Detect binaries despite git attributes and reject unconfirmed reviews (#1825 )

Fix push-check binary checks from repository subdirectories (#1825 )
Add reviewed-binary push check and scratch regression suite (#1825 )
2026-10-24 01:40:16 -05:00 · 2026-10-24 01:12:15 -05:00 · 2026-10-24 01:02:29 -05:00 · 2026-10-24 00:52:34 -05:00 · 2026-10-24 00:52:13 -05:00 · 2026-10-24 00:26:11 -05:00
77 changed files with 3715 additions and 43 deletions
@@ -5469,3 +5469,9 @@ bus bypass refusals. Prior old-test draft regression fixed under sage-3918;
 missing root oauth4webapi corrected by pinned npm ci under sage-3924. Evidence:
 agents/poe/work/queue-208/BUILD.md. Independent reviews and Sage's global gate
 remain; no live state, schema or bus policy change.
+
+2026-10-24 | Goldie | Row265 / #1770 before, recorded during authorized verification | C2-09b has no project room verbs. On goldie/row265 at ec86f2c84, add only room.open/send/read, pure exported leading-tag parser, README verb rows and new bus tests. Sage-3921 fixes EOF-tag and message-only timestamp readings; tester list/helpers/schema stay unchanged. Claim rev3814; Sage-3932 CLEAR for serialized new files, whole bus and twelve refusal mutants. No old-test edits authorized; stop rules apply.
+
+2026-10-24 | Goldie | Row265 / #1770 first slot STOP (sage-3932) | New parser14/14, rooms18/18 green; serialized bus stops at old project-runtime.test.mjs:14 import-closure pin, partial619 ok/1 not ok. New pure address.mjs import is absent from expected imports. Static trace also needs address.mjs in seat RUNNER_FILES. No old-test/product correction, no mutant/restored run, no green commit/push; old-pin and out-of-owned-files mount change sent to Sage for ruling. Audit prose missed the direct source pin despite raw grep hit; correction recorded in BUILD.md.
+
+2026-10-24 | Goldie | Row265 / #1770 verified (mos-1567, sage-3942) | Approved correction adds solely address import pin + Row265 comment to project-runtime.test and one pure-source RUNNER_FILES mount; new block checks parser has no imports. Serialized fresh-short-TMP timeout-k10: unchanged sandbox10/10, parser15/15, rooms18/18, full bus957/957, twelve named refusal mutants killed (each Node1, driver0), restored parser15/15 + rooms18/18. All positives zero fail/skip/cancel; every mutation restored full broker SHA71b32ee4. Old first-red evidence retained, no other old-test change. Slot returned goldie-0034; Boyd packet explicitly includes mount-list review, candidate push next.
@@ -0,0 +1,10 @@
+# Bradford
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1572. Owns the push check row:
+`scripts/push-check.sh`, which passes a binary only when an approved review candidate lists its path and sha256
+(docs/plans/2026-10-24_push-guard-binary-manifest.md, #1825).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `bradford/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Poe gives the first Codex review and Dewey the Opus 5.5 landing review (mos-1542,
+mos-1571). Registered by Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -0,0 +1,162 @@
+# Row 327 — reviewed binary push check (#1825)
+
+2026-10-24 Bradford, branch bradford/row327, base b617b80f6.
+
+## Plan and boundaries
+
+Implement the scratch check's ordered tokens in scripts/push-check.sh, using an
+embedded Node program for byte-safe git paths and SHA-256 blob hashing. Bash is
+the public entry point; Node is already a repository requirement. Git commands
+use explicit resolved object IDs, disable external diff/textconv, and inspect
+committed bytes. No queue writes, hook changes, binary evidence, or live state.
+Fetch is opt-in. Read reviewed rows with the queue package rows() API rooted in
+the caller's repository; this preserves canonical/witness/replay checks.
+
+Only the latest round counts; any changes receipt blocks that round. A matching
+approval authorizes exactly the manifest path/hash, or a path changed from the
+commit candidate's first parent with matching committed blob hash and mode.
+Deleted binaries need no candidate. Multiple --row values form a union.
+
+Add scratch-only integration coverage in scripts/test-push-check.sh. Reuse queue
+test fixture helpers to bootstrap real scratch queues, then use queue verbs to
+open rounds and record receipts. All git writes, bare remotes and queues remain
+under TMPDIR. Test fail-closed ordering and five required mutants, generated as
+text copies in scratch. No old tests are modified. Add the TOOLS entry.
+
+Every run needs Sage CLEAR; run timeout -k 10. Record plain-text results here or
+in this packet. After green checks, commit and push only bradford/row327 through
+the repository helper, send Sage and Poe tip/base/path sha256 manifest, and move
+327 in-review. Sage owns request posting and landing; Dewey reviews once there.
+
+## Recovery and choices
+
+Initial worktree queue next refused linked-worktree access as designed. Queue
+claim is performed from the canonical checkout; production reads in the guard
+retain the same refusal rather than invent a worktree override.
+
+Requested Sage ruling on AGENTS log appends outside the brief's owned paths.
+
+Sage sage-3989: lead handles BUILD-LOG and SESSIONS at landing. Session entry:
+2026-10-24 Bradford — row 327 / #1825 — implementation and scratch verification
+in this packet; outcome to be appended after acceptance.
+
+Implementation note: commit candidates use an explicit first-parent diff (empty
+tree for a root commit), with rename detection disabled, like verify-commit.
+The changes-veto case has both an approval and a changes receipt; a veto mutant
+would otherwise still fail for lack of approval and provide false confidence.
+A receipt for another candidate cannot be produced through queue verbs: the
+suite corrupts only a scratch queue and expects the production reader to refuse.
+Diff color, external diff and textconv are disabled so scans inspect plain git
+output. Paths are read from NUL-delimited records (including spaces/tabs).
+
+## Verification (Sage CLEAR sage-3991)
+
+First new-suite run red: my whitespace-path fixture attempted a manifest path
+that the queue intentionally forbids. Corrected the fixture to a commit
+candidate, which can contain that git path. Production queue code and old tests
+remain unchanged. Raw first-run output is test-run-1.txt.
+
+Second run green: PASS push-check 22 checks; KILLED skip-hash,
+accept-changes, earlier-round, working-tree, no-row. test-run-2.txt holds the
+plain-text receipt. bash -n both scripts and git diff --check passed. Runs used
+TMPDIR recorded in tmpdir.txt and timeout -k 10 240; all generated binary bytes
+were in disposable scratch repositories, never in this checkout or evidence.
+The slot was used for only the authorized new suite and syntax/diff checks.
+No claim of the lead's full scripts/test-*.sh landing gate is made here.
+
+Final inspection after the first green run found a path-decoding concern: lossy
+UTF-8 decoding can conflate distinct git filenames. Hardened NUL-delimited path
+decoding to reject invalid UTF-8, and quote newline-containing paths in refusal
+output to preserve one STOP line. Added scratch cases for both. Requested a new
+CLEAR (bradford-0005) because the previous slot had already been released.
+
+Final run (sage-3994 CLEAR) green on final code: PASS push-check 24 checks,
+all five mutants KILLED again, bash -n both scripts and git diff --check passed.
