system.proxy || proxyContext), resolver });
      } catch (e) {
        const code = e instanceof BundleError && (e.code === "no-route" || e.code.startsWith("proxy-") || e.code.startsWith("model-")) ? e.code : "unsupported-harness";
-        throw new Refusal(code, e.message);
+        throw new Refusal(code, relay(e.message));
      }
    };
    const primary = routeOf("primary");
    const fallback = hasFallback(resolved) ? routeOf("fallback") : null;
-    if (!resolved.contract) throw new Refusal("no-role-contract", `role ${resolved.definition} has no contract file`);
+    if (!resolved.contract && typeof resolved.instructions !== "string") throw new Refusal("no-role-contract", `role ${resolved.definition} has no contract file`);
+    // org-defscan (#1873): an org: definition, as this check just read it, passes the bus's held-secret check before a contract exists.
+    if (String(resolved.definition).startsWith("org:")) {
+      const { held } = (await host.op({ op: "definitionScan", business: b.id, definition: resolved.definition, entry: definitionEntry })) ?? {};
+      if (typeof held === "string") throw new Refusal("definition-holds-credential", `${instance}'s definition ${resolved.definition} holds a credential in ${held}`);
+      if (held !== null) throw new Refusal("organization-refused", `the bus did not check ${instance}'s definition ${resolved.definition}`);
+    }
    // Row 64 (#1557): every skill on the role's list is enabled and readable before a run exists.
    try {
      readSkills(resolved.skills, skillsDir);
    } catch (e) {
-      if (e instanceof BundleError) throw new Refusal(e.code === "skill-not-enabled" ? "skill-not-enabled" : "skill-refused", e.message);
+      if (e instanceof BundleError) throw new Refusal(e.code === "skill-not-enabled" ? "skill-not-enabled" : "skill-refused", relay(e.message));
      throw e;
    }
    // Both of a launch's harnesses must be switched on, whichever it takes.
@@ -415,9 +451,11 @@ export function createLauncher({
    }
    // One harness through a fresh loader, so a refusal never leaves an earlier load's module in use.
    const harnessOf = async (m) => {
-      const loader = makeLoader({ log: (entry) => record({ ...entry, instance }) });
+      const loader = makeLoader({ dataRoot:system.instanceRoot ?? dataRoot, log: (entry) => record({ ...entry, instance }) });
      const { refused } = await loader.load({ harness: [m.harness] });
-      if (refused.length) throw new Refusal("harness-refused", `harness ${m.harness}: ${refused.map((r) => `${r.code}: ${r.message}`).join("; ")}`);
+      // #1873: a loader message can quote the module's path or its load error; only a
+      // missing-export one, which names the export, is relayed. Any other refusal names its code.
+      if (refused.length) throw new Refusal("harness-refused", `harness ${m.harness}: ${refused.map((r) => r.code === "missing-export" ? `${r.code}: ${relay(r.message)}` : String(r.code)).join("; ")}`);
      const module = loader.modules("harness")[0];
      const levels = call(m.harness, "levels", () => module.levels());
      if (!levels.includes(m.thinking)) throw new Refusal("thinking-unsupported", `harness ${m.harness} takes thinking ${levels.join(", ")}, not ${m.thinking}`);
@@ -464,7 +502,7 @@ export function createLauncher({
        }
      }
      const unavailable = sandboxProblem({ bwrap });
-      if (unavailable) throw new Refusal("sandbox-unavailable", unavailable);
+      if (unavailable) throw new Refusal("sandbox-unavailable", relay(unavailable));
      const hit=limitHit(registry.sessions,b.id,b.launch.limits,model);
      if(hit){const error=new Refusal("capacity-full",JSON.stringify(hit));error.limit=hit;throw error;}
      // Row 125 (#1619, REQ-LIMIT-4): the limit checks. An answer that isn't an allow refuses,
@@ -512,7 +550,8 @@ export function createLauncher({
    // and the helper returns the last one they saw.
    const pickRoute = async (proxyOf) => {
      let sessionProxy = await proxyOf(primary);
-      const failed = call(primary.harness, "preflight", () => harness.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy }));
+      // #1873: a preflight's message is the module's own text, relayed with host paths replaced.
+      const failed = relayed(call(primary.harness, "preflight", () => harness.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy })));
      if (failed) {
        if (!fallback) throw new Refusal(failed.code, failed.message);
        // The fallback only on a failed primary preflight, and only at launch (row 65). Any refusal of
@@ -522,7 +561,7 @@ export function createLauncher({
          throw e;
        });
        sessionProxy = await proxyOf(fallback);
-        const also = call(fallback.harness, "preflight", () => second.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy }));
+        const also = relayed(call(fallback.harness, "preflight", () => second.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy })));
        if (also) throw new Refusal(also.code, `fallback ${fallback.harness}: ${also.message} (primary ${primary.harness}: ${failed.message})`);
        [model, harness, route, routeReason] = [fallback, second, "fallback", failed.code];
      }
@@ -539,12 +578,12 @@ export function createLauncher({
      await pickRoute(() => standIn);
      await gate(model, harness, null);
      admission(admissionGeneration);
-      return { resolved, model, account: null, harness, route, routeReason, admissionGeneration, resolver };
+      return { resolved, model, account: null, harness, route, routeReason, admissionGeneration, resolver, revision: businessRevision };
    }
    const sessionProxy = await pickRoute(proxyFor);
    const account = await gate(model, harness, sessionProxy);
    admission(admissionGeneration);
-    return { resolved, model, account, harness, route, routeReason, admissionGeneration, sessionProxy, resolver };
+    return { resolved, model, account, harness, route, routeReason, admissionGeneration, sessionProxy, resolver, revision: businessRevision };
  }

  // Reread host state on every new-run path, including opens/clears queued before archive.
@@ -554,6 +593,8 @@ export function createLauncher({
    const row = rows.find(r => r.thread === thread && r.session === session);
    if (!row) throw new Refusal("session-not-found");
    if (row.archived) throw new Refusal("project-archived");
+    // #1873 A3: the thread's project no longer takes its instance: the union refuses, or excludes it.
+    if (row.projectRefused) throw new Refusal(row.projectRefused.code, row.projectRefused.reason);
  }

  // Bundle, spawn, bind, register, hand over the capability.
@@ -616,13 +657,24 @@ export function createLauncher({
    // (a mapping published before the seed and records finished) is left out and the launch goes on without
    // it. Ordinary mappings also recheck archive state through the same host admission.
    const codeProjects = {};
+    // #1873 A3: an instance gets only the code projects it works in: a project agent its own one, and
+    // no instance a project that excludes it or whose union refuses. A project agent refuses when its
+    // own project isn't admitted. A checkout an earlier launch left in the workspace for a project
+    // the instance may not work in now is hidden from the session, never deleted (sandbox.mjs).
+    const own = copyOf(b, instance)?.project ?? null;
+    const declared = new Set();
    for (const [project, entry] of Object.entries(b.projects)) {
      if (entry.kind === 'library') continue;
+      declared.add(project);
+      if (own !== null && project !== own) continue;
+      const unavailable = projectRefusal(b, instance, project);
+      if (unavailable) { record({ event: "checkout-skipped", instance, project, reason: unavailable.code }); continue; }
      let answer = null;
      try { answer = await host.op({ op: 'request.admission', business: b.id, project }); } catch (e) { answer = { ready: false, code: e.code ?? 'admission-unavailable' }; }
      if (answer?.ready !== true) { record({ event: "checkout-skipped", instance, project, reason: answer?.code ?? 'project-pending' }); continue; }
      codeProjects[project] = entry;
    }
+    if (own !== null && !Object.hasOwn(codeProjects, own)) throw new Refusal("project-refused", `${instance} works only in project ${own}, which isn't ready`);
    await threadAdmission(thread, session);
    let checkouts;
    try {
@@ -631,7 +683,7 @@ export function createLauncher({
        return ensureCheckouts({ workspace, projects: codeProjects, env });
      });
    } catch (e) {
-      if (e instanceof CheckoutError) throw new Refusal("checkout-failed", `${e.project}: ${e.message}`);
+      if (e instanceof CheckoutError) throw new Refusal("checkout-failed", `${e.project}: ${relay(e.message)}`);
      throw e;
    }
    for (const c of checkouts) {
@@ -646,9 +698,30 @@ export function createLauncher({
      catch (error) { throw new Refusal(error.code ?? 'proxy-down', error.code ?? 'proxy-down'); }
      if (!admittedProxy || typeof admittedProxy.key !== 'string' || !admittedProxy.key || admittedProxy.baseUrl !== `http://127.0.0.1:${system.proxy.port}`) throw new Refusal('proxy-down', 'proxy-down');
    }
-    let harness, route, routeReason, sessionProxy, resolver;
-    ({resolved,model,account,harness,route,routeReason,sessionProxy,resolver}=await check(instance,{pm:instance===b.launch.by,thread,session,human,proxyContext:admittedProxy,proxyReady:true}));
+    let harness, route, routeReason, sessionProxy, resolver, revision;
+    ({resolved,model,account,harness,route,routeReason,sessionProxy,resolver,revision}=await check(instance,{pm:instance===b.launch.by,thread,session,human,proxyContext:admittedProxy,proxyReady:true}));
    admission(admissionGeneration);
+    // #1873 A3: check() read the organization again. A project that excluded or refused this
+    // instance while its checkouts were prepared refuses the launch; the next one leaves it out.
+    for (const project of Object.keys(codeProjects)) {
+      const unavailable = projectRefusal(b, instance, project);
+      if (unavailable) throw new Refusal(unavailable.code, unavailable.message);
+    }
+    // #1873 A3: every declared code project this launch leaves out, in the document it started from
+    // or the one check() read, is hidden if an earlier launch left its checkout in the workspace,
+    // whatever kept it out (not admitted, excluded, refused, another project's agent). Only a real
+    // directory can be covered: a tmpfs mounted at a symlink would land on its target, so anything
+    // else at that path refuses the launch, and nothing on the host is changed or removed.
+    for (const [project, entry] of Object.entries(b.projects)) if (entry.kind !== 'library') declared.add(project);
+    const hidden = [];
+    for (const project of declared) {
+      if (Object.hasOwn(codeProjects, project)) continue;
+      const path = join(workspace, project);
+      let stat;
+      try { stat = lstatSync(path); } catch (e) { if (e.code === "ENOENT") continue; throw new Refusal("checkout-unsafe", `${instance}'s workspace path for project ${project} can't be read`); }
+      if (!stat.isDirectory()) throw new Refusal("checkout-unsafe", `${instance}'s workspace path for project ${project} isn't a directory, so it can't be hidden; a person removes it before ${instance} launches again`);
+      hidden.push(path);
+    }
    const { run, runDir } = newRun(dataRoot, b.id);
    let modelKeyId;
    if (admittedProxy) {
@@ -677,7 +750,7 @@ export function createLauncher({
      models: b.launch.models,
      proxy: sessionProxy,
      resolver,
-      contract: readFileSync(resolved.contract, "utf8"),
+      contract: resolved.contract ? readFileSync(resolved.contract, "utf8") : resolved.instructions,
      arbiter: Object.values(b.arbiters).includes(instance),
      tracker,
      library: Object.values(b.projects ?? {}).some(project => project.kind === "library"),
@@ -744,6 +817,7 @@ export function createLauncher({
      gitSocket: git,
      threadStore: store,
      readOnly,
+      hidden,
    };
    admission(admissionGeneration);
    await threadAdmission(thread, session);
@@ -754,7 +828,21 @@ export function createLauncher({
    }
    // One synchronous broker snapshot covers the thread and the entire manifest after every
    // asynchronous preparation read. Admission is the launch boundary; bindLaunch remains a fence.
-    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), thread, session });
+    // #1873 A3: `revision` is the organization file check() resolved the bundle from; a file that
+    // changed since (a narrow, a define's vars, an exclude) refuses, and the next launch resolves anew.
+    // #1873 CB3: a bound copy's launch authority, after the bus re-resolved its binding and proved the
+    // slot live at the service. The final admission and bindLaunch each check it is still current.
+    let copyAuthority = null;
+    if (copyOf(b, instance)?.bound?.length) {
+      // The bus's refusal is the launch's: its code goes to the log and the thread as given.