+Receipt: test-run-3.txt. The guard rejects non-UTF-8 git paths as environment
+errors rather than comparing replacement characters; newline paths remain
+checkable through commit candidates and refusals quote them on one line.
+
+Acceptance for the builder stage: ordered tokens and stop behavior, explicit
+base/fetch, exact blob manifest/commit checks, latest-round/veto checks, deletion,
+log/FF/secrets/attribution refusals, and all required mutants are covered. Queue
+reads use rows() with production validation; tests use only scratch queues.
+Candidate-mismatched receipts are impossible through the queue API and are
+covered by a corrupt scratch queue refusing its read. The lead's full-suite gate,
+Poe first review, Dewey landing review, and adoption for Sage's next push remain
+landing stages. No hooks, role policy, credentials or other seats' paths changed.
+
+## Poe first review R1 (poe-0010) — changes
+
+cceea407e has a blocking subdirectory bypass: ls-tree without --full-tree can
+omit an existing binary outside the caller cwd, making it look deleted.
+Accepted the finding. Git now anchors all invocations at the repository root,
+ls-tree uses --full-tree, and diff/diff-tree use --no-relative. EXPECTED_LOG still
+resolves from the original caller cwd. Added outside-cwd and nested-binary cases
+under diff.relative=true: unreviewed stops, reviewed manifest/commit passes.
+No old test changed. New run requires Sage CLEAR before execution.
+
+R1 verification under sage-3999 CLEAR: test-run-4.txt records PASS 29 checks
+and KILLED all five required mutants. Syntax and diff whitespace checks passed.
+A second bounded run used the new suite against cceea407e's script copied under
+TMPDIR: r1-regression-red.txt records the outside-cwd unreviewed binary reaching
+NO_BINARY/PUSH_READY (actual exit 0, expected 1). Thus the new regression detects
+the reviewed bug, while the revised guard refuses it. No code changed between
+the green run and this old-candidate reproduction. All runs used timeout -k 10.
+
+Holding claimant queue writes per sage-3999 until Boyd finishes row 309's record.
+Last acknowledged row 327 state is in-progress (bradford-0010, revision 3868).
+
+## Dewey landing review B1 (dewey-0956) — changes
+
+Read the invited review body at /mnt/storage/scratch/tmp/dew327vWXloCT/body.md.
+B1 identifies a brief-level gap: numstat follows candidate/host git attributes,
+so *.bin diff makes a NUL-containing blob disappear from the binary-only set.
+The production script indeed filters numstat before reading any blob, consistent
+with that data flow. Proposed correction: enumerate every changed numstat path,
+skip absent/non-blob entries at SHA, classify binary when numstat says binary OR
+committed blob has NUL among first 8000 bytes. Read with cat-file, never worktree.
+Test committed .gitattributes, info/attributes, and core.attributesFile overrides
+in scratch; reject with no row, allow exact reviewed bytes; add NUL-scan mutant.
+Sage owns the brief amendment and next CLEAR/queue sequencing.
+
+N1 acknowledged: candidate-equality check is defense in depth; invalid receipt
+cannot pass queue replay, so the corrupt-queue case does not isolate that check.
+N2/N3 recorded as described in review, without optional secrets/reader changes.
+N4 planned hardening: refuse unconfirmed durable tail notes from rows() with
+exit 2, with a real scratch witness-prefix case rather than a test-only reader.
+No test run or queue write started for B1/N4 before Sage CLEAR.
+
+Sage sage-4013/4015 authorizes B1 and N4 within the brief; amendment committed on
+refactor at 9042754c4 (read with git show, no branch change). Fix and tests written
+before requesting CLEAR as directed. Tests cover all three attribute sources,
+approved manifest success under each override, exact 7999/8000 offset boundary,
+and a real prefix-witness rollback to yield an unconfirmed approval tail.
+Added only the requested sixth mutant, skip-nul-scan; the original five remain.
+No new production configuration knobs, no secrets-diff change, no queue writes.
+Will demonstrate red against the prior candidate using the new tests, then green
+against revised code, under the approved slot. Full landing gate remains Sage's.
+
+After Dewey's round-2 CHANGES record (comment 31522, rev3876), Sage sage-4016
+released only the claimant return to in-progress. Acknowledged:
+`ok bradford-0017 rev 3877 row 327 in-review→in-progress`.
+No other queue write before the next in-review candidate move.
+Test slot remains pending Sage CLEAR after Gyro's build.
+
+## Amendment 1 verification (sage-4017 CLEAR)
+
+b1-regression-red.txt: new tests against 704910ca3 reproduce attributes-hidden
+asset.bin reaching NO_BINARY/PUSH_READY with exit0 instead of exit1.
+n4-regression-red.txt: revised code with only the N4 check removed lets the real
+scratch unconfirmed approval tail reach BINARY_REVIEWED/PUSH_READY, exit0 rather
+than exit2. These are expected negative controls; neither changed committed code.
+
+Final full new-suite run is green: test-run-5.txt records PASS 38 checks and
+KILLED skip-hash, accept-changes, earlier-round, working-tree, no-row, skip-nul-scan.
+All runs used timeout -k 10 240 with the same scratch TMPDIR; no old tests were
+changed or run. bash -n both scripts and git diff --check also passed. No source
+changes followed this green run. Sage's full landing gate is still separate.
+
+Scope in the final delta: classify all changed present blobs using numstat OR
+first-8000-byte NUL; fail closed on queue unconfirmed-tail notes; regression cases
+and requested sixth mutant; TOOLS entry and this plain-text packet. B1's brief
+amendment is Sage's 9042754c4; this branch does not edit the brief or queue files.
@@ -0,0 +1,27 @@
+node:internal/modules/run_main:107
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: LOG_OK
+FF_OK
+NO_BINARY
+SECRETS_CLEAN
+NO_ATTRIBUTION
+PUSH_READY ee394f31d1e52751716e2413049f41b2f3072e65..76acc948149e718091fcd3f3807257e752a6616e
+
+
+
+0 !== 1
+
+    at Object.check (file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:44:12)
+    at file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:100:7
+    at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 0,
+  expected: 1,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v26.8.1
@@ -0,0 +1,27 @@
+node:internal/modules/run_main:107
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: LOG_OK
+FF_OK
+BINARY_REVIEWED 1
+SECRETS_CLEAN
+NO_ATTRIBUTION
+PUSH_READY c1a8a1e9b8c3988874a8f7a35afab7c06aea94a5..325cd3671a7bf70b9a3aee60f4446bc93594a12a
+
+
+
+0 !== 2
+
+    at Object.check (file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:44:12)
+    at file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:121:7
+    at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 0,
+  expected: 2,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v26.8.1
@@ -0,0 +1,27 @@
+node:internal/modules/run_main:107
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: LOG_OK
+FF_OK
+NO_BINARY
+SECRETS_CLEAN
+NO_ATTRIBUTION
+PUSH_READY 896bdf0ef56596c67d2dc427275743c46026e832..ad9f9c86112fadafef4d4854f46bd9994fe2fe5d
+
+
+
+0 !== 1
+
+    at Object.check (file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:44:12)
+    at file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:130:7
+    at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 0,
+  expected: 1,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v26.8.1
@@ -0,0 +1,21 @@
+node:internal/modules/run_main:107
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: queue: candidate manifest path must be a repo-relative path: "space tab\tasset.bin"
+
+
+2 !== 1
+
+    at Object.round (file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:61:12)
+    at file:///home/jwoltje/.t3/worktrees/mosaic-stack/bradford-row327/[eval1]:116:7
+    at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 2,
+  expected: 1,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v26.8.1
@@ -0,0 +1,6 @@
+PASS push-check 22 checks
+KILLED skip-hash
+KILLED accept-changes
+KILLED earlier-round
+KILLED working-tree
+KILLED no-row
@@ -0,0 +1,6 @@
+PASS push-check 24 checks
+KILLED skip-hash
+KILLED accept-changes
+KILLED earlier-round
+KILLED working-tree
+KILLED no-row
@@ -0,0 +1,6 @@
+PASS push-check 29 checks
+KILLED skip-hash
+KILLED accept-changes
+KILLED earlier-round
+KILLED working-tree
+KILLED no-row
@@ -0,0 +1,7 @@
+PASS push-check 38 checks
+KILLED skip-hash
+KILLED accept-changes
+KILLED earlier-round
+KILLED working-tree
+KILLED no-row
+KILLED skip-nul-scan
@@ -0,0 +1 @@
+/mnt/storage/scratch/tmp/YPrPwR
@@ -0,0 +1,78 @@
+# Row 208 (193d) second review: poe/row208 4a4bef6c1 (duckworth-0302)
+
+Request: sage-3934 (sage-3931 request, c31492 on #1706). Candidate: 4a4bef6c1 on ec86f2c84, one
+commit. Design: e2d161e2e:agents/morgana/work/queue-193/DESIGN.md section 8, sha256 dd7fcb41
+(matches). Scope under mos-1542: the guards only. The question is whether a viewer can widen
+authority.