+      let prepared;
+      try { prepared = await host.op({ op: "copyLaunch", business: b.id, instance, revision }); }
+      catch (e) { throw new Refusal(typeof e?.code === "string" && /^[a-z][a-z0-9-]*$/.test(e.code) ? e.code : "credential-unavailable", `${instance}'s bound services can't be proved live`); }
+      if (typeof prepared?.authority !== "string") throw new Refusal("credential-unavailable", `${instance}'s bound services can't be proved live`);
+      copyAuthority = prepared.authority;
+      admission(admissionGeneration);
+    }
+    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), instance, revision, thread, session, ...(copyAuthority ? { authority: copyAuthority } : {}) });
    if (finalAdmission?.ready !== true) throw new Refusal(finalAdmission?.code ?? "project-pending");
    const managed = registerRuntime(dataRoot, { kind: 'session', business: b.id, run });
    let child;
@@ -783,7 +871,7 @@ export function createLauncher({
      admission(admissionGeneration);
      if (!outerStart) throw new Error("the session process exited at once");
      lock?.update({ run, runPid: child.pid, runStartTime: outerStart });
-      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}) });
+      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}), ...(copyAuthority ? { copyAuthority, revision } : {}) });
      bound = true;
      admission(admissionGeneration);
      entry = {
@@ -804,7 +892,7 @@ export function createLauncher({
      unregisterRuntime(dataRoot, managed.id);
      if (e instanceof Refusal) throw e;
      if (e.code?.startsWith('proxy-')) throw new Refusal(e.code, e.code);
-      throw new Refusal("launch-failed", e.message);
+      throw new Refusal("launch-failed", reason(e));
    }
    children.set(run, exited);
    const outputWatch = admittedProxy ? watchModelOutput({ runDir, armAtFirstTurn: true, keyId: modelKeyId, seconds: system.proxy.firstOutputSeconds ?? 120,
@@ -889,6 +977,8 @@ export function createLauncher({
    for (const i of pending) {
      const session = registry.running(b.id, i.target, null);
      if (!session || !i.project || stopping.has(session.run)) continue;
+      // #1873 A3: a manifest never gains a project its instance doesn't work in.
+      if (projectRefusal(b, i.target, i.project)) continue;
      let projects = [];
      try { projects = JSON.parse(readFileSync(join(session.runDir, 'bundle/manifest.json'), 'utf8')).projects ?? []; } catch {}
      if (!projects.includes(i.project)) {
@@ -982,7 +1072,7 @@ export function createLauncher({
          if (refusedThreads.get(key) === code) return;
          refusedThreads.set(key, code);
          log(`thread ${t.thread} session ${t.session} (${t.instance}): start refused: ${code}`);
-          record({ event: "refused", by: b.human, instance: t.instance, thread: t.thread, session: t.session, code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
+          record({ event: "refused", by: b.human, instance: t.instance, thread: t.thread, session: t.session, code, why: reason(e), ...(e.limit?{limit:e.limit}:{}) });
        }
      });
    }
@@ -1084,7 +1174,7 @@ export function createLauncher({
          if (clearLogged.get(c.op) === code) return;
          clearLogged.set(c.op, code);
          log(`clear ${c.op}: successor ${c.successor} (${c.instance}): start ${CLEAR_HELD.has(code) ? "held" : "refused"}: ${code}`);
-          record({ event: "refused", by: b.human, instance: c.instance, thread: c.thread, session: c.successor, code, why: e.message, ...(e.limit ? { limit: e.limit } : {}) });
+          record({ event: "refused", by: b.human, instance: c.instance, thread: c.thread, session: c.successor, code, why: reason(e), ...(e.limit ? { limit: e.limit } : {}) });
          await host.op({ op: "sessionClearStart", record: { ...where, start: CLEAR_HELD.has(code) ? "held" : "refused", refusal: code } });
          return;
        }
@@ -1144,7 +1234,7 @@ export function createLauncher({
          if (refusedLand.get(h.decision) === code) return;
          refusedLand.set(h.decision, code);
          log(`decision ${h.decision} (${h.instance}): landing start refused: ${code}`);
-          record({ event: "refused", by: b.human, instance: h.instance, decision: h.decision, code, why: e.message, ...(e.limit ? { limit: e.limit } : {}) });
+          record({ event: "refused", by: b.human, instance: h.instance, decision: h.decision, code, why: reason(e), ...(e.limit ? { limit: e.limit } : {}) });
        }
      });
    }
@@ -1189,7 +1279,7 @@ export function createLauncher({
    try {
      done = await act(take);
    } catch (e) {
-      done = { refusal: e instanceof Refusal ? e.code : "launch-failed", why: e.message, limit: e.limit };
+      done = { refusal: e instanceof Refusal ? e.code : "launch-failed", why: reason(e), limit: e.limit };
    }
    const { why, limit, ...closing } = done;
    if (closing.refusal) record({ event: "refused", by: r.by, instance: r.instance, request: r.request, code: closing.refusal, ...(why ? { why } : {}), ...(limit ? { limit } : {}) });
@@ -1297,18 +1387,19 @@ export function createLauncher({
    const bot = out.bot ? { bot: out.bot } : {};
    // The old instance workspace, then (row 269) the instance's session workspaces, each moved
    // whole. A retry moves whichever is still in place.
-    for (const from of [workspaceDir(dataRoot, b.id, r.instance), join(dataRoot, "session-workspaces", b.id, r.instance)]) {
+    for (const [from, label] of [[workspaceDir(dataRoot, b.id, r.instance), "the instance workspace"], [join(dataRoot, "session-workspaces", b.id, r.instance), "the session workspaces"]]) {
      if (!existsSync(from)) continue;
      const to = join(dirname(from), ".retired", `${r.instance}-${transaction}`);
      try {
        mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
        chmodSync(dirname(to), 0o700);
-        if (existsSync(to)) throw new Error(`${to} exists`);
+        if (existsSync(to)) throw new Error("its .retired name already exists");
        renameSync(from, to);
        chmodSync(to, 0o700);
      } catch (e) {
        log(`request ${r.request} (${r.instance}): workspace rename failed: ${e.message}; left at ${from}`);
-        return { transaction, ...bot, refusal: "workspace-rename-failed", why: `${e.message}; left at ${from}` };
+        // #1873: the reason names the workspace by label and the error by code, never a path.
+        return { transaction, ...bot, refusal: "workspace-rename-failed", why: `${quietMessage(e, label) ?? `${label}: ${relay(e.message)}`}; left in place` };
      }
      record({ event: "workspace-retired", instance: r.instance, request: r.request, transaction, path: to });
    }
@@ -1348,7 +1439,7 @@ export function createLauncher({
        if (typeof instance === 'string') await host.op({ op: 'request.launchResult', record: { business: b.id, instance, code: out.ok ? null : out.error, run: out.ok ? out.result.run : null } });
        return out;
      };
-      try { b = loadBusiness(host.business, { dir: configDir(env), rolesDir: rolesDir(env) }); }
+      try { b = loadOrg(); }
      catch { return reply({ ok: false, error: 'organization-refused' }); }
      // Product enums and clones are frozen in a session's manifest. A legitimate chief
      // launch may request a drain, never interrupt the turn or start a privileged worker.
@@ -1379,7 +1470,7 @@ export function createLauncher({
      } catch (e) {
        if (!(e instanceof Refusal)) throw e;
        await host.op({ op: "refuse", cap, code: e.code }).catch(() => {});
-        record({ event: "refused", by: who.role, instance, code: e.code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
+        record({ event: "refused", by: who.role, instance, code: e.code, why: reason(e), ...(e.limit?{limit:e.limit}:{}) });
        return reply({ ok: false, error: e.code });
      }
      try {
@@ -1394,7 +1485,7 @@ export function createLauncher({
        const code = e instanceof Refusal ? e.code : "launch-failed";
        log(`launch of ${instance} for ${who.role} failed: ${e.message}`);
        await host.op({ op: "refuse", cap, code }).catch(() => {});
-        record({ event: "refused", by: who.role, instance, code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
+        record({ event: "refused", by: who.role, instance, code, why: reason(e), ...(e.limit?{limit:e.limit}:{}) });
        return reply({ ok: false, error: code });
      }
    });
@@ -1408,8 +1499,8 @@ export function createLauncher({
        return await start({ instance: b.launch.by, launchedBy: b.human, ...(await check(b.launch.by, { pm: true })) });
      } catch (e) {
        if (!(e instanceof Refusal)) throw e;
-        record({ event: "refused", by: b.human, instance: b.launch.by, code: e.code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
-        const error = new CliError(`PM launch refused: ${e.code}${e.message !== e.code ? ` (${e.message})` : ""}`, 3);
+        record({ event: "refused", by: b.human, instance: b.launch.by, code: e.code, why: reason(e), ...(e.limit?{limit:e.limit}:{}) });
+        const error = new CliError(`PM launch refused: ${e.code}${reason(e) !== e.code ? ` (${reason(e)})` : ""}`, 3);
        error.code = e.code;
        throw error;
      }
@@ -1460,7 +1551,7 @@ export function createLauncher({
    await recover();
    const path = launchSocketPath(dataRoot);
    if (existsSync(path)) {
-      if (!lstatSync(path).isSocket()) throw new CliError(`${path} exists and isn't a socket`, 3);
+      if (!lstatSync(path).isSocket()) throw new CliError("launch socket path exists and isn't a socket", 3);
      rmSync(path);
    }
    server = createServer((socket) => {
@@ -7,6 +7,9 @@ import { orgSelector } from './org-selector.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 import { fetchPinned } from '../../model-proxy/src/fetch.mjs';
 import { validManagementKey, proxyTiming } from '../../model-proxy/src/common.mjs';
+import { createProxyAdmin } from '../../model-proxy/src/admin-control.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+import { busesStopped, instanceFromConfig } from './proxy-admin-host.mjs';
 const failure = (code, exitCode = 2) => Object.assign(new CliError(code, exitCode), { code });
 // A raw terminal suppresses echo; input is never argv, env, readline history or stdout.
 export function promptProxyKey(io, label) {
@@ -34,12 +37,90 @@ export function promptProxyKey(io, label) {
    io.stdin.setRawMode(true); io.stdin.on('data', data); io.stdin.once('end', end); io.stdin.once('error', failed); io.stdin.resume();
  });
 }
-export async function proxyCommand(args, io, { system, callFor, prompt = promptProxyKey, fetch = fetchPinned }) {
+// #1873: the setup controller the Console's Proxy page uses, for this instance. `admin` is a
+// test seam; the default runs proxy-service.sh, systemctl and the pinned fetch for real.
+function adminFor(io, system, deps) {
+  if (deps.admin) return deps.admin;
+  const config = typeof system === 'function' ? system() : system;
+  const dir = configDir(io.env);
+  return createProxyAdmin({
+    dataRoot: config.dataRoot, configDir: dir, instance: instanceFromConfig(io.env), env: io.env, fetch: deps.fetch ?? fetchPinned,
+    unitDir: deps.unitDir ?? null,
+    buses: () => busesStopped({ dataRoot: config.dataRoot, configDir: dir }),
+    orgs: async () => (await listOrgs({ configDir: dir, dataRoot: config.dataRoot })).filter(org => org.state === 'active').map(org => ({ id: org.id, proxy: 'shared', catalogue: null })),
+  });
+}
+const print = (io, value) => io.stdout.write(JSON.stringify(value) + '\n');
+const hostCode = (error, fallback) => (/^proxy-[a-z-]+$/.test(error?.code ?? '') ? error.code : fallback);
+
+// `mosaic proxy status | unit ... | init-lock ...`: host facts and actions, labels only.
+async function setupCommand(verb, rest, io, { system, deps }) {
+  const admin = adminFor(io, system, deps);
+  try {
+    if (verb === 'status') {
+      if (!(rest.length === 0 || (rest.length === 1 && rest[0] === '--json'))) throw failure('proxy-usage', 4);
+      const status = await admin.status();
+      if (rest[0] === '--json') return print(io, status);
+      const { release, init, unit, fence, initLock } = status;
+      io.stdout.write([
+        `release: ${release.fetched ? `${release.version} (panel ${release.panelVersion}) ${release.verified ? 'hashes verified' : `not verified: ${release.problem}`}` : `not fetched (pinned ${release.version})`}`,
+        `initialized: ${init.initialized ? `yes, port ${init.settings?.port}` : init.partial ? `partly (${init.files.filter(f => f.present).map(f => f.label).join(', ')})` : 'no'}`,
+        `unit: ${unit.unit} ${unit.installed ? 'installed' : 'not installed'}, ${unit.active}${unit.pid ? ` pid ${unit.pid}` : ''}${unit.port ? `, port ${unit.port} ${unit.listening ? 'answering' : 'not answering'}` : ''}`,
+        `fence: ${fence.set ? `set${fence.op ? ` after ${fence.op}` : ''}${fence.time ? ` at ${fence.time}` : ''}` : 'clear'}`,
+        `init lock: ${initLock.present ? (initLock.clearable ? 'stale, clearable' : `held: ${initLock.blockers.join('; ')}`) : 'none'}`,
+        `own proxy: ${status.ownProxy.state}`,
+        `next: ${status.next.join(', ')}`,
+      ].join('\n') + '\n');
+      return;
+    }
+    if (verb === 'unit') {
+      const [op, ...flags] = rest;
+      if (op === 'render' && flags.length === 0) { io.stdout.write((await admin.render()).text); return; }
+      if (op === 'status' && (flags.length === 0 || (flags.length === 1 && flags[0] === '--json'))) { print(io, (await admin.status()).unit); return; }
+      if (['install', 'start', 'stop', 'restart'].includes(op) && flags.length === 0) { print(io, await admin.unitAction(op)); return; }
+      throw failure('proxy-usage', 4);
+    }
+    if (verb === 'init-lock') {
+      const [op, ...flags] = rest;
+      if (flags.length !== 0) throw failure('proxy-usage', 4);
+      if (op === 'status') { print(io, (await admin.status()).initLock); return; }
+      if (op === 'clear') { print(io, await admin.initLockClear()); return; }
+      throw failure('proxy-usage', 4);
+    }
+  } catch (error) { if (error instanceof CliError) throw error; throw failure(hostCode(error, 'proxy-unit-failed')); }
+  throw failure('proxy-usage', 4);
+}
+
+export async function proxyCommand(args, io, { system, callFor, prompt = promptProxyKey, fetch = fetchPinned, ...deps }) {
  const [verb, ...rest] = args;
  if (args.includes('--tester')) throw failure('human-required', 3);
-  if (verb === 'init' || verb === 'fetch' || verb === 'fence') {
+  // #1873: every proxy verb, read or write, runs only from a human shell.
+  if (['init', 'fetch', 'fence', 'status', 'unit', 'init-lock'].includes(verb)) {
    try { refuseInsideAgent(io.env); } catch { throw failure('human-required', 3); }
  }
+  if (['status', 'unit', 'init-lock'].includes(verb)) return setupCommand(verb, rest, io, { system, deps: { ...deps, fetch } });
+  if (verb === 'fence' && rest[0] === 'clear' && rest.includes('--restart')) {
+    // #1873: restart the proxy unit, then send the restart evidence to the bus, which re-proves it
+    // on the host before it clears the fence. --business/--org names the bus.
+    const parsed = { flags: new Set(), values: {} };
+    const selector = orgSelector(() => failure('proxy-usage', 4));
+    const flags = rest.slice(1);
+    let restart = false;
+    for (let i = 0; i < flags.length; i++) {
+      if (flags[i] === '--restart' && !restart) { restart = true; continue; }
+      if (selector.owns(flags[i])) { selector.take(flags[i], flags[i + 1]); i++; continue; }
+      throw failure('proxy-usage', 4);
+    }
+    if (selector.given) parsed.values['--business'] = selector.value;
+    const call = callFor(parsed);
+    const admin = adminFor(io, system, { ...deps, fetch });
+    try {
+      const restarted = await admin.unitAction('restart');
+      if (restarted.evidence?.confirmed !== true) throw failure('proxy-restart-unconfirmed');
+      print(io, { restart: restarted.receipt, ...(await admin.fenceClear(call)) });
+      return;
+    } catch (error) { if (error instanceof CliError) throw error; throw failure(hostCode(error, 'proxy-down')); }
+  }
  if (verb === 'fence') {
    const [action, ...flags] = rest;
    if (action === 'clear' && flags.length === 0) throw failure('proxy-restart-required');
@@ -66,6 +147,7 @@ export async function proxyCommand(args, io, { system, callFor, prompt = promptP
  for (let i = 0; i < rest.length; i++) {
    const flag = rest[i];
    if (verb === 'init' && selector.owns(flag)) { selector.take(flag, rest[i + 1]); i++; continue; }
+    if (verb === 'init' && flag === '--generate-key' && !parsed.flags.has(flag)) { parsed.flags.add(flag); continue; }
    if (verb !== 'init' || !['--port', '--rotate-grace-minutes', '--first-output-seconds'].includes(flag) || parsed.values[flag] !== undefined || !rest[i + 1]) throw failure('proxy-usage', 4);
    parsed.values[flag] = rest[++i];
  }
@@ -81,7 +163,23 @@ export async function proxyCommand(args, io, { system, callFor, prompt = promptP
  try { proxyTiming(timing); } catch (error) { throw failure(error.code); }
  try {
    const config = typeof system === 'function' ? system() : system;
-    if (verb === 'fetch') { const result = await fetch({ dataRoot: config.dataRoot }); io.stdout.write(JSON.stringify({ binary: result.binary, panel: result.panel }) + '\n'); return; }
+    if (verb === 'fetch') {
+      // #1873: the page's fetch, with its progress on stderr and its receipt in proxy-admin.jsonl;
+      // stdout keeps its existing line.
+      const { result, receipt } = await adminFor(io, system, { ...deps, fetch }).fetchRun({ progress: step => io.stderr.write(`fetch: ${step}\n`) });
+      io.stderr.write(`receipt: ${JSON.stringify(receipt)}\n`);
+      io.stdout.write(JSON.stringify({ binary: result.binary, panel: result.panel }) + '\n'); return;
+    }
+    // #1873: the bus generates the key and stores it where init stores a typed key; no prompt,
+    // no terminal needed, and the key is never printed or returned.
+    if (parsed.flags.has('--generate-key')) {
+      // Through the page's controller, so the same init receipt lands in proxy-admin.jsonl.
+      const call = callFor(parsed);
+      const { settings, receipt } = await adminFor(io, system, deps).init(call, { generate: true, ...(port === undefined ? {} : { port }), ...timing });
+      io.stderr.write(`receipt: ${JSON.stringify(receipt)}\n`);
+      print(io, { ...settings, generated: true });
+      return;
+    }
    if (!io.stdin.isTTY || !io.stdout.isTTY) throw failure('proxy-terminal-required', 3);
    // Establish that the CLI is eligible before reading sensitive input. The bus verifies the proof.
    const call = callFor(parsed);
@@ -162,28 +162,28 @@ export function openJournal(file, { log = () => {}, now = () => new Date() } = {
    mkdirSync(dir, { recursive: true, mode: 0o700 });
  } catch (e) {
    // A dangling link in place of the directory fails mkdir with ENOENT.
-    if (e.code === "ENOENT" && lstatSync(dir, { throwIfNoEntry: false })?.isSymbolicLink()) throw new CliError(`notify journal directory must not be a symlink: ${dir}`, 3);
-    if ([...UNWRITABLE, "ENOTDIR"].includes(e.code)) throw new CliError(`notify journal directory cannot be created (${e.code}): ${dir}`, 3);
+    if (e.code === "ENOENT" && lstatSync(dir, { throwIfNoEntry: false })?.isSymbolicLink()) throw new CliError(`notify journal directory must not be a symlink`, 3);
+    if ([...UNWRITABLE, "ENOTDIR"].includes(e.code)) throw new CliError(`notify journal directory cannot be created (${e.code})`, 3);
    if (e.code !== "EEXIST") throw e;
  }
  const ds = lstatSync(dir);
-  if (ds.isSymbolicLink()) throw new CliError(`notify journal directory must not be a symlink: ${dir}`, 3);
+  if (ds.isSymbolicLink()) throw new CliError(`notify journal directory must not be a symlink`, 3);
  if (!ds.isDirectory() || ds.uid !== process.getuid() || (ds.mode & 0o077) !== 0) {
-    throw new CliError(`notify journal directory must be mode 0700 and owned by this user: ${dir}`, 3);
+    throw new CliError(`notify journal directory must be mode 0700 and owned by this user`, 3);
  }
  try {
    accessSync(dir, constants.W_OK | constants.X_OK);
  } catch (e) {
-    if (UNWRITABLE.includes(e.code)) throw new CliError(`notify journal directory is not writable (${e.code}): ${dir}`, 3);
+    if (UNWRITABLE.includes(e.code)) throw new CliError(`notify journal directory is not writable (${e.code})`, 3);
    throw e;
  }
  let fd;
  try {
    fd = openSync(file, O_RDWR | O_APPEND | O_CREAT | O_NOFOLLOW, 0o600);
  } catch (e) {
-    if (e.code === "ELOOP") throw new CliError(`notify journal must not be a symlink: ${file}`, 3);
-    if (UNWRITABLE.includes(e.code)) throw new CliError(`notify journal is not writable (${e.code}): ${file}`, 3);
-    if (e.code === "EISDIR") throw new CliError(`notify journal must be a regular file, mode 0600, owned by this user: ${file}`, 3);
+    if (e.code === "ELOOP") throw new CliError(`notify journal must not be a symlink`, 3);
+    if (UNWRITABLE.includes(e.code)) throw new CliError(`notify journal is not writable (${e.code})`, 3);
+    if (e.code === "EISDIR") throw new CliError(`notify journal must be a regular file, mode 0600, owned by this user`, 3);
    throw e;
  }
  const sent = new Set();
@@ -204,7 +204,7 @@ export function openJournal(file, { log = () => {}, now = () => new Date() } = {
  try {
    const st = fstatSync(fd);
    if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) {
-      throw new CliError(`notify journal must be a regular file, mode 0600, owned by this user: ${file}`, 3);
+      throw new CliError(`notify journal must be a regular file, mode 0600, owned by this user`, 3);
    }
    const bytes = readFileSync(fd);
    const end = bytes.lastIndexOf(0x0a) + 1;
@@ -218,7 +218,7 @@ export function openJournal(file, { log = () => {}, now = () => new Date() } = {
        r = null;
      }
      const bad = r === null ? "json" : badField(r);
-      if (bad) throw new CliError(`notify journal line ${i + 1} is malformed (${bad}): ${file}`, 3);
+      if (bad) throw new CliError(`notify journal line ${i + 1} is malformed (${bad})`, 3);
      count(r);
    });
    if (end < bytes.length) {
@@ -6,27 +6,28 @@ import { CliError } from "./errors.mjs";
 // The notifier's private config: `<dataRoot>/notify/<business>/notify.json`,
 // 0600, `{"notifyVersion": 1, "binding": "<discord binding>" | null}`.
 // Missing refuses, so a host never starts without someone deciding whether
-// it DMs; null runs the host without a notifier.
+// it DMs; null runs the host without a notifier. Refusals name the business
+// and the path under the data root, never the host path (PR #1916).
 export function readNotifyConfig(dataRoot, business) {
  const file = join(dataRoot, "notify", business, "notify.json");
  let st;
  try {
    st = lstatSync(file);
  } catch {
-    throw new CliError(`no notifier config at ${file}; write {"notifyVersion": 1, "binding": "<discord binding>"} there, mode 0600, or "binding": null to run without DMs`, 3);
+    throw new CliError(`no notifier config for ${business}: write {"notifyVersion": 1, "binding": "<discord binding>"} to notify/${business}/notify.json under the data root, mode 0600, or "binding": null to run without DMs`, 3);
  }
  if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) {
-    throw new CliError(`notifier config must be a regular file, mode 0600, owned by this user: ${file}`, 3);
+    throw new CliError(`notifier config for ${business} must be a regular file, mode 0600, owned by this user`, 3);
  }
  let doc;
  try {
    doc = JSON.parse(readFileSync(file, "utf8"));
  } catch {
-    throw new CliError(`notifier config is not JSON: ${file}`, 3);
+    throw new CliError(`notifier config for ${business} is not JSON`, 3);
  }
  const keys = doc && typeof doc === "object" && !Array.isArray(doc) ? Object.keys(doc).sort().join(",") : "";
  if (keys !== "binding,notifyVersion" || doc.notifyVersion !== 1 || (doc.binding !== null && !(typeof doc.binding === "string" && BINDING_NAME.test(doc.binding)))) {
-    throw new CliError(`notifier config must be exactly {"notifyVersion": 1, "binding": <binding name> | null}: ${file}`, 3);
+    throw new CliError(`notifier config for ${business} must be exactly {"notifyVersion": 1, "binding": <binding name> | null}`, 3);
  }
  return doc.binding;
 }
@@ -2,7 +2,7 @@
 import { randomBytes } from 'node:crypto';
 import { processState } from '../../seat/src/process-state.mjs';
 import { spawn } from 'node:child_process';
-import { constants, closeSync, lstatSync, mkdirSync, openSync, readFileSync, fstatSync, unlinkSync, writeFileSync } from 'node:fs';
+import { constants, closeSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, fstatSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { connect } from 'node:net';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -138,7 +138,9 @@ export async function busStart(ctx, id, { detach = false, devLocalOwner = false,
    await new Promise(r => setTimeout(r, 50));
  }
  if (!exited) { child.kill('SIGTERM'); await done; }
-  throw new CliError(`bus failed to start; see ${join(org.paths.hostDir, 'host.log')}`, 3);
+  // Name the log by its place in the organization's runtime directory, never by host path (PR #1916);
+  // resolveOrg admitted `id` only after the registry's id check.
+  throw new CliError(`bus failed to start; see bus-host/host.log in the runtime directory of organization ${id}`, 3);
 }
 export async function busRestart(ctx, id) {
  const org = await target(ctx, id);
@@ -149,6 +151,27 @@ export async function busRestart(ctx, id) {
  return busStart(ctx, id, { detach: true, ...options });
 }

+// D2 security review: clear only the entries busRecover inspected. Each is renamed aside (atomic)
+// and the renamed entry is checked by device and inode; an entry swapped after the inspection is
+// put back with everything moved so far, and the recovery refuses before any receipt or deletion.
+// The deletion then names only the aside entries, never the live paths.
+export function setAside(entries) {
+  const tag = randomBytes(4).toString('hex'), moved = [];
+  const restore = () => {
+    // link() refuses an existing path, so a put-back never replaces whatever now holds the name; an
+    // entry that cannot go back stays under its .recovering name for a person to inspect.