+Method: static. Git reads, plus the mutant summary Sage sent by path. No node, no tests.
+
+## Verdict: APPROVE (static)
+
+The diff has no bus or schema change. Every write is still decided by the broker as it stood at the
+base. The webui adds routes and hints, and no authority.
+
+- **chat-http.mjs.**
+  - share and unshare are POST only. They come after the same write fences as every other write:
+    send and named mode, the SSO session or auth header, Origin, and sec-fetch-site.
+  - The body must be exactly `{to}`: a string of 1-200 characters with no CR, LF or NUL. Extra keys
+    (owner, verb) refuse 400, and the test covers that.
+  - shares is GET only and takes no query.
+  - The reply must echo thread, to and op exactly. Anything else is 503 outcome-unknown.
+  - The new STATUS codes map share-not-covered to 403, share-exists to 409 and share-not-found to 404.
+  - `?shared=` accepts only `true`.
+- **chat.mjs and the adapter.**
+  - The three verbs go over `createChannelCaller` to the webui adapter (index.mjs:12-14). The adapter
+    is an allowlist passthrough to the session's own `call`.
+  - A granted user's chat is rebound per session (serve.mjs:701), so share calls carry the user's
+    principal, never the owner's.
+  - The test fixture runs the real adapter and the real Broker.
+- **The broker decides each new path, unchanged from the base.**
+  - thread.share, thread.unshare and thread.shares are in USER_VERBS and not in VIEWER_VERBS, so
+    userLevel gives collaborator. A viewer gets access-refused at #grantedThread (broker.mjs:950).
+  - Each of the three goes through `#thread`'s owner check (broker.mjs:909-913). A sharee gets
+    thread-not-owned and can't reshare.
+  - share-not-covered applies to a `user:` target (broker.mjs:6559).
+  - Only thread.messages takes `#threadRead`, so a share gives read access and nothing else.
+- **The grant-hint predicate.**
+  - access.mjs `chatGrants` re-runs `lookup`, so the subject must still sign in as session.user with a
+    live grant. It then keeps only that user's grants in this business that cover at collaborator,
+    which is the same `covers` call as the broker's `#granted`.
+  - It returns only `{projects, instances}`. No ids, receipts, subjects or other users escape. Any
+    failure gives [].
+  - The client's `scopeWrites` requires the project and the instance to match within one grant
+    (`some(g => project && instance)`). It never pairs a project from one grant with an instance from
+    another, so mixed grants can't combine into a scope that no single grant has.
+  - `includes('*')` on the client is equivalent to covers' `[0] === '*'`, because checkScope
+    (business access.mjs:97-103) refuses `*` unless it is alone.
+  - The hint is never carried over: chatGrants starts at [] and is re-read from /api/config on each
+    user render. It is in /api/config only when `granted`.
+- **No client-only hiding stands in for a broker refusal.** Each hidden control maps to a refusal:
+
+  | Hidden control | Who | Broker refusal |
+  | --- | --- | --- |
+  | composer and resume | viewer | thread.send/open: access-refused |
+  | composer and resume | sharee | thread.send/open: thread-not-owned |
+  | share form | viewer | access-refused |
+  | share form | sharee | thread-not-owned |
+  | create thread | out of scope | collaborator check at create |
+  | create project | user | project.create isn't in USER_VERBS |
+  | session controls, clear, cancel | user | session.* isn't in USER_VERBS (tester-only) |
+
+  Test :136 POSTs create, send, open and share from the page with the UI bypassed, and checks four
+  403 access-refused responses, unchanged table counts, and that each verb reached the bus. Test :19
+  adds unshare and the shares read over HTTP. Test :154 covers the sharee's thread-not-owned on send,
+  open and share.
+- **Mutants, as reported (sage-3920 CLEAR, /mnt/storage/scratch/tmp/8UlAhS/poe-208-mutants.json, not
+  rerun).**
+  - There are four served-copy mutants: composer, open, share and create. Each one's anchor must exist,
+    or the fixture throws.
+  - Each mutant fails the UI-absence test with ERR_ASSERTION, and the bypass test passes under each
+    one, so the broker still refuses. That meets design section 8: "With each UI check removed, the
+    bus still refuses."
+  - The full webui suite passed 418/0 and plugins 119/0 (sage-3925), as reported.
+
+## Notes
+
+- N1 (outside guard scope). user.js:16 re-renders every 5 s while the tab is visible. Each render
+  re-reads /api/config, projects, threads and the shared list. This doesn't affect authority, but it
+  is steady load per open user tab.
@@ -0,0 +1,9 @@
+# Glomgold
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1571. Owns row 309, O2 W1: the reviewed local
+thesaurus data (docs/plans/2026-10-21_q195-writing-editor.md, "W1 reviewed local thesaurus data").
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `glomgold/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and give the Opus 5.5 landing review (mos-1571). Registered by
+Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -0,0 +1,134 @@
+# Row 265 / #1770 — project rooms
+
+Current result: verified under sage-3942; slot returned in goldie-0034. Full bus 957/957, sandbox 10/10, parser 15/15, rooms 18/18, twelve mutants killed, restored files green. Review/push packet below includes mos-1567 closure scope.
+
+Goldie, 2026-10-24. Branch goldie/row265, base ec86f2c847f6154a0677c6ed23c87dabc2c665d0. Brief docs/plans/2026-10-20_case2-rows.md § C2-09b rooms at blob3a5ed91a4fb3462df67e6939ae6f18290ac9b453; design agents/gosalyn/work/case2/DESIGN.md §6. Sage-3915 transfers ownership from Rocko to Goldie and review from Dewey to Boyd. No old test edit authorized. All tests/mutants wait for Sage CLEAR; queued behind Poe, Bentina and Sage's326 gate.