+    for (const m of moved.slice().reverse()) { try { linkSync(m.aside, m.path); unlinkSync(m.aside); } catch { /* left aside */ } }
+  };
+  for (const entry of entries) {
+    const aside = `${entry.path}.recovering-${tag}`;
+    let current;
+    try { renameSync(entry.path, aside); moved.push({ path: entry.path, aside }); current = lstatSync(aside); }
+    catch { restore(); fail('bus recovery state changed'); }
+    if (current.dev !== entry.st.dev || current.ino !== entry.st.ino) { restore(); fail('bus recovery state changed'); }
+  }
+  return { restore, remove: () => { for (const m of moved.slice().reverse()) unlinkSync(m.aside); } };
+}
+
 // Recover only while the org lifecycle fence excludes new starts and deletion.
 export async function busRecover(ctx, id) {
  return withOrgLifecycle(ctx, id, async () => {
@@ -175,10 +198,12 @@ export async function busRecover(ctx, id) {
    const h = state.value;
    if (!Number.isSafeInteger(h?.pid) || h.pid <= 0 || typeof h.startTime !== 'string' || !/^\d+$/.test(h.startTime) || typeof h.startedAt !== 'string' || !Number.isFinite(Date.parse(h.startedAt)) || h.business !== id) fail('invalid or mismatched bus host state');
    let p; try { p = processState(h.pid); } catch { fail('bus host identity is uncertain'); }
+    // A live pid with the recorded start time is the recorded process: never proof of death. Its argv
+    // only picks the message (D2 security review: a mismatching argv used to read as a dead host).
    if (p.alive && p.startTime === h.startTime) {
-      const argv = cmdlineOf(h.pid); if (!argv || !argv.length) fail('bus host identity is uncertain');
-      const i = argv.indexOf(CLI);
+      const argv = cmdlineOf(h.pid), i = argv?.indexOf(CLI) ?? -1;
      if (i >= 0 && argv[i + 1] === 'bus' && argv[i + 2] === 'start' && argv[i + 3] === id) fail(`bus host pid ${h.pid} is alive`);
+      fail('bus host identity is uncertain');
    }
    if (lock && (lock.value?.pid !== h.pid || lock.value?.startTime !== h.startTime || lock.value?.business !== id || lock.value?.startedAt !== h.startedAt)) fail('bus host lock does not match host state');
    if (writer) {
@@ -196,14 +221,43 @@ export async function busRecover(ctx, id) {
      if (occupied) fail('bus socket answers or is uncertain');
    }
    const entries = [state, lock, writer, socket].filter(Boolean);
-    for (const entry of entries) {
-      const current = lstatSync(entry.path);
-      if (current.dev !== entry.st.dev || current.ino !== entry.st.ino) fail('bus recovery state changed');
-    }
+    const aside = setAside(entries);
    const at = new Date().toISOString();
    const receipt = join(org.paths.hostDir, `recovery-${at.replace(/[:.]/g, '-')}-${randomBytes(4).toString('hex')}.json`);
-    writeFileSync(receipt, JSON.stringify({ action: 'bus.recover', at, org: id, stopped: true, host: h, lock: lock?.value ?? null, writer: writer?.value ?? null, socket: Boolean(socket) }, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-    for (const entry of entries.slice().reverse()) unlinkSync(entry.path);
-    return { org: id, recovered: true, pid: h.pid, receipt };
+    try { writeFileSync(receipt, JSON.stringify({ action: 'bus.recover', at, org: id, stopped: true, host: h, lock: lock?.value ?? null, writer: writer?.value ?? null, socket: Boolean(socket) }, null, 2) + '\n', { mode: 0o600, flag: 'wx' }); }
+    catch (e) { aside.restore(); throw e; }
+    aside.remove();
+    const result = { org: id, recovered: true, pid: h.pid, receipt };
+    // The dead host's start options, for busRevive. Not part of the printed receipt.
+    const o = h.options && typeof h.options === 'object' ? h.options : {};
+    Object.defineProperty(result, 'options', { value: Object.freeze({ devLocalOwner: o.devLocalOwner === true, pm: o.pm === true, noLaunch: o.noLaunch === true }) });
+    return result;
  });
 }
+
+// D2 (P0-3): bring back a bus whose host was killed, as a Console unit stop does to the hosts the
+// Console started. busRecover is the proof: it refuses a live or unprovable host, a lock that does
+// not match the dead host, a live writer and an answering socket. The host restarts on the options
+// the dead host recorded, never wider; `pm: false` also keeps the chief from launching.
+export function reviveStartOptions(recorded, { pm = true } = {}) {
+  const o = recorded && typeof recorded === 'object' ? recorded : {};
+  return { detach: true, devLocalOwner: o.devLocalOwner === true, pm: pm === true && o.pm === true, noLaunch: o.noLaunch === true };
+}
+export async function busRevive(ctx, id, { pm = true } = {}) {
+  await target(ctx, id);
+  const recovered = await busRecover(ctx, id);
+  const options = reviveStartOptions(recovered.options, { pm });
+  const cleared = { pid: recovered.pid, receipt: recovered.receipt };
+  let started;
+  try { started = await busStart(ctx, id, options); }
+  catch (e) {
+    // The dead host's state is gone by now: the caller must not report "nothing changed".
+    if (e && typeof e === 'object') { try { Object.defineProperty(e, 'recovered', { value: cleared }); } catch { /* frozen: the caller sees a plain failure */ } }
+    throw e;
+  }
+  const receipt = { ...started, recovered: cleared };
+  Object.defineProperty(receipt, 'done', { value: started.done });
+  // The chief was not relaunched although the dead host was started with --pm.
+  Object.defineProperty(receipt, 'pmDropped', { value: recovered.options.pm === true && !options.pm });
+  return receipt;
+}
@@ -3,13 +3,14 @@ import { randomBytes } from 'node:crypto';
 import { processState } from '../../seat/src/process-state.mjs';
 import { spawn } from 'node:child_process';
 import { request as httpRequest } from 'node:http';
-import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, renameSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, renameSync, writeFileSync, writeSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listOrgs, resolveOrg } from '../../organization/src/org-registry.mjs';
 import { cmdlineOf, startTimeOf } from './host.mjs';
 import { CliError } from './errors.mjs';
 import { devLanOptions } from './dev-local-owner.mjs';
+import { refuseInsideAgent } from './transport.mjs';

 const WEBUI = fileURLToPath(new URL('../../webui/src/cli.mjs', import.meta.url));
 const forbidden = new Set([7332, 7340, 7341, 33223, 17450, 17443, 44307]);
@@ -63,8 +64,25 @@ function takeLock(ctx) {
  checkDir(ctx);
  const path = join(directory(ctx), 'start.lock');
  let fd; try { fd = openSync(path, 'wx', 0o600); } catch { fail('console start lock exists'); }
+  // D1: the lock names its holder, so a detached start that timed out can clear the lock of the
+  // supervisor it killed (clearDeadLock) and no other.
+  try { writeSync(fd, JSON.stringify({ pid: process.pid, startTime: startTimeOf(process.pid) })); } catch { /* an unnamed lock is only never cleared */ }
  return () => { closeSync(fd); rmSync(path, { force: true }); };
 }
+// Removes start.lock only when it names this exact process (pid and start time) and that process
+// is gone. A lock that is unreadable, unnamed or another holder's stays.
+function clearDeadLock(ctx, pid, startTime) {
+  if (!startTime) return;
+  const path = join(directory(ctx), 'start.lock');
+  let owner;
+  try {
+    const st = lstatSync(path);
+    if (!st.isFile() || st.uid !== process.getuid()) return;
+    owner = JSON.parse(readFileSync(path, 'utf8'));
+  } catch { return; }
+  if (owner?.pid !== pid || owner.startTime !== startTime || startTimeOf(pid) === startTime) return;
+  rmSync(path, { force: true });
+}
 // The exit code a supervised Console uses to ask for a relaunch (EX_TEMPFAIL). Only the Console's
 // own restart route (POST /api/console/restart, a human action) exits with it.
 export const RESTART_EXIT = 75;
@@ -95,7 +113,8 @@ async function launch(ctx, args, lan, detach) {
      }
      await sleep(50);
    }
-    fail(`console failed to start; see ${log}`);
+    // The log is named under the data root, never by host path (PR #1916).
+    fail(`console failed to start; see console/${basename(log)} under the data root`);
  } catch (e) {
    if (child.exitCode === null && child.signalCode === null) { child.kill('SIGTERM'); await done; }
    throw e;
@@ -152,15 +171,77 @@ function supervise(ctx, first, args, lan, warn) {
  })();
  return { done, stop };
 }
+// D1 (#1873): `--dev-local-owner --detach` runs the foreground supervision above in a process of
+// its own session (console-supervisor.mjs), so Restart Console works on a detached dev Console. The
+// supervisor takes the start lock and writes the console state as a foreground start does. This
+// process waits for the supervisor's one-line reply, passes its warnings on and leaves it running.
+const SUPERVISOR = fileURLToPath(new URL('./console-supervisor.mjs', import.meta.url));
+async function detachedSupervisor(ctx, { port, bind, allowHosts, warn }) {
+  checkDir(ctx);
+  lastStamp = Math.max(Date.now(), lastStamp + 1);
+  const name = `supervisor-${process.pid}-${lastStamp}.log`;
+  const fd = openSync(join(directory(ctx), name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+  let child;
+  try {
+    child = spawn(process.execPath, [SUPERVISOR, JSON.stringify({ configDir: ctx.configDir, dataRoot: ctx.dataRoot, instance: ctx.instance, port, bind, allowHosts })],
+      { env: ctx.env ?? process.env, detached: true, stdio: ['ignore', 'pipe', fd] });
+  } finally { closeSync(fd); }
+  const supervisorStart = child.pid ? startTimeOf(child.pid) : null;
+  const done = new Promise(resolve => { child.once('error', () => resolve(1)); child.once('exit', code => resolve(code ?? 1)); });
+  // The log is named under the data root, never by host path (PR #1916).
+  const unclear = `console failed to start; see console/${name} under the data root`;
+  let text = '', timer;
+  child.stdout.setEncoding('utf8');
+  const line = await Promise.race([
+    new Promise(resolve => {
+      child.stdout.on('data', c => { text += c; const n = text.indexOf('\n'); if (n >= 0) resolve(text.slice(0, n)); else if (text.length > 65536) resolve(null); });
+      child.stdout.once('end', () => resolve(null));
+    }),
+    new Promise(resolve => { timer = setTimeout(() => resolve(undefined), 60000); }),
+  ]);
+  clearTimeout(timer);
+  child.stdout.destroy();
+  // The supervisor leads its own process group, with the Console it may have started: a timed-out
+  // start signals that group, then kills it if it is still there after 10 seconds. A supervisor
+  // killed while it held the start lock never released it, so the lock it named is cleared.
+  if (line === undefined) {
+    const group = signal => { try { process.kill(-child.pid, signal); } catch { /* already gone */ } };
+    group('SIGTERM');
+    let grace; const exited = await Promise.race([done.then(() => true), new Promise(r => { grace = setTimeout(() => r(false), 10000); })]);
+    clearTimeout(grace);
+    if (!exited) { group('SIGKILL'); await done; }
+    clearDeadLock(ctx, child.pid, supervisorStart);
+    fail(unclear);
+  }
+  let reply = null;
+  try { reply = JSON.parse(line); } catch { /* no reply */ }
+  for (const w of Array.isArray(reply?.warnings) ? reply.warnings : []) if (typeof w === 'string') warn(w);
+  child.unref();
+  if (typeof reply?.receipt?.url !== 'string' || !Number.isSafeInteger(reply.receipt.pid)) {
+    const code = [1, 2, 3, 4].includes(reply?.exitCode) ? reply.exitCode : 1;
+    throw new CliError(typeof reply?.error === 'string' ? reply.error : unclear, code);
+  }
+  const result = { ...reply.receipt, supervisor: child.pid };
+  Object.defineProperty(result, 'done', { value: done });
+  Object.defineProperty(result, 'stop', { value: () => child.kill('SIGTERM') });
+  return result;
+}
 // `bind` and `allowHosts` are --dev-insecure-bind and --dev-allow-host (org-lan-bind): the dev
 // owner Console on the LAN with no sign-in. Neither is set for a loopback Console.
 // In the foreground the Console runs with --supervised: its restart route exits RESTART_EXIT and
-// this process relaunches it in place (F3). A detached Console has no supervisor.
+// this process relaunches it in place (F3). A detached dev-local-owner Console runs under a
+// detached supervisor (D1); any other detached Console has none.
 export async function consoleStart(ctx, { devLocalOwner = false, detach = false, port = 'auto', bind = null, allowHosts = [], warn = s => process.stderr.write(s) } = {}) {
  const value = port === 'auto' ? 0 : Number(port);
  if (!(port === 'auto' || (typeof port === 'string' && /^\d+$/.test(port) && value >= 1 && value <= 65535 && !forbidden.has(value)))) fail('invalid or forbidden console port');
  let lan;
  try { lan = devLanOptions({ devOwner: devLocalOwner, bind, names: allowHosts }); } catch (e) { throw new CliError(e.message, 4); }
+  // D1 fix round (security review P1): a dev-local-owner Console acts as the owner with no sign-in,
+  // so an agent run never starts one, detached or not. agent-guard (#1873): nor any other Console.
+  // This process's own environment is checked as well as the one given for the Console (security
+  // re-check P1). A Restart Console relaunch goes through relaunch(), not here.
+  refuseInsideAgent(process.env); if (ctx.env) refuseInsideAgent(ctx.env);
+  if (detach && devLocalOwner) return detachedSupervisor(ctx, { port, bind, allowHosts, warn });
  const release = takeLock(ctx);
  let run, args;
  try {
@@ -193,11 +274,8 @@ export async function consoleStop(ctx, { warn = s => process.stderr.write(s) } =
    const argv = cmdlineOf(s.pid);
    if (!argv || !argv.length) fail('console process identity is uncertain');
    const i = argv.indexOf(WEBUI);
-    if (i < 0 || argv[i + 1] !== 'serve') {
-      const serve = argv.indexOf('serve');
-      const entry = serve > 0 ? ` ${argv[serve - 1]}` : '';
-      fail(`console was started from another path${entry}; stop it there`);
-    }
+    // The other entry script is a host path, so the refusal never names it (PR #1916).
+    if (i < 0 || argv[i + 1] !== 'serve') fail('console was started from another checkout; stop it there');
    process.kill(s.pid, 'SIGTERM');
    const deadline = Date.now() + 20000;
    while (Date.now() < deadline) {
@@ -240,9 +318,10 @@ function consoleTarget(ctx) {
  const address = s.bind && s.bind !== '0.0.0.0' ? s.bind : '127.0.0.1';
  return { address, port, host: `${address}:${port}` };
 }
-function consoleCall(target, { method = 'GET', path, timeoutMs }) {
+function consoleCall(target, { method = 'GET', path, timeoutMs, body = {} }) {
  return new Promise((resolve, reject) => {
-    const headers = { host: target.host, ...(method === 'POST' ? { origin: `http://${target.host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': 2 } : {}) };
+    const payload = method === 'POST' ? JSON.stringify(body) : undefined;
+    const headers = { host: target.host, ...(method === 'POST' ? { origin: `http://${target.host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {}) };
    let sent = false;
    const req = httpRequest({ host: target.address, port: target.port, method, path, headers, timeout: timeoutMs }, res => {
      let text = '';
@@ -254,14 +333,14 @@ function consoleCall(target, { method = 'GET', path, timeoutMs }) {
    req.on('timeout', () => req.destroy(Object.assign(new Error('timed out'), { code: 'timeout' })));
    req.on('finish', () => { sent = true; });
    req.on('error', e => reject(Object.assign(e, { sent })));
-    req.end(method === 'POST' ? '{}' : undefined);
+    req.end(payload);
  });
 }
 // A refused connection never reached the Console. Anything else after the request left may have
 // changed something, so it is outcome-unknown and nothing is retried.
-async function consolePost(target, path, { timeoutMs, unknown }) {
+async function consolePost(target, path, { timeoutMs, unknown, body }) {
  let answer;
-  try { answer = await consoleCall(target, { method: 'POST', path, timeoutMs }); }
+  try { answer = await consoleCall(target, { method: 'POST', path, timeoutMs, body }); }
  catch (e) {
    if (e.code === 'ECONNREFUSED' && !e.sent) fail('the Console refused the connection; see mosaic console status');
    throw new CliError(`outcome unknown: ${unknown}`, 1);
@@ -296,3 +375,19 @@ export async function consoleBusRestart(ctx, id, { timeoutMs = 120000 } = {}) {
  if (answer.status !== 200 || answer.body?.outcome !== 'done' || answer.body.step !== 'bus-restart') throw refusal(answer, 'org reload');
  return answer.body;
 }
+// E2 (#1873, P1-3): the owner's org page actions from a terminal (org-owner.mjs): the hire form and
+// the autonomy page, each through the running Console's own org route, sent as the page sends it.
+// The route applies its owner, --send, origin, body and live-session checks and asks the org's own
+// bus; nothing here decides or writes anything. A GET that fails changed nothing, so it is exit 1
+// with no outcome-unknown wording; a POST that fails after it left is outcome-unknown.
+export async function consoleOrgRequest(ctx, id, { method = 'GET', path, body, timeoutMs = 30000, unknown }) {
+  if (typeof id !== 'string' || !ORG_ID.test(id)) throw new CliError('invalid organization id', 4);
+  const target = consoleTarget(ctx);
+  const route = `/api/orgs/${id}/${path}`;
+  if (method === 'POST') return consolePost(target, route, { timeoutMs, unknown, body });
+  try { return await consoleCall(target, { path: route, timeoutMs }); }
+  catch (e) {
+    if (e.code === 'ECONNREFUSED' && !e.sent) fail('the Console refused the connection; see mosaic console status');
+    throw new CliError('the Console did not answer; see mosaic console status', 1);
+  }
+}
@@ -0,0 +1,96 @@
+// #1873 T1: `mosaic org definitions`, the human verbs on an organization's own role definitions and
+// the template hash and diff reads. Reads run here, from the file. A write runs only from a human
+// shell (refuseInsideAgent) and goes through the organization's bus as its human: the bus holds the
+// credential store, whose held-secret check every definition write needs (R1), and no other process
+// holds the tokens it looks for. Each write prints its receipt.
+import { readFile } from 'node:fs/promises';
+import { configDir } from '../../organization/src/organization-config.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { definitionVerbs } from '../../organization/src/definition-verbs.mjs';
+import { checkDefinition } from '../../organization/src/definitions.mjs';
+import { rolesDir } from './config.mjs';
+import { CliError } from './errors.mjs';
+import { busExit, refuseInsideAgent } from './transport.mjs';
+
+export const DEFINITIONS_USAGE = 'mosaic org definitions templates | definitions ID list | definitions ID show NAME | definitions ID diff NAME | definitions ID import TEMPLATE [--as NAME] | definitions ID invent NAME --from FILE | definitions ID edit NAME --from FILE --if-rev N | definitions ID remove NAME --if-rev N';
+
+const WRITES = ['import', 'invent', 'edit', 'remove'];
+const VALUES = ['--as', '--from', '--if-rev'];
+
+function parse(args) {
+  const pos = [];
+  const values = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (VALUES.includes(a)) {
+      if (values[a] !== undefined || !args[i + 1] || args[i + 1].startsWith('--')) throw new CliError(`${a} needs one value`, 4);
+      values[a] = args[++i];
+    } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4);
+    else pos.push(a);
+  }
+  return { pos, values };
+}
+
+async function definitionFile(file) {
+  try {
+    return JSON.parse(await readFile(file, 'utf8'));
+  } catch (e) {
+    // Never echo the file's text: it may hold what the composition check refuses.
+    throw new CliError(`cannot read definition ${file}: ${e instanceof SyntaxError ? 'not valid JSON' : e.code ?? 'unreadable'}`, 2);
+  }
+}
+
+// The bus answers a refusal with its code only. These say what the code means for this request;
+// none quotes the definition's text.
+function refusal(code, verb, name, rev, read) {
+  const why = {
+    'definition-in-use': () => `definition ${name} is named by ${read().usedBy.join(', ')}; a change to a hired agent's role is a change decision`,
+    'definition-rev-conflict': () => `definition ${name} is not at rev ${rev}`,
+    'definition-exists': () => `definitions already declares ${name}`,
+    'definition-missing': () => `definitions declares no ${name}`,
+    'revision-conflict': () => 'the organization file changed while this ran; run it again',
+    'credential-leak': () => `the ${verb} request holds a credential the organization's bus holds; nothing was written`,
+    'invalid-request': () => `the bus refused the ${verb}: the definition fails the composition check or holds a held credential`,
+  }[code];
+  let detail = null;
+  try { detail = why?.() ?? null; } catch { detail = null; }
+  const error = new CliError(detail ? `${code}: ${detail}` : code, busExit(code));
+  error.code = code;
+  return error;
+}
+
+// deps.callFor(parsed) returns the human's call(verb, args) for the organization parsed names (cli.mjs
+// passes its callFor). Without one, a write refuses: it never runs without the bus's secret check.
+export async function definitionsCommand(args, io, deps = {}) {
+  const { pos, values } = parse(args);
+  const allowed = (...keys) => { for (const k of Object.keys(values)) if (!keys.includes(k)) throw new CliError(`unexpected ${k}`, 4); };
+  const need = (key) => { if (!values[key]) throw new CliError(`${key} is required`, 4); return values[key]; };
+  const ifRev = () => { const r = need('--if-rev'); if (!/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid --if-rev', 4); return Number(r); };
+  const [id, verb, name] = pos;
+  if (WRITES.includes(verb)) refuseInsideAgent(io.env);
+  const writer = deps.writer ?? organizationWriter({ dir: configDir(io.env), rolesDir: rolesDir(io.env) });
+  const verbs = definitionVerbs({ writer, rolesDir: rolesDir(io.env) });
+  let result;
+  if (id === 'templates' && pos.length === 1) { allowed(); result = verbs.templates(); }
+  else if (verb === 'list' && pos.length === 2) { allowed(); result = verbs.list(id); }
+  else if (['show', 'diff'].includes(verb) && pos.length === 3) { allowed(); result = verbs[verb](id, name); }
+  else if (WRITES.includes(verb) && pos.length === 3) {
+    let request, rev;
+    if (verb === 'import') { allowed('--as'); request = { template: name, as: values['--as'] ?? name }; }
+    else if (verb === 'invent') { allowed('--from'); request = { name, definition: await definitionFile(need('--from')) }; }
+    else if (verb === 'edit') { allowed('--from', '--if-rev'); rev = ifRev(); request = { rev, name, definition: await definitionFile(need('--from')) }; }
+    else { allowed('--if-rev'); rev = ifRev(); request = { rev, name }; }
+    // The file's own checks first, so a bad key is named here; the bus repeats them with its secret check.
+    if (request.definition) checkDefinition(name, { ...request.definition, rev: rev ?? 1 });
+    if (typeof deps.callFor !== 'function') throw new CliError('a definition write goes through the organization bus; run it as `mosaic org definitions`', 3);
+    const call = deps.callFor({ positional: [id], flags: new Set(), values: { '--business': id } });
+    const { revision } = writer.read(id);
+    try {
+      result = await call(`definition.${verb}`, { revision, ...request });
+    } catch (e) {
+      if (typeof e?.code !== 'string' || e.code === '') throw e;
+      throw refusal(e.code, verb, request.as ?? name, rev, () => verbs.show(id, request.as ?? name));
+    }
+  } else throw new CliError(DEFINITIONS_USAGE, 4);
+  io.stdout.write(JSON.stringify(result, null, 2) + '\n');
+}
@@ -0,0 +1,213 @@
+// E2 (#1873, P1-3, org ruling 6): the owner's org page actions from a terminal. Each verb sends the
+// request the WebUI page sends, to the running Console's own org route (org-console.mjs
+// consoleOrgRequest), so the same route checks the owner, --send, the origin, the body and the live
+// session, and the same bus verb runs on the organization's own bus:
+//   - role-templates, hire, fire, change: the inbox hire form (public/bus.js hireSubmit), the routes
+//     /api/orgs/ID/decisions/hire/templates and /start (decision-http.mjs), the bus verbs
+//     hire.templates.console and hire.start.console.
+//   - autonomy, autonomy set, autonomy review: the org Autonomy panel (public/autonomy.js), the
+//     route /api/orgs/ID/autonomy[/review] (autonomy-http.mjs), the bus verbs autonomy.get.console,
+//     autonomy.set.console (with its revision check) and autonomy.review.console.
+// No new authority: a Console that is not the owner's, not started with --send, or not signed in
+// refuses exactly as it refuses the page. Usage errors (exit 4) come first; then every verb refuses
+// inside an agent run, before any config is read, as `org archive|delete` do (agent guard #1942).