+
+## Design and clarified readings
+
+A room is a bus project. Members are all loaded business instances whose definitions are in THREAD_DEFINITIONS, sorted by key. Canonical room threads have those keys as names and belong to the requesting human. open checks all name/instance/owner collisions before creating anything; it delegates missing inserts to existing thread.create dispatch, including default session metadata. send/read require the complete canonical set. No schema or migration change.
+
+Sage-3921 settles two brief readings: the single captured timestamp applies to the room.send MESSAGE rows; existing route/delivery/event helpers keep their own timestamps in the same dispatch transaction. They are unchanged. A final EOF-terminated @name is a tag, so bare @continuity is invalid-request rather than a broadcast. Leading whitespace is accepted. Pure parseAddress returns {tags,body}, where body is the unaddressed remainder; room.send stores the ORIGINAL input unchanged. Export it from the bus index and expose a separate reusable test table for C2-10c parity.
+
+send resolves tags against current #named results and member instance keys, deduplicates recipients, and refuses multiple member matches. It checks each target's current default-session fence and messaging rule, then inserts one normal INFO message, route and human.input per target under the existing request transaction. All message rows share one at. No tag broadcasts; tags after the first non-tag token remain plain text.
+
+read includes all sessions of the caller's canonical threads, globally ordered by messages.seq. Each entry retains first-message fields plus thread/session/instance and adds ids (every grouped message id) and to (each instance once). Only consecutive human rows with identical at/body/class group, and a repeated instance starts a new entry, so same-millisecond identical sends remain separate. Paging limit counts merged entries (THREAD_PAGE defaults/max); clients continue after the last ids element. Cursor must belong to a room thread. Bounded raw scan limit*memberCount+1 completes requested groups without reading unbounded history. Sage-3921 accepts these routine choices as proposed in goldie-0030.
+
+## Scope / steps
+
+1. Read current thread.create/send/messages, transaction wrapper, naming and messaging helpers; audit source readers/pins. Claim265 via queue after next. Done/read, claim recorded at rev 3814 with op goldie-0265-start-1 (same-op replay confirmed).
+2. Add parser + index export, only three room cases in broker, README verb rows and new bus tests/fixtures. Do not modify existing thread/messaging/ACL/helper behavior.
+3. New tests cover all brief cases, atomicity across message/route/input rows, ownership/projects, permissions, paging/grouping and session fences. No suites or test runs before CLEAR.
+4. Record exact refusal→test→mutant matrix here before requesting the slot; one targeted killed mutant per named refusal, restoration byte-checks. New files whole then bus suite under CLEAR, serial timeout-k10, fresh31-byte mktemp TMPDIR plus UTC/load/busy header.
+5. Before in-review, grep packages/*/tests for broker.mjs/TESTER_VERBS and changed-file pins. Push own branch and hand tip/base/manifest directly to Sage/Boyd. Sage owns request posting/landing.
+
+No Console/Discord/CLI room surface or cross-agent reply visibility added. No tester verb, role, schema or secret change. No host action or credential access.
+
+## New tests and refusal / mutant matrix
+
+Only new test files and a new reusable vector fixture are added. No pre-existing test changes. Parser table: address.test.mjs consumes address-cases.mjs, including final EOF tags, leading whitespace, tags after the first word, repetition and blank/tag-only remainder. Broker cases: rooms.test.mjs covers sorted/reused canonical threads, other-instance and other-owner collisions, all three verbs' human/tester gates, missing projects/member set, partial/foreign/wrong-instance rooms, key and current-name addressing, ambiguity/same-member name+key, unknown/non-member/old-name tags, tags-only bodies, one/many/broadcast targets, original bytes, shared message timestamp, routes/deliveries/human.input, denied last recipient, clearing last session, all-session merged reads, agent reply metadata, merged paging/default/max, foreign/noncanonical/absent cursors, and same-at repeated sends. Synthetic historical rows append valid rows; they do not rewrite evidence or clocks. The same-at batches repeat the first recipient at each boundary, proving identical sends remain distinct.
+
+Each named refusal has one mutation of its enforcement, run against the entire new rooms.test.mjs file. The driver mutants.py stores the exact original→mutant diff in logs/Mxx-*.diff, logs UTC/load/busy/TMPDIR, accepts only Node exit 1 with the named target test failing, and restores/verifies full broker bytes and SHA256 in finally. No mutation is retained. Generic pre-existing request/schema/argument policies are exercised through existing code; the matrix names the refusals added or deliberately inherited by these room cases.
+
+| Mutant | Refusal | Guard relaxed | Required failing new test |
+| --- | --- | --- | --- |
+| M01-human | human-required | remove common room human check | room verbs require the human |
+| M02-tester | tester-refused | add the three room verbs to TESTER_VERBS | room verbs require the human (explicit absence pin) |
+| M03-project | project-not-found | remove room project lookup check | room verbs refuse missing projects |
+| M04-members | thread-instance-missing | allow empty member set | room verbs refuse missing projects |
+| M05-collision | room-thread-name-taken | remove canonical owner/instance collision check | room.open preflights instance collisions |
+| M06-open | room-not-open | remove missing canonical thread check | send/read refuse a missing canonical member |
+| M07-body | invalid-request | allow empty parsed remainder | unknown or non-member addressees and tags-only bodies |
+| M08-unknown | unknown-addressee | allow zero member matches | unknown or non-member addressees and tags-only bodies |
+| M09-ambiguous | addressee-ambiguous | allow multiple member matches | a legacy name colliding with another member key |
+| M10-messaging | message-sender-refused | omit room target messaging check | messaging denial on the last target |
+| M11-cursor | message-not-found | unknown room cursor falls back to seq zero | room.read groups one send, pages |
+| M12-fence | session-clearing | omit room target session fence | a clearing last member fences the whole send |
+
+For M02, the existing human check remains a second barrier: the mutant deliberately relaxes only the tester allowlist; the new explicit absence assertion kills it without loosening or running the old pin. Existing helpers keep their full session-state behavior. No helper or schema mutation ships.
+
+## Reader / hash audit
+
+`rg -n 'broker\.mjs|TESTER_VERBS' packages/*/tests --glob '!fixtures/*'` produced reader-grep.txt (133 hits at audit time). These are imports except the concrete source read at bus/tests/limit-checks.test.mjs:323-326 (forbidden limit-check/token-limit imports) and the tester set assertions at bus/tests/tester-writes.test.mjs:18-32. The latter stays byte-for-byte unchanged. bus/tests/viewer.test.mjs:116 builds its coverage set from exported verb lists; rooms do not widen those lists. No old test needs an edit.
+
+Pin check: recursively inspect packages/*/tests plus scripts/test-*.sh for changed-file mentions (broker.mjs, address.mjs, packages/bus/README.md, packages/bus/src/index.mjs) with literal 64-hex values within eight lines: pin-context-grep.txt records no hits. A direct same-line hash/digest/sha256 grep finds registrySha256 imports only, which hash host registry data rather than broker bytes. The independent channel-proof.test.mjs baselines cover proof/transport files, none changed here. Positive control: pin-positive-control.txt records actual schema.sql / SCHEMA_SHA256 / createHash references in bus/tests/schema.test.mjs and bus/src/store.mjs. Schema bytes are unchanged.