+import { configDir } from '../../organization/src/organization-config.mjs';
+import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
+import { loadSystem } from './config.mjs';
+import { CliError } from './errors.mjs';
+import { consoleOrgRequest } from './org-console.mjs';
+import { refuseInsideAgent } from './transport.mjs';
+
+export const ORG_OWNER_VERBS = Object.freeze(['role-templates', 'hire', 'fire', 'change', 'autonomy']);
+export const ORG_OWNER_USAGE = 'mosaic org role-templates ID [--json] | hire|change ID --name NAME --template TEMPLATE --harness HARNESS --model MODEL [--thinking LEVEL] [--level org|project|root] [--project PROJECT] --reason TEXT [--json] | fire ID --name NAME [--level org|project|root] [--project PROJECT] --reason TEXT [--json] | autonomy ID [--json] | autonomy ID set --revision REV [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours N] [--authority-resolver NAME|""] [--json] | autonomy ID review cross-role|merge|policy|authority [--json]';
+
+const usage = why => new CliError(`${why}\nusage: ${ORG_OWNER_USAGE}`, 4);
+const ORG_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const CLASSES = Object.freeze(['cross-role', 'merge', 'policy', 'authority']);
+const LEVELS = Object.freeze({ in: 'in the loop', near: 'near the loop', out: 'out of the loop' });
+const HIRE_VALUES = ['--name', '--template', '--harness', '--model', '--thinking', '--level', '--project', '--reason'];
+const AUTONOMY_VALUES = ['--revision', ...CLASSES.map(c => `--${c}`), '--notices', '--reverse-window-hours', '--authority-resolver'];
+
+function parse(args, values) {
+  const pos = [], got = {}, flags = new Set();
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === '--json') { if (flags.has(a)) throw usage('duplicate --json'); flags.add(a); }
+    else if (values.includes(a)) {
+      if (Object.hasOwn(got, a)) throw usage(`duplicate ${a}`);
+      if (i + 1 >= args.length || args[i + 1].startsWith('--')) throw usage(`${a} needs one value`);
+      got[a] = args[++i];
+    } else if (a.startsWith('--')) throw usage(`unknown option ${a}`);
+    else pos.push(a);
+  }
+  return { pos, values: got, json: flags.has('--json') };
+}
+
+// The hire form's body (bus.js hireSubmit), from flags. The bus's proposal checks (hire-decisions.mjs
+// prepare) run on it unchanged; these checks only refuse what the form itself would not send.
+function hireBody(op, v) {
+  const need = key => { if (!v[key]?.trim()) throw usage(`${op} needs ${key}`); return v[key]; };
+  const level = v['--level'] ?? 'org';
+  if (!['org', 'project', 'root'].includes(level)) throw usage('--level takes org, project or root');
+  if (level === 'project' ? !v['--project']?.trim() : v['--project'] !== undefined) throw usage(level === 'project' ? '--level project needs --project' : '--project goes with --level project');
+  const reason = need('--reason');
+  if (reason.length > 500) throw usage('--reason takes at most 500 characters');
+  if (op === 'fire') for (const k of ['--template', '--harness', '--model', '--thinking']) if (v[k] !== undefined) throw usage(`fire takes no ${k}`);
+  const hire = { op, level, name: need('--name'), reason, ...(level === 'project' ? { project: v['--project'] } : {}) };
+  if (op === 'fire') return { hire, template: null };
+  const template = need('--template');
+  const thinking = v['--thinking']?.trim();
+  return { hire: { ...hire, route: { harness: need('--harness'), model: need('--model'), ...(thinking ? { thinking } : {}) } }, template };
+}
+
+function autonomyChanges(v) {
+  const revision = v['--revision'];
+  if (revision === undefined) throw usage('autonomy set needs --revision, the revision mosaic org autonomy ID shows');
+  // The panel's revision is the bus's 64-hex digest of the organization (autonomy.set.console).
+  if (!/^[a-f0-9]{64}$/.test(revision)) throw usage('--revision takes the 64-hex revision mosaic org autonomy ID shows');
+  const changes = {};
+  for (const c of CLASSES) {
+    const value = v[`--${c}`];
+    if (value === undefined) continue;
+    if (!Object.hasOwn(LEVELS, value)) throw usage(`--${c} takes in, near or out`);
+    changes[c] = LEVELS[value];
+  }
+  if (v['--notices'] !== undefined) {
+    if (!['on', 'off'].includes(v['--notices'])) throw usage('--notices takes on or off');
+    changes.notices = v['--notices'] === 'on';
+  }
+  if (v['--reverse-window-hours'] !== undefined) {
+    if (!/^[1-9][0-9]{0,2}$/.test(v['--reverse-window-hours']) || Number(v['--reverse-window-hours']) > 168) throw usage('--reverse-window-hours takes a whole number of hours from 1 to 168');
+    changes.reverseWindowHours = Number(v['--reverse-window-hours']);
+  }
+  if (v['--authority-resolver'] !== undefined) changes.authorityResolver = v['--authority-resolver'];
+  if (!Object.keys(changes).length) throw usage('autonomy set needs a setting to change');
+  return { revision, changes };
+}
+
+// The panel's save sends every class with the level it shows, notices, the reverse window (24 when
+// none is set) and the resolver when one is set (autonomy.js). The terminal sends the same document
+// with the named settings changed, so an unchanged field keeps the value the page would send.
+export function autonomyDocument(current, changes) {
+  const shown = current?.autonomy ?? {};
+  const doc = Object.fromEntries(CLASSES.map(c => [c, current?.levels?.[c]]));
+  doc.notices = shown.notices === true;
+  doc.reverseWindowHours = shown.reverseWindowHours ?? 24;
+  if (shown.authorityResolver) doc.authorityResolver = shown.authorityResolver;
+  const out = { ...doc, ...changes };
+  // An empty --authority-resolver clears it: the panel leaves an emptied field out of its save.
+  if (out.authorityResolver === '') delete out.authorityResolver;
+  return out;
+}
+
+// Autonomy codes carry no message from the route; these are the panel's own words (autonomy.js).
+const AUTONOMY_GUIDANCE = {
+  'revision-conflict': 'the organization changed; read it again with mosaic org autonomy ID',
+  'autonomy-precondition': 'this move needs a separate resolver, a tested reverse, owner notices and an enforced budget covering new agents for authority; out of the loop needs a near-loop decision followed by your review of its trail',
+  'policy-reverse-unavailable': 'policy has no near-loop setting until a reverse exists',
+  'authority-limits-unavailable': 'authority cannot move out of the loop',
+  'owner-only': 'only the owner changes autonomy',
+  'read-only': 'start the Console with --send to make changes',
+  'sign-in-required': 'sign in to the Console',
+};
+// A refusal is exit 3 and changed nothing. outcome-unknown (and a 5xx the route did not name) may
+// have changed something, so it is exit 1 and nothing is retried.
+function refused(answer, what, unknown, guidance = {}) {
+  const raw = answer.body?.error;
+  const code = typeof raw === 'string' && /^[a-z-]{1,64}$/.test(raw) ? raw : `http ${answer.status}`;
+  if (code === 'outcome-unknown' || (answer.status >= 500 && !raw)) return new CliError(`outcome unknown: ${unknown}`, 1);
+  const said = typeof answer.body?.message === 'string' ? answer.body.message.slice(0, 500) : guidance[code];
+  return new CliError(`${what} refused (${code})${said ? `: ${said}` : ''}`, 3);
+}
+
+function ok(answer) { return answer.status === 200 && answer.body && typeof answer.body === 'object'; }
+
+export async function orgOwnerCommand(args, io, deps = {}) {
+  const verb = args[0];
+  const autonomy = verb === 'autonomy';
+  const p = parse(args.slice(1), autonomy ? AUTONOMY_VALUES : verb === 'role-templates' ? [] : HIRE_VALUES);
+  const id = p.pos[0];
+  if (id === undefined) throw usage(`org ${verb} takes an organization id`);
+  if (!ORG_ID.test(id)) throw usage('invalid organization id');
+  let run;
+  if (verb === 'role-templates') {
+    if (p.pos.length !== 1) throw usage('role-templates takes one organization id');
+    run = async ctx => {
+      const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/templates', body: { business: id }, unknown: 'the templates read did not finish; nothing was changed' });
+      if (!ok(answer) || !Array.isArray(answer.body.templates)) throw answer.status === 200 ? new CliError('the Console answered without templates', 1) : refused(answer, 'role-templates', 'the templates read did not finish; nothing was changed');
+      return { value: answer.body, text: b => b.templates.length ? b.templates.map(t => `${t.name}  ${String(t.sha256 ?? '').slice(0, 12)}\n`).join('') : 'role templates: none\n' };
+    };
+  } else if (['hire', 'fire', 'change'].includes(verb)) {
+    if (p.pos.length !== 1) throw usage(`${verb} takes one organization id`);
+    const { hire, template } = hireBody(verb, p.values);
+    run = async ctx => {
+      let body = hire;
+      // The form chooses a template from the ones it read and sends its name and sha256.
+      if (template !== null) {
+        const read = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/templates', body: { business: id }, unknown: 'the templates read did not finish; nothing was changed' });
+        if (!ok(read) || !Array.isArray(read.body.templates)) throw refused(read, verb, 'the templates read did not finish; nothing was changed');
+        const chosen = read.body.templates.find(t => t?.name === template);
+        if (!chosen) throw new CliError(`${verb}: no role template ${JSON.stringify(template)}; see mosaic org role-templates ${id}`, 2);
+        const { route, ...rest } = hire;
+        body = { ...rest, role: { template: chosen.name, sha256: chosen.sha256 }, route };
+      }
+      const unknown = `the ${verb} may have been recorded; check mosaic inbox --business ${id} and mosaic trail before trying again`;
+      const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/start', body: { business: id, hire: body }, timeoutMs: 120000, unknown });
+      if (!ok(answer)) throw refused(answer, verb, unknown);
+      if (typeof answer.body.id !== 'string' || answer.body.op !== 'resolved') throw new CliError(`outcome unknown: ${unknown}`, 1);
+      return { value: answer.body, text: b => `recorded decision ${b.id}: ${verb} ${hire.name} (${b.op} ${b.choice})\n` };
+    };
+  } else if (autonomy) {
+    const step = p.pos[1] ?? null;
+    if (step === null) {
+      if (p.pos.length !== 1 || Object.keys(p.values).length) throw usage('autonomy ID reads; use autonomy ID set to change it');
+      run = async ctx => {
+        const answer = await consoleOrgRequest(ctx, id, { path: 'autonomy' });
+        if (!ok(answer)) throw refused(answer, 'autonomy', 'the autonomy read did not finish; nothing was changed', AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: formatAutonomy };
+      };
+    } else if (step === 'set') {
+      if (p.pos.length !== 2) throw usage('autonomy ID set takes options only');
+      const { revision, changes } = autonomyChanges(p.values);
+      run = async ctx => {
+        const read = await consoleOrgRequest(ctx, id, { path: 'autonomy' });
+        if (!ok(read)) throw refused(read, 'autonomy set', 'the autonomy read did not finish; nothing was changed', AUTONOMY_GUIDANCE);
+        const unknown = `the setting may have been saved; check mosaic org autonomy ${id} before trying again`;
+        const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'autonomy', body: { revision, autonomy: autonomyDocument(read.body, changes) }, unknown });
+        if (!ok(answer)) throw refused(answer, 'autonomy set', unknown, AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: b => `saved autonomy for ${id}: revision ${b.revision ?? 'unknown'}${b.transaction ? `, receipt ${b.transaction}` : ''}\n` };
+      };
+    } else if (step === 'review') {
+      if (p.pos.length !== 3 || !CLASSES.includes(p.pos[2])) throw usage(`autonomy ID review takes one class: ${CLASSES.join(', ')}`);
+      if (Object.keys(p.values).length) throw usage('autonomy ID review takes no options but --json');
+      run = async ctx => {
+        const unknown = `the review may have been recorded; check mosaic trail before trying again`;
+        const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'autonomy/review', body: { decisionClass: p.pos[2] }, unknown });
+        if (!ok(answer)) throw refused(answer, 'autonomy review', unknown, AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: () => `recorded your trail review for ${p.pos[2]} on ${id}\n` };
+      };
+    } else throw usage(`autonomy takes set or review, not ${JSON.stringify(step)}`);
+  } else throw usage(`unknown org verb ${verb}`);
+  // agent-guard (#1873): after the usage checks, before any config is read; this process's own
+  // environment as well as io.env, as org archive|delete check.
+  refuseInsideAgent(process.env);
+  refuseInsideAgent(io.env);
+  let instance;
+  try { instance = devOwnerInstance(io.env); }
+  catch (e) { throw new CliError(`${e.message}; these verbs need a named instance whose Console runs with --dev-local-owner`, 3); }
+  const system = deps.system ?? loadSystem({ env: io.env, instance });
+  const ctx = { configDir: configDir(io.env), dataRoot: system.dataRoot, instance, principal: DEV_OWNER };
+  const { value, text } = await run(ctx);
+  io.stdout.write(p.json ? `${JSON.stringify(value, null, 2)}\n` : text(value));
+}
+
+function formatAutonomy(b) {
+  const a = b.autonomy ?? {};
+  return [
+    `revision ${b.revision}${b.writable ? '' : ' (read-only: this Console takes no changes)'}`,
+    ...CLASSES.map(c => `${c}: ${b.levels?.[c] ?? 'unknown'}`),
+    `notices: ${a.notices === true ? 'on' : 'off'}`,
+    `reverse window: ${a.reverseWindowHours === undefined ? 'not set (the page offers 24 hours)' : `${a.reverseWindowHours} hours`}`,
+    `authority resolver: ${a.authorityResolver ?? 'none'}`,
+  ].join('\n') + '\n';
+}
@@ -1,19 +1,40 @@
 import { readFile, writeFile } from 'node:fs/promises';
 import { configDir } from '../../organization/src/organization-config.mjs';
 import { listOrgs, orgLock } from '../../organization/src/org-registry.mjs';
-import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
+import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, projectRepoSet, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
 import { installedSystemTypes } from '../../plugins/src/system-types.mjs';
 import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
 import { loadSystem } from './config.mjs';
 import { CliError } from './errors.mjs';
-import { busStopForDelete } from './org-bus.mjs';
+import { busStart, busStopForDelete } from './org-bus.mjs';
+import { assertBuildStart, assertDevInstance } from './deployment.mjs';
 import { consoleBusRestart } from './org-console.mjs';
 import { refuseInsideAgent } from './transport.mjs';
-export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | config validate ID | config resolve ID INSTANCE [--project ID]';
-function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
-async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read document ${file}: ${e instanceof SyntaxError ? 'not valid JSON' : e.message}`, 2); } }
+import { definitionsCommand, DEFINITIONS_USAGE } from './org-definitions.mjs';
+import { orgOwnerCommand, ORG_OWNER_USAGE, ORG_OWNER_VERBS } from './org-owner.mjs';
+export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--no-bus] [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | project repo set ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | ' + ORG_OWNER_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
+function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk', '--no-bus'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
+// A refusal names the document by label and the error by its code, never by host path or bytes (PR #1916).
+const errorCode = e => typeof e?.code === 'string' && /^E[A-Z0-9]+$/.test(e.code) ? e.code : 'unreadable';
+async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read organization document: ${e instanceof SyntaxError ? 'not valid JSON' : errorCode(e)}`, 2); } }
+// agent-guard (#1873): archive and delete stop the organization's bus, so an agent run is refused
+// as it is for `mosaic bus stop`: after the usage checks, before any config is read, and checking
+// this process's own environment as well as io.env. Restore starts the organization's bus (E1, P1-4),
+// so it is refused the same way unless --no-bus is given; `restore --no-bus` starts nothing.
+function refuseAgentRun(io) { refuseInsideAgent(process.env); refuseInsideAgent(io.env); }
+// E1 (P1-4): the bus a restore starts is the one `mosaic bus start ID --dev-local-owner --detach`
+// starts, after that verb's checks. The checks run before the restore, so a refusal changes nothing.
+function restoreBusCheck(system, env) {
+  try { assertBuildStart({ devOwner: true }); assertDevInstance(system, env); }
+  catch (e) { throw new CliError(`restore starts the bus as the local dev owner, and ${e.message}; restore with --no-bus, then start the bus with mosaic bus start`, 3); }
+}
+const busStartVerb = id => `mosaic bus start ${id} --dev-local-owner --detach`;
 export async function orgCommand(args, io, deps = {}) {
 try {
+  // #1873 T1: the definitions verbs take their own options.
+  if (args[0] === 'definitions') return await definitionsCommand(args.slice(1), io, deps);
+  // E2 (#1873, P1-3): the hire form and the autonomy panel, through the running Console (org-owner.mjs).
+  if (ORG_OWNER_VERBS.includes(args[0])) return await orgOwnerCommand(args, io, deps);
  const p = parse(args); const words = p.pos; let result; let accepted = [];
  const allowed = (flags, values) => { for (const f of p.flags) if (!flags.includes(f)) throw new CliError(`unexpected ${f}`, 4); for (const f of Object.keys(p.values)) if (!values.includes(f)) throw new CliError(`unexpected ${f}`, 4); };
  const need = key => { if (!p.values[key]) throw new CliError(`${key} is required`, 4); return p.values[key]; };
@@ -21,14 +42,35 @@ export async function orgCommand(args, io, deps = {}) {
  if (words[0] === 'validate' && words.length === 2) { allowed([], []); result = await validateOrg(await document(words[1])); if (!result.ok) throw new CliError(result.errors.map(e => `${e.path}: ${e.message}`).join('\n'), 2); io.stdout.write('valid\n'); return; }
  // U1 (#1873): `org reload` is a human action; an agent run is refused before any config is read.
  if (words[0] === 'reload') refuseInsideAgent(io.env);
+  const revision = (r, required) => { if (r === undefined && !required) return undefined; if (!/^[1-9][0-9]*$/.test(r ?? '')) throw new CliError(r === undefined ? '--if-revision is required' : 'invalid revision', 4); return Number(r); };
+  let lifecycle = null;
+  if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json', ...(words[0] === 'restore' ? ['--no-bus'] : [])], ['--if-revision']); lifecycle = { ifRevision: revision(p.values['--if-revision'], true) }; if (words[0] === 'archive' || !p.flags.has('--no-bus')) refuseAgentRun(io); }
+  else if (words[0] === 'delete' && words.length === 2) { allowed(['--json'], ['--confirm', '--if-revision']); const ifRevision = revision(p.values['--if-revision'], false); lifecycle = { confirm: need('--confirm'), ifRevision }; refuseAgentRun(io); }
  if (words[0] === 'system-types' && words[1] === 'installed' && words.length === 2) { allowed(['--json'], []); io.stdout.write(JSON.stringify(await installedSystemTypes(), null, 2) + '\n'); return; }
  const instance = devOwnerInstance(io.env); const system = deps.system ?? loadSystem({ env: io.env, instance }); const ctx = { configDir: configDir(io.env), dataRoot: system.dataRoot, instance, principal: DEV_OWNER };
  if (words[0] === 'system-types' && words[1] === 'enabled' && words.length === 3) { allowed(['--json'], []); const org = await showOrg(ctx, words[2]); result = { organization: words[2], enabled: org.doc.plugins?.['system-type'] ?? [] }; }
  else if (words[0] === 'lock' && ['show', 'clear'].includes(words[1]) && words.length === 3) { allowed([], []); result = await orgLock(ctx, words[2], { clear: words[1] === 'clear' }); }
  else if (words[0] === 'create' && words.length === 2) { allowed([], ['--from']); result = await createOrg(ctx, words[1], await document(need('--from'))); }
  else if (words[0] === 'update' && words.length === 2) { allowed([], ['--from', '--if-revision']); const r = need('--if-revision'); if (!/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid revision', 4); result = await updateOrg(ctx, words[1], await document(need('--from')), { ifRevision: Number(r) }); }
-  else if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json'], ['--if-revision']); const r = need('--if-revision'); if (!/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid revision', 4); const opts = { ifRevision: Number(r) }; result = words[0] === 'archive' ? await archiveOrg(ctx, words[1], { ...opts, busStop: busStopForDelete }) : await restoreOrg(ctx, words[1], opts); }
-  else if (words[0] === 'delete' && words.length === 2) { allowed(['--json'], ['--confirm', '--if-revision']); const r = p.values['--if-revision']; if (r !== undefined && !/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid revision', 4); result = await deleteOrg(ctx, words[1], { busStop: busStopForDelete, confirm: need('--confirm'), ifRevision: r === undefined ? undefined : Number(r) }); }
+  else if (words[0] === 'archive' && words.length === 2) result = await archiveOrg(ctx, words[1], { ...lifecycle, busStop: busStopForDelete });
+  else if (words[0] === 'restore' && words.length === 2) {
+   const startBus = !p.flags.has('--no-bus');
+   if (startBus) restoreBusCheck(system, io.env);
+   result = await restoreOrg(ctx, words[1], lifecycle);
+   // The restore stands whatever the bus does. A bus that does not start is said so, with the verb
+   // that starts it, and the command exits 3 after printing the restore receipt.
+   if (startBus) {
+    try { const started = await (deps.busStart ?? busStart)({ ...ctx, env: io.env }, words[1], { detach: true, devLocalOwner: true, pm: false }); result = { ...result, bus: { outcome: 'started', pid: started.pid } }; }
+    catch (e) {
+     // A host that died left its lock behind; `bus start` refuses it until `bus recover` clears it.
+     const message = e instanceof CliError ? e.message : 'the bus did not start', dead = /^stale /.test(message);
+     result = { ...result, bus: { outcome: 'failed', message, next: dead ? `mosaic bus recover ${words[1]}; ${busStartVerb(words[1])}` : busStartVerb(words[1]) } };
+     io.stdout.write(JSON.stringify(result, null, 2) + '\n');
+     throw new CliError(`${words[1]} was restored, but its bus did not start: ${message}; ${dead ? `clear the dead host with mosaic bus recover ${words[1]}, then start it with` : 'start it with'} ${busStartVerb(words[1])}`, 3);
+    }
+   }
+  }
+  else if (words[0] === 'delete' && words.length === 2) result = await deleteOrg(ctx, words[1], { busStop: busStopForDelete, ...lifecycle });
  // U1 (#1873): the F3 bus control from a terminal, through the running Console's own route, which
  // checks the owner and writes the action trail (org-console.mjs consoleBusRestart).
  else if (words[0] === 'reload' && words.length === 2) { allowed([], []); result = await consoleBusRestart(ctx, words[1], deps.consoleRequest ?? {}); }
@@ -38,8 +80,17 @@ export async function orgCommand(args, io, deps = {}) {
   const project = words[0] === 'project', op = words[project ? 2 : 1], id = words[project ? 3 : 2], name = project ? words[4] : null;
   if (op === 'show') { allowed(['--json'], []); result = project ? await projectRepoShow(ctx, id, name) : await queueShow(ctx, id); }
   else if (op === 'init') { allowed(['--local-only', '--accept-local-loss-risk'], ['--remote']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const opts = { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk') }; result = project ? await projectRepoInit(ctx, id, name, opts) : await queueInit(ctx, id, opts); }
+   // #1873 P1-7: change the project's repository (remote URL, or remote to local-only and back).
+   // The same URL rules and check as init; origin follows; nothing is pushed.
+   else if (op === 'set' && project) { allowed(['--json', '--local-only', '--accept-local-loss-risk'], ['--remote', '--if-revision']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const ifRevision = revision(p.values['--if-revision'], true); result = await projectRepoSet(ctx, id, name, { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk'), ifRevision }); }
   else throw new CliError(ORG_USAGE, 4);
  } else throw new CliError(ORG_USAGE, 4);
  io.stdout.write(JSON.stringify(result, null, 2) + '\n');
- } catch (e) { if (e instanceof CliError) throw e; throw new CliError(`${e.code ? e.code + ': ' : ''}${e.message}`, 2); }
+ } catch (e) {
+  if (e instanceof CliError) throw e;
+  // A raw Node filesystem error ("CODE: description, syscall 'path'") is named by its operation
+  // and code, never by the host path in its message (PR #1916).
+  const message = typeof e?.syscall === 'string' && typeof e.code === 'string' && e.message.startsWith(`${e.code}:`) ? `cannot ${e.syscall} (${errorCode(e)})` : e.message;
+  throw new CliError(`${e.code ? e.code + ': ' : ''}${message}`, 2);
+ }
 }
@@ -0,0 +1,38 @@
+// Instance-level shell verbs. Intentionally separate from pluginsCommand's bus transport.
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { CliError } from './errors.mjs';
+import { refuseInsideAgent } from './transport.mjs';
+import { configDir } from '../../organization/src/organization-config.mjs';
+import { assertAccountsOwner } from '../../organization/src/accounts.mjs';
+import { withRegistry } from '../../organization/src/org-registry.mjs';
+import { readJsonFile } from '../../organization/src/util.mjs';
+import { installPlugin, removePlugin } from '../../plugins/src/install.mjs';
+import { readPluginLock } from '../../plugins/src/pinned.mjs';
+
+export async function pluginInstallCommand(args,io,{system,dir=configDir(io.env)}) {
+  refuseInsideAgent(io.env);
+  try {
+    assertAccountsOwner(dir);
+    const [verb,value,...rest]=args;
+    if(!['install','list','remove'].includes(verb))throw new CliError('mosaic plugins install SOURCE --sha256 HASH [--commit FULL_SHA] | list | remove NAME',4);
+    const opts={};
+    if(verb==='install') {
+      for(let i=0;i<rest.length;i+=2){if(!['--sha256','--commit'].includes(rest[i]) || !rest[i+1] || Object.hasOwn(opts,rest[i]))throw new CliError('invalid plugin install options',4);opts[rest[i]]=rest[i+1];}
+      if(!value || !opts['--sha256'])throw new CliError('install requires SOURCE and --sha256 HASH',4);
+    }else if(rest.length || (verb==='list'?value!==undefined:!value))throw new CliError('invalid plugin management arguments',4);
+    let result;
+    if(verb==='list') result=readPluginLock(system.dataRoot);
+    else if(verb==='install')result=installPlugin({dataRoot:system.dataRoot,source:value,commit:opts['--commit'],expectedHash:opts['--sha256'],print:line=>io.stdout.write(line+'\n')});
+    else result=await withRegistry({configDir:dir,instance:system.instance ?? dir.split('/').pop().replace(/^mosaic-/, '')},()=>{
+      // All organization files, including archived organizations, must be readable. The registry
+      // lock prevents a simultaneous create from disappearing from this check.