+
+## Requested serialized slot plan (not run)
+
+At each run: fresh `TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX)`, date -u, uptime, and `bash /mnt/storage/scratch/sage-busy-now.sh 2>/dev/null | tail -1` in the log. No concurrent test runs. Ignored root node_modules symlink targets the canonical checkout; it will not be committed.
+
+1. `timeout -k 10 120 node --test packages/bus/tests/address.test.mjs` whole.
+2. `timeout -k 10 120 node --test packages/bus/tests/rooms.test.mjs` whole.
+3. `timeout -k 10 600 node --test --test-concurrency=1 packages/bus/tests/*.test.mjs` bus suite whole.
+4. `python3 agents/goldie/work/queue-265/mutants.py`: M01 through M12 serially, each runs `timeout -k 10 120 node --test packages/bus/tests/rooms.test.mjs` whole, fresh TMPDIR/header; stop on a live mutant or wrong failure. Record each diff and restoration digest.
+5. Restored address.test.mjs whole and rooms.test.mjs whole separately, same commands as 1/2 and fresh directories/header each.
+
+Estimate 5–10 minutes; bus timeout ceiling 10 minutes, individual new/mutant ceilings 2 minutes each. On first new-test red, record/report it. On any old-test red or need for old-test change, stop and ask Sage. Static node --check for new modules/tests and git diff --check passed; no tests or mutants run yet.
+
+## First slot STOP — sage-3932
+
+2026-10-24T04:27Z: stopped on an old-test red. No old test changed or rerun, no mutant executed, no product adjustment after the failure, no commit/push claiming verification.
+
+| Step | Exit | Counts / disposition | Log |
+| --- | --- | --- | --- |
+| 1 address whole | 0 | 14 pass, 0 fail/skip/cancel; 58.559 ms | logs/01-address.log |
+| 2 rooms whole | 0 | 18 pass, 0 fail/skip/cancel; 1067.524 ms | logs/02-rooms.log |
+| 3 bus whole | 1 (stopped) | partial 619 top-level ok, 1 not ok; not a completed-suite result | logs/03-bus.log |
+| 4 twelve mutants | not run | stop rule | none |
+| 5 restored files | not run | stop rule; no mutations were applied | none |
+
+All three run headers use UTC/date, uptime, helper CLEAR and distinct 31-byte scratch TMPDIRs. Bus began04:25:22Z at load2.80/2.91/2.61, TMPDIR /mnt/storage/scratch/tmp/LaZAaK. Parser used /mnt/storage/scratch/tmp/rqcTH7; rooms has its own header. Explicit TAP reporter was selected for rooms/bus and the mutant driver so failure detection/counts are stable across Node26's default spec reporter; this changes reporting only.
+
+The old red is project-runtime.test.mjs:12, assertion:14, test620, “Broker keeps the sandbox client import closure: only the listed imports, no lazy project import”. Actual imports include the new `import { parseAddress } from './address.mjs';`; the pinned array omits it. ERR_ASSERTION deepStrictEqual; individual duration2.469251ms. The full expected/actual/stack is in 03-bus.log. No other red was observed before stopping.
+
+Reader-audit correction: reader-grep.txt:100 already contains project-runtime.test.mjs:13, a direct broker source read. The earlier prose incorrectly described the import-closure assertion as a normal import; I missed this old source pin during inspection. This is not a hash pin. Follow-up static trace finds seat/src/sandbox.mjs:50-60 RUNNER_FILES includes broker and landing but not address; seat/tests/sandbox.test.mjs:45-53 compares this mount list to the recursively imported source closure. A parser dependency therefore also needs the one new RUNNER_FILES path. Both an old-test pin change and this out-of-owned-files product change require Sage/Mos approval before edits. Recommended bounded change: add only the parser import to the project-runtime expected imports, add only packages/bus/src/address.mjs beside broker in RUNNER_FILES, and leave the generic sandbox closure test unchanged.
+
+Broker bytes remain SHA256 71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781. git diff --check still passes. Slot returned in goldie-0032, pending ruling/new CLEAR; no reruns.
+
+## mos-1567 approved closure correction / second slot request
+
+Sage-3940 relays Mos's mos-1567 and widened row scope (sage-3939). Applied exactly the approved pre-existing-file edits: project-runtime.test.mjs adds two lines at17-18, one Row265 comment and the parser import in the pinned array, no other line changed (numstat2 added/0 deleted); seat/src/sandbox.mjs adds only `packages/bus/src/address.mjs` immediately after broker in RUNNER_FILES. seat/tests/sandbox.test.mjs stays byte-for-byte unchanged. The parser remains a separate pure module. A NEW block in address.test.mjs asserts `doesNotMatch(/\bimport\b/)` on its source, with a node:fs import in that new test file; no existing assertion is moved or weakened.
+
+Review packet must explicitly call out the RUNNER_FILES mount-list entry for Boyd's review. This is a read-only source-file mount needed by the broker's static dependency, with no new module dependency or role/verb authority. The first-run import pin failure remains recorded above and in logs/03-bus.log; new logs will have rerun-prefixed names, preserving first-slot bytes.
+
+Requested rerun order, awaiting CLEAR after Bentina: first `timeout -k 10 180 node --test --test-reporter=tap packages/seat/tests/sandbox.test.mjs` whole, then the original five steps again from step1: address whole (now15 cases), rooms whole, bus whole with concurrency1 (includes project-runtime whole), M01–M12 whole-room-file mutants, then restored address and rooms files separately. Explicit TAP reporter is used throughout for stable logs/kill matching; timeouts otherwise120 per new/mutant run and600 for bus. Each run still gets fresh short mktemp TMPDIR, date/uptime/busy header, serialized with the same stop rule. Estimate5–10minutes. Only static node --check and git diff --check run since the STOP; all pass. No new test run yet.
+
+## Verified result — sage-3942 CLEAR, slot returned goldie-0034
+
+All rerun positives exit 0 with zero failures, skips or cancellations. Full bus suite passed 957/957, including the approved project-runtime import pin. The unchanged sandbox test passed 10/10, including its recursive mount/import-closure assertion. New parser cases passed 15/15, rooms 18/18, and both passed again after restoration. No tests run after slot return.
+
+| Run | Exit | Pass / fail | Duration ms | UTC / load / helper | Log |
+| --- | --- | --- | --- | --- | --- |
+| rerun-00-sandbox | 0 | 10 / 0 | 5526.027699 | Sat Oct 24 04:31:35 UTC 2026; 23:31:35 up 10 days, 14:51,  2 users,  load average: 2.83, 2.91, 2.73; CLEAR | [log](logs/rerun-00-sandbox.log.gz) |
+| rerun-01-address | 0 | 15 / 0 | 54.634817 | Sat Oct 24 04:31:45 UTC 2026; 23:31:45 up 10 days, 14:51,  2 users,  load average: 2.54, 2.84, 2.71; CLEAR | [log](logs/rerun-01-address.log.gz) |
+| rerun-02-rooms | 0 | 18 / 0 | 921.788987 | Sat Oct 24 04:31:52 UTC 2026; 23:31:52 up 10 days, 14:51,  2 users,  load average: 2.42, 2.81, 2.70; CLEAR | [log](logs/rerun-02-rooms.log.gz) |
+| rerun-03-bus | 0 | 957 / 0 | 118397.418425 | Sat Oct 24 04:32:01 UTC 2026; 23:32:01 up 10 days, 14:51,  2 users,  load average: 2.28, 2.77, 2.68; CLEAR | [log](logs/rerun-03-bus.log.gz) |
+| rerun-05-restored-address | 0 | 15 / 0 | 54.587943 | Sat Oct 24 04:35:02 UTC 2026; 23:35:02 up 10 days, 14:54,  2 users,  load average: 3.10, 3.07, 2.83; CLEAR | [log](logs/rerun-05-restored-address.log.gz) |
+| rerun-05-restored-rooms | 0 | 18 / 0 | 991.877991 | Sat Oct 24 04:35:11 UTC 2026; 23:35:11 up 10 days, 14:55,  2 users,  load average: 3.17, 3.09, 2.84; CLEAR | [log](logs/rerun-05-restored-rooms.log.gz) |
+
+Mutant driver exit 0; all twelve target tests killed their guard relaxation with Node exit 1. Every mutant log records exact bytes restored to broker SHA256 `71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781`. Driver receipt: [rerun-04-mutants-driver.log](logs/rerun-04-mutants-driver.log.gz).
+
+| Mutant | Node exit | Pass / fail | Exact diff | Raw log |
+| --- | --- | --- | --- | --- |
+| M01-human | 1, killed | 16 / 2 | [diff](logs/M01-human.diff) | [log](logs/M01-human.log.gz) |
+| M02-tester | 1, killed | 17 / 1 | [diff](logs/M02-tester.diff) | [log](logs/M02-tester.log.gz) |
+| M03-project | 1, killed | 17 / 1 | [diff](logs/M03-project.diff) | [log](logs/M03-project.log.gz) |
+| M04-members | 1, killed | 17 / 1 | [diff](logs/M04-members.diff) | [log](logs/M04-members.log.gz) |
+| M05-collision | 1, killed | 14 / 4 | [diff](logs/M05-collision.diff) | [log](logs/M05-collision.log.gz) |
+| M06-open | 1, killed | 17 / 1 | [diff](logs/M06-open.diff) | [log](logs/M06-open.log.gz) |
+| M07-body | 1, killed | 17 / 1 | [diff](logs/M07-body.diff) | [log](logs/M07-body.log.gz) |
+| M08-unknown | 1, killed | 16 / 2 | [diff](logs/M08-unknown.diff) | [log](logs/M08-unknown.log.gz) |
+| M09-ambiguous | 1, killed | 17 / 1 | [diff](logs/M09-ambiguous.diff) | [log](logs/M09-ambiguous.log.gz) |
+| M10-messaging | 1, killed | 17 / 1 | [diff](logs/M10-messaging.diff) | [log](logs/M10-messaging.log.gz) |
+| M11-cursor | 1, killed | 17 / 1 | [diff](logs/M11-cursor.diff) | [log](logs/M11-cursor.log.gz) |
+| M12-fence | 1, killed | 17 / 1 | [diff](logs/M12-fence.diff) | [log](logs/M12-fence.log.gz) |
+
+## Final review scope and packet
+
+Boyd reviews the three room cases, pure parser/export, README rows, new parser/room tests, and **the added read-only RUNNER_FILES mount for packages/bus/src/address.mjs**. mos-1567 authorizes that one sandbox source line and the sole old-test delta: project-runtime.test.mjs:17-18 adds exactly the Row265 comment and parser import pin (numstat 2 added / 0 deleted). Byte comparison against base after removing those additions proves all other old-test bytes unchanged. Removing the single RUNNER_FILES addition likewise restores sandbox.mjs to base. sandbox.test.mjs has no byte change. New address.test.mjs block proves the mounted parser source has no import word.
+
+The widened changed-file hash-context audit includes sandbox.mjs: [pin-context-with-sandbox.txt](pin-context-with-sandbox.txt), zero 64-hex-near-reference hits. The original reader and positive-control receipts remain alongside it; the missed source pin and first STOP remain recorded, not concealed. No role/schema/tester allowlist or helper change ships. BUILD-LOG and SESSIONS only append tracking entries.
+
+Base: `ec86f2c847f6154a0677c6ed23c87dabc2c665d0`. Branch: `goldie/row265`. MANIFEST.sha256 lists every changed source/test/tracking/evidence file except itself, with repository-relative paths, and is verified before commit/push. Raw first-red logs are retained separately from green reruns.
+
+Evidence packaging: logs are stored losslessly as `.log.gz`; decompress with `gzip -cd`. Decompression was byte-compared with each raw run log before packing. This preserves the original failure/Node whitespace while keeping the committed diff whitespace-clean. The run driver recreates raw `.log` files when used. Mutant busy-check headers identify only their own Python driver PID3686656 as BUSY; positive runs report CLEAR. The driver held the assigned slot throughout, with serialized child tests.
@@ -0,0 +1,51 @@
+996e9d0c1e7a8436691ce5d5d89b4eb940b07aafb3386f63a9847d203f43d998  BUILD-LOG.md
+26b5821895a152ddac66a26f16585c6c48ec71d99ca7e7c2b9a4d5a71943c5b4  agents/goldie/work/queue-265/BUILD.md
+1289c0f9f4e857590490a0972b5300cc8fb1a86e3ef79fe63e47472709e982f6  agents/goldie/work/queue-265/logs/01-address.log.gz
+bc0ac95454ca4a4478641832e68caeb82bfe8b1fdc9abc0b80f1126ef42b7be5  agents/goldie/work/queue-265/logs/02-rooms.log.gz
+459a45bd772576847338a438b27f4f578a2a660be744e1404fd239d192c6957c  agents/goldie/work/queue-265/logs/03-bus.log.gz
+c30cecb149e98d64f285e81a82d07a0a89dad5ea223f9031b543230615663bb5  agents/goldie/work/queue-265/logs/M01-human.diff
+a75e02d91ff46fbfaf627beea943183b769e417bcb572bf11f778f0fca7fcf29  agents/goldie/work/queue-265/logs/M01-human.log.gz