+      let files=[];try{files=readdirSync(join(dir,'businesses'));}catch(e){if(e.code!=='ENOENT')throw e;}
+      return removePlugin({dataRoot:system.dataRoot,name:value,enabled:name=>files.filter(n=>n.endsWith('.json')).some(n=>{
+        const doc=readJsonFile(join(dir,'businesses',n),'organization file');
+        return Object.values(doc.plugins ?? {}).flat().includes(name);
+      })});
+    },{write:false});
+    io.stdout.write(JSON.stringify(result,null,2)+'\n');
+  }catch(e){if(e instanceof CliError)throw e;throw new CliError(`plugin management refused: ${/^[a-z-]+$/.test(e.code ?? '')?e.code:'plugin-refused'}`,3);}
+}
@@ -7,7 +7,7 @@ import { readFileSync } from "node:fs";
 import { CliError } from "./errors.mjs";
 import { orgSelector } from "./org-selector.mjs";

-export const PLUGINS_USAGE = "mosaic plugins [--business ID] [--json] [--tester] | set --file PATCH [--business ID] [--tester]";
+export const PLUGINS_USAGE = "mosaic plugins [--business ID] [--json] [--tester] | set --file PATCH [--business ID] [--tester] | install SOURCE --sha256 HASH [--commit FULL_SHA] | list | remove NAME";

 function parse(args) {
  const out = { positional: [], flags: new Set(), values: {} };
@@ -0,0 +1,49 @@
+// #1873 proxy setup: host facts that `mosaic proxy` and the Console page share. Never reads a
+// key, proxy setting or bus record; labels only, never an absolute path.
+import net from 'node:net';
+import { hostStatus } from './host.mjs';
+import { socketPath, orgPaths } from './config.mjs';
+import { devOwnerInstance } from './dev-local-owner.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+
+// A socket that accepts a connection, or fails other than "absent"/"refused", counts as running.
+function socketLive(file, timeout = 1000) {
+  return new Promise(resolve => {
+    const socket = net.connect(file);
+    const done = value => { socket.destroy(); resolve(value); };
+    socket.setTimeout(timeout, () => done(true));
+    socket.once('connect', () => done(true));
+    socket.once('error', error => done(!['ENOENT', 'ECONNREFUSED'].includes(error.code)));
+  });
+}
+
+async function rootRunning(root, socket) {
+  try {
+    const status = hostStatus(root);
+    if (status.host?.live || status.writerLock?.live) return true;
+  } catch { return true; }
+  return socketLive(socket);
+}
+
+// The init-lock README condition "the bus is stopped", proved for the instance's own bus and
+// every registered organization's bus. Anything that cannot be examined counts as running.
+// `listOrgsFn` and `running` are for tests.
+export async function busesStopped({ dataRoot, configDir, listOrgsFn = listOrgs, running = rootRunning }) {
+  const out = [];
+  if (await running(dataRoot, socketPath(dataRoot))) out.push('the instance bus');
+  let orgs;
+  try { orgs = await listOrgsFn({ configDir }); }
+  catch { return { stopped: false, running: [...out, 'organization registry unreadable'] }; }
+  for (const org of orgs) {
+    const label = `organization ${typeof org?.id === 'string' ? org.id : '?'}`;
+    let paths;
+    try { paths = orgPaths(org.root); } catch { out.push(label); continue; }
+    if (await running(org.root, paths.socket)) out.push(label);
+  }
+  return { stopped: out.length === 0, running: out };
+}
+
+// The named instance MOSAIC_CONFIG selects, or null for the default (dev) instance.
+export function instanceFromConfig(env = process.env) {
+  try { return devOwnerInstance(env); } catch { return null; }
+}
@@ -63,7 +63,7 @@ const inside = (root, path) => { const r = relative(root, path); return r !== ''
 export function threadRecords(file, thread) {
  const log = fileEvidence(file);
  if (!log.ok && log.problem === 'missing') return { file, missing: true, launches: [], ends: [], malformed: 0 };
-  if (!log.ok) throw new CliError(`run-evidence-refused: launch log ${file}: ${log.problem}`, 3);
+  if (!log.ok) throw new CliError(`run-evidence-refused: launch log: ${log.problem}`, 3);
  const launches = [], ends = []; let malformed = 0;
  log.bytes.toString('utf8').split('\n').forEach((line, i) => {
    if (!line) return;
@@ -186,7 +186,7 @@ export async function runCommand(rest, io, deps = {}) {
    lines.push(verify ? `verified: ${verified ? 'yes' : 'no'}` : 'not verified (pass --verify)');
    io.stdout.write(`${lines.join('\n')}\n`);
  }
-  if (runs.length === 0) throw new CliError(`no launch for thread ${thread.label} in ${log.file}`, 2);
+  if (runs.length === 0) throw new CliError(`no launch for thread ${thread.label} in the launch log`, 2);
  if (verify && !verified) throw new CliError('run evidence failed verification', 1);
  return report;
 }
@@ -0,0 +1,104 @@
+// E2 (#1873, P1-3, org ruling 6): the task board's writes from a terminal. `mosaic tasks create`,
+// `edit` and `archive` send the board's three ops (workspace-tasks.mjs) to the organization's bus as
+// the person, through the human transport (U4a: the bus's tasks.create, tasks.edit and tasks.archive
+// are the person's writes "from the terminal (human-cli)"). The arguments pass the board's own
+// check, parseTaskWrite, before anything is sent, so the terminal takes exactly what the board
+// takes; the bus then runs its own human, field, digest and archive checks, as it does for the
+// board. Writes take no --tester and refuse inside an agent run (callFor), and the bus refuses any
+// caller that is not the person (human-required).
+import { parseTaskWrite } from '../../webui/src/workspace-tasks.mjs';
+import { CliError } from './errors.mjs';
+import { orgSelector } from './org-selector.mjs';
+import { refuseInsideAgent } from './transport.mjs';
+
+export const TASKS_WRITE_OPS = Object.freeze(['create', 'edit', 'archive']);
+export const TASKS_WRITE_USAGE = 'mosaic tasks create --title TEXT --requirement REQ-X-N [--project NAME] [--state STATE] [--assignees ROLE,...] [--priority 0-5] [--due ISO|none] --business <id> [--json]\n' +
+  '  mosaic tasks edit task:N --expect DIGEST [--title TEXT] [--state STATE] [--assignees ROLE,...] [--priority 0-5] [--due ISO|none] --business <id> [--json]\n' +
+  '  mosaic tasks archive task:N --expect DIGEST --business <id> [--json]';
+
+const usage = why => new CliError(`${why}\nusage: ${TASKS_WRITE_USAGE}`, 4);
+// Each op's options, as the board's op takes its keys (workspace-tasks.mjs OPS).
+const OPTIONS = {
+  create: ['--title', '--requirement', '--project', '--state', '--assignees', '--priority', '--due'],
+  edit: ['--expect', '--title', '--state', '--assignees', '--priority', '--due'],
+  archive: ['--expect'],
+};
+const KEY = { '--title': 'title', '--requirement': 'requirement', '--project': 'group', '--state': 'state', '--assignees': 'assignees', '--priority': 'priority', '--due': 'due_date', '--expect': 'expect' };
+// The board's answer when the bus refuses, by code (workspace-tasks.mjs REFUSALS), so the terminal
+// reads the same next step.
+const GUIDANCE = {
+  'human-required': 'the bus takes task changes only from a person; nothing was written',
+  'tracker-not-store': 'this organization keeps its tasks in Vikunja; nothing was written',
+  'task-conflict': 'the task changed after you read it; nothing was written. Read it again with mosaic tasks --json',
+  'task-archived': 'the task is archived; nothing was written',
+  'task-already-archived': 'the task was already archived; nothing was written',
+  'task-not-found': 'the task is not on this organization\'s bus; nothing was written',
+  'task-position-full': 'this project has no room for another task position; nothing was written',
+  'invalid-state': 'the bus does not have that state; nothing was written',
+  'unknown-role': 'an assignee is not a role in this organization; nothing was written',
+  'invalid-request': 'the bus refused the change as invalid; nothing was written',
+  'credential-leak': 'the change holds part of a stored credential, so the bus refused it; nothing was written',
+};
+
+export function parseTasksWrite(args) {
+  const op = args[0];
+  if (!TASKS_WRITE_OPS.includes(op)) throw usage(`tasks takes create, edit or archive, not ${JSON.stringify(op)}`);
+  const selector = orgSelector(usage);
+  const values = {}, positional = [];
+  let json = false;
+  for (let i = 1; i < args.length; i++) {
+    const a = args[i];
+    if (selector.owns(a)) { selector.take(a, args[i + 1]); i++; }
+    else if (a === '--json') { if (json) throw usage('duplicate --json'); json = true; }
+    else if (OPTIONS[op].includes(a)) {
+      if (Object.hasOwn(values, a)) throw usage(`duplicate ${a}`);
+      if (i + 1 >= args.length || args[i + 1].startsWith('--')) throw usage(`${a} needs one value`);
+      values[a] = args[++i];
+    } else if (a.startsWith('--')) throw usage(`tasks ${op} does not take ${a}`);
+    else positional.push(a);
+  }
+  // The organization is named before anything else is checked, so a missing --business is a usage
+  // error (exit 4) inside an agent run too, as for the org owner verbs.
+  if (!selector.given) throw usage('name the organization with --business');
+  if (positional.length !== (op === 'create' ? 0 : 1)) throw usage(op === 'create' ? 'tasks create takes no task' : `tasks ${op} takes one task, task:N`);
+  const body = op === 'create' ? {} : { task_ref: positional[0] };
+  for (const [flag, raw] of Object.entries(values)) {
+    const key = KEY[flag];
+    if (key === 'assignees') body[key] = raw === '' ? [] : raw.split(',').map(r => r.trim());
+    else if (key === 'priority') body[key] = /^[0-9]$/.test(raw) ? Number(raw) : raw;
+    else if (key === 'due_date') body[key] = raw === 'none' ? null : raw;
+    else body[key] = raw;
+  }
+  // The board's own check. Its org is the page's; here the organization is checked by the selector
+  // and the bus, so a fixed valid id stands in for it.
+  let write;
+  try { write = parseTaskWrite({ op, org: 'terminal', ...body }); }
+  catch (e) { if (typeof e?.status === 'number') throw usage(`tasks ${op}: ${e.message}`); throw e; }
+  return { op, verb: write.verb, args: write.args, json, business: selector.given ? selector.value : undefined };
+}
+
+export async function tasksWriteCommand(args, io, callFor) {
+  const write = parseTasksWrite(args);
+  // agent-guard (#1873): this process's own environment as well as io.env (callFor checks io.env),
+  // as the org owner verbs check.
+  refuseInsideAgent(process.env);
+  const parsed = { positional: [], flags: new Set(), values: write.business === undefined ? {} : { '--business': write.business } };
+  const call = callFor(parsed);
+  let result;
+  try { result = await call(write.verb, write.args); }
+  catch (e) {
+    if (e?.code === 'outcome-unknown' || e?.exitCode === 1) throw new CliError(`outcome unknown: the task change may or may not have been written; read it with mosaic tasks --json before trying again`, 1);
+    if (typeof e?.code === 'string' && Object.hasOwn(GUIDANCE, e.code)) {
+      const refused = new CliError(`tasks ${write.op} refused (${e.code}): ${GUIDANCE[e.code]}`, e.exitCode ?? 2);
+      refused.code = e.code;
+      throw refused;
+    }
+    throw e;
+  }
+  const taskRef = typeof result?.task_ref === 'string' ? result.task_ref : write.args.task_ref ?? null;
+  const digest = typeof result?.digest === 'string' ? result.digest : null;
+  // The board's answer shape (workspace-tasks.mjs), with the organization the call went to.
+  const answer = { ok: true, org: parsed.business ?? write.business ?? null, op: write.op, task_ref: taskRef, digest };
+  const done = { create: 'created', edit: 'changed', archive: 'archived' }[write.op];
+  io.stdout.write(write.json ? `${JSON.stringify(answer, null, 2)}\n` : `${done} ${taskRef}${digest ? `, digest ${digest}` : ''}\n`);
+}
@@ -91,7 +91,9 @@ test("R6 B3 a boot with a file R1's loader refuses still boots, binds no user an
    const s = await boot(t, file);
    assert.equal(s.config.access.file, s.path, why);
    assert.equal(s.bind("alice"), "access-revoked", why);
-    assert.deepEqual(s.warnings, [TRACKER, `access file refused at boot (${code}), no granted user binds until it is fixed: ${s.path}`], why);
+    // #1873: the warning names access.json by its place, never by host path.
+    assert.deepEqual(s.warnings, [TRACKER, `access file refused at boot (${code}), no granted user binds until it is fixed: access.json in the config directory`], why);
+    assert.ok(!s.warnings.join("\n").includes(s.path), why);
    assert.doesNotMatch(s.warnings.join("\n"), /secret-marker/, why);
  }
 });
				`@@ -0,0 +1 @@`
				`export * from "../../organization/src/hire-decisions.mjs";`