+b78b1c5b205272411710f56a981acf58dc09c46333369924b98c4c8657dc949c  agents/goldie/work/queue-265/logs/M02-tester.diff
+6a680dcb1db461cce3a3a2e066aa1245e4f84aa6754354058009bc0f6ebf4185  agents/goldie/work/queue-265/logs/M02-tester.log.gz
+02a6cfab404405099fc39eb83413614c67a0c4c3f87cd23c3849a35d1055ddb0  agents/goldie/work/queue-265/logs/M03-project.diff
+8b7cd0c568510e49b61fa14fce7b2680025b773eda884e0a84163d240a124e39  agents/goldie/work/queue-265/logs/M03-project.log.gz
+18b2cb43f2799301cf934e4c327bc1a03e08ff8d11ff590cb9677c86dfd43ff0  agents/goldie/work/queue-265/logs/M04-members.diff
+195f9ec57c9494552566d2f8b87f3b17a210b811f8b556dd65db89814e237816  agents/goldie/work/queue-265/logs/M04-members.log.gz
+a773e214c76acf5285ac4ca17cdd90dd552ddc79157abe75ef6de7f67a0b6a70  agents/goldie/work/queue-265/logs/M05-collision.diff
+1148cda3f6aaa7f6aeaab2f95c932114ddeac5bfd9318a6b77a4148079d486ed  agents/goldie/work/queue-265/logs/M05-collision.log.gz
+56400065c9cdb6305763b2bff8c0e06e9ae1223fa89b4467634a9951622d3fbe  agents/goldie/work/queue-265/logs/M06-open.diff
+b8f9bd9a5c488e604d0afe3feda4a2602359a94a49c7fdbd2f0f6a421b0ca1ce  agents/goldie/work/queue-265/logs/M06-open.log.gz
+2c1b745a15602cdcaf194131e4d6e0f8fa349e9712ce2e8cb6e695699e4ec19d  agents/goldie/work/queue-265/logs/M07-body.diff
+4857461e7a2ceb01a6446acb4708a732949a0d8d1a85fa2f6d10bedde6b9e11b  agents/goldie/work/queue-265/logs/M07-body.log.gz
+e3480e69d016caea6c1fbcdfa022b18214a10e8deca4409d0dc2f72261d2ee92  agents/goldie/work/queue-265/logs/M08-unknown.diff
+3d0f347f21df3c388a4f39679d4694aadc9684ae8b8ad2d30bf0bb316e48dcb0  agents/goldie/work/queue-265/logs/M08-unknown.log.gz
+62420ed20affcab256facee05414b8b760a4c79a60f60be0c06c88abb61ec6ae  agents/goldie/work/queue-265/logs/M09-ambiguous.diff
+14a18d61344df592e885c46ace34e0c59914f4fbe591fa99eeb3d81fa8ef8bf1  agents/goldie/work/queue-265/logs/M09-ambiguous.log.gz
+0671bf77394f82df92252275171fd9edea2e5b2e7143387840d03bda544676bf  agents/goldie/work/queue-265/logs/M10-messaging.diff
+4202215d40999e0d1cc98ebfb5445f0c8fd4688e6ca968e85d225723076ca8a7  agents/goldie/work/queue-265/logs/M10-messaging.log.gz
+042598ecb551e761d37af898f69e17ec137d2f39687dbf81ce5e1eeb98a38202  agents/goldie/work/queue-265/logs/M11-cursor.diff
+deff3d0514c379bd3d9c6f6bbc60db59b9dce2baaafd6fa611711c98cc8365ce  agents/goldie/work/queue-265/logs/M11-cursor.log.gz
+780e70fbcb2328006c8d9ace75aa62fcd0d935b4d758b50b0f5c5d5c55604122  agents/goldie/work/queue-265/logs/M12-fence.diff
+b629b41a39c028b70d4b847c351d248d6d70e8175d6d27f563b0ed8817f89642  agents/goldie/work/queue-265/logs/M12-fence.log.gz
+1b8c3cec31b44ff018a1bc74fef95996bcbdd21d340e2d2605154ba645648040  agents/goldie/work/queue-265/logs/rerun-00-sandbox.log.gz
+d18c5a9432de06ebec36c937da7dfb1a3e79dc397b33ff624058af351eee24dd  agents/goldie/work/queue-265/logs/rerun-01-address.log.gz
+d10b83ccec56e47d8c7c74d8304fc4fc87b8ea92a50098380cd02b8012c32d09  agents/goldie/work/queue-265/logs/rerun-02-rooms.log.gz
+6ff5955fe5c85f51c1cf4daeb8eddd61ef1a30e170221f99bfb08da8304d7e4a  agents/goldie/work/queue-265/logs/rerun-03-bus.log.gz
+eeba0182f06cee0c06cd15ecf7ef43aaeffd7149b2202cc0653078c20bb46198  agents/goldie/work/queue-265/logs/rerun-04-mutants-driver.log.gz
+5fe9fe35af60ef951c5c68b040aa9bb6067d9c746e143bb5782eb428acd4e4fe  agents/goldie/work/queue-265/logs/rerun-05-restored-address.log.gz
+2b3f3305ff5f6926a0269bd6c88d5f2e4a89727eefcf99625bebb51a70abb649  agents/goldie/work/queue-265/logs/rerun-05-restored-rooms.log.gz
+f11ae40d923affad1936fe51d05981ac201a1051bc9f877d75fc1d544c6e38f1  agents/goldie/work/queue-265/mutants.py
+e9cdf16670a16a14f3dd722a69c63a1785e4deb3608ee05d519b0ec8c1a9ca0b  agents/goldie/work/queue-265/pin-context-grep.txt
+491ba3bb25e918049249178f3c6a67b2b4f56a197f0a67059acb2420cd03b73c  agents/goldie/work/queue-265/pin-context-with-sandbox.txt
+784fb42bff187c0eebcf7756942ec3cf56f8faa7b54ce4ad96181b81fe46f0e9  agents/goldie/work/queue-265/pin-positive-control.txt
+766ead519eefbde958bbdbf77bf858b10dd1e3d9dee8ab5d356fe821ce7602fe  agents/goldie/work/queue-265/reader-grep.txt
+6c3c44eb943f33d5bb547f542c77da4d6f04e738056466bc491c2f6fd5f67946  docs/SESSIONS.md
+1ba33af1f42c88a5346d25fe915a44ee70a27fbc6b9ab880db0866cbdad5d45d  packages/bus/README.md
+232a1c77c2f17011c53b55fc6052f70985598210769d41d7c2c0b535328aad23  packages/bus/src/address.mjs
+71b32ee4afa322793aad81231441ee7badc3e5aff65ff008c6cc0f7f63b72781  packages/bus/src/broker.mjs
+ed57d48d2af4a225259e0a44c86a30b12792ec9f725dd9c89251569b7dc89e5a  packages/bus/src/index.mjs
+a6725ffe30d44981a9b9d3a3c319f7e96a46ec7bd74f0c8d869d9a798eca1a81  packages/bus/tests/address-cases.mjs
+fae431bc3743b224f69da33c4cebe376b47257d67f52d25d3ab0cb59f224a607  packages/bus/tests/address.test.mjs
+8594e94384c1c8b7234cfa8bbc17456cff86d9adef936cd1059a0d5a60e4546b  packages/bus/tests/project-runtime.test.mjs
+892c3709393fa8962710bc07565d1097bbd79ea1fbfda34af5f9385db34ed0fa  packages/bus/tests/rooms.test.mjs
+83019fa6b39ad9fd79b84627856b4dec82683d8261b8cba9b9ac840e0c489268  packages/seat/src/sandbox.mjs
@@ -0,0 +1,10 @@
+--- broker.original
+++ M01-human
+@@ -6423,7 +6423,6 @@
+       case 'room.open':
+       case 'room.send':
+       case 'room.read': {
+-        this.#human(s);
+         const opening = verb === 'room.open';
+         const sending = verb === 'room.send';
+         keys(a, opening ? ['project'] : sending ? ['project', 'body'] : ['project', 'after', 'limit'],
@@ -0,0 +1,12 @@
+--- broker.original
+++ M02-tester
+@@ -122,7 +122,8 @@
+ // Row 175 (#1673, Q173): the test system's reads and two writes, name.set and project.create,
+ // each recorded with `tester` as its actor. The organization branch keeps its own list below.
+ // Row 177 (#1675, Q173): the tester's own threads, owner `tester`, and a stop of their runs.
+-export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies',
+export const TESTER_VERBS = Object.freeze([
+  'room.open', 'room.send', 'room.read','message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies',
+   'usage', 'names', 'limits', 'plugins', 'instances', 'project.list', 'thread.list', 'name.set', 'project.create', 'credentials',
+   'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop',
+   // Row 194 (#1692, D4.1): launch and terminate, and the read of the requests they make.
@@ -0,0 +1,10 @@
+--- broker.original
+++ M03-project
+@@ -6429,7 +6429,6 @@
+         keys(a, opening ? ['project'] : sending ? ['project', 'body'] : ['project', 'after', 'limit'],
+           sending ? ['project', 'body'] : ['project']);
+         const project = identifier(a.project);
+-        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');
+         const members = Object.keys(b.roles).filter((instance) => this.#threaded(s.business, instance)).sort();
+         if (!members.length) fail('thread-instance-missing');
+         const owner = this.#owner(s);
@@ -0,0 +1,10 @@
+--- broker.original
+++ M04-members
+@@ -6431,7 +6431,6 @@
+         const project = identifier(a.project);
+         if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');
+         const members = Object.keys(b.roles).filter((instance) => this.#threaded(s.business, instance)).sort();
+-        if (!members.length) fail('thread-instance-missing');
+         const owner = this.#owner(s);
+         // Preflight all collisions/missing threads before open creates or send writes anything.
+         const threads = members.map((instance) => {
@@ -0,0 +1,11 @@
+--- broker.original
+++ M05-collision
+@@ -6436,8 +6436,6 @@
+         // Preflight all collisions/missing threads before open creates or send writes anything.
+         const threads = members.map((instance) => {
+           const t = this.#store.get('SELECT * FROM threads WHERE project=? AND name=?', project, instance);
+-          if (t && (t.instance !== instance || t.owner !== owner))
+-            fail(opening ? 'room-thread-name-taken' : 'room-not-open');
+           if (!t && !opening) fail('room-not-open');
+           return t ?? { instance, name: instance };
+         });
@@ -0,0 +1,10 @@
+--- broker.original
+++ M06-open
+@@ -6438,7 +6438,6 @@
+           const t = this.#store.get('SELECT * FROM threads WHERE project=? AND name=?', project, instance);
+           if (t && (t.instance !== instance || t.owner !== owner))
+             fail(opening ? 'room-thread-name-taken' : 'room-not-open');
+-          if (!t && !opening) fail('room-not-open');
+           return t ?? { instance, name: instance };
+         });
+         if (opening) {
@@ -0,0 +1,10 @@
+--- broker.original
+++ M07-body
+@@ -6450,7 +6450,6 @@
+         if (sending) {
+           string(a.body, 32768);
+           const addressed = parseAddress(a.body);
+-          if (!addressed.body.trim()) fail('invalid-request');
+           const selected = new Set();
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
@@ -0,0 +1,10 @@
+--- broker.original
+++ M08-unknown
+@@ -6454,7 +6454,6 @@
+           const selected = new Set();
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
+-            if (!candidates.size) fail('unknown-addressee');
+             if (candidates.size > 1) fail('addressee-ambiguous');
+             selected.add([...candidates][0]);
+           }
@@ -0,0 +1,10 @@
+--- broker.original
+++ M09-ambiguous
+@@ -6455,7 +6455,6 @@
+           for (const tag of addressed.tags) {
+             const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
+             if (!candidates.size) fail('unknown-addressee');
+-            if (candidates.size > 1) fail('addressee-ambiguous');
+             selected.add([...candidates][0]);
+           }
+           const targets = threads.filter((t) => !addressed.tags.length || selected.has(t.instance));
@@ -0,0 +1,10 @@
+--- broker.original
+++ M10-messaging
+@@ -6462,7 +6462,6 @@
+           const sessions = targets.map((t) => {
+             const session = this.#defaultSession(t.id);
+             this.#sessionFence(session);
+-            this.#checkMessaging(s.business, 'human', t.instance);
+             return session;
+           });
+           const at = this.#now();
@@ -0,0 +1,11 @@
+--- broker.original
+++ M11-cursor
+@@ -6488,7 +6488,7 @@
+             `SELECT m.seq FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE m.id=? AND m.business=? AND mt.thread IN (${placeholders})`,
+             identifier(a.after), s.business, ...tids,
+           )?.seq;
+-          if (after === undefined) fail('message-not-found');
+          if (after === undefined) after = 0;
+         }
+         // At most one row per instance joins a group; one lookahead row completes the last page.
+         const rows = this.#store.all(
@@ -0,0 +1,10 @@
+--- broker.original
+++ M12-fence
+@@ -6461,7 +6461,6 @@
+           const targets = threads.filter((t) => !addressed.tags.length || selected.has(t.instance));
+           const sessions = targets.map((t) => {
+             const session = this.#defaultSession(t.id);
+-            this.#sessionFence(session);
+             this.#checkMessaging(s.business, 'human', t.instance);
+             return session;
+           });
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Slot-only runner. Every mutation restores and verifies the complete broker bytes."""
+from pathlib import Path
+import hashlib, os, re, subprocess, sys
+
+ROOT = Path(__file__).resolve().parents[4]
+SOURCE = ROOT / 'packages/bus/src/broker.mjs'
+OUT = Path(__file__).resolve().parent / 'logs'
+MUTANTS = [
+    ('M01-human', 'human-required', 'room verbs require the human', '        this.#human(s);\n', ''),
+    ('M02-tester', 'tester-refused', 'room verbs require the human', None, None),
+    ('M03-project', 'project-not-found', 'room verbs refuse missing projects', "        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');\n", ''),
+    ('M04-members', 'thread-instance-missing', 'room verbs refuse missing projects', "        if (!members.length) fail('thread-instance-missing');\n", ''),
+    ('M05-collision', 'room-thread-name-taken', 'room.open preflights instance collisions', "          if (t && (t.instance !== instance || t.owner !== owner))\n            fail(opening ? 'room-thread-name-taken' : 'room-not-open');\n", ''),
+    ('M06-open', 'room-not-open', 'send/read refuse a missing canonical member', "          if (!t && !opening) fail('room-not-open');\n", ''),
+    ('M07-body', 'invalid-request', 'unknown or non-member addressees and tags-only bodies', "          if (!addressed.body.trim()) fail('invalid-request');\n", ''),
+    ('M08-unknown', 'unknown-addressee', 'unknown or non-member addressees and tags-only bodies', "            if (!candidates.size) fail('unknown-addressee');\n", ''),
+    ('M09-ambiguous', 'addressee-ambiguous', 'a legacy name colliding with another member key', "            if (candidates.size > 1) fail('addressee-ambiguous');\n", ''),
+    ('M10-messaging', 'message-sender-refused', 'messaging denial on the last target', "            this.#checkMessaging(s.business, 'human', t.instance);\n", ''),
+    ('M11-cursor', 'message-not-found', 'room.read groups one send, pages', "          if (after === undefined) fail('message-not-found');\n", '          if (after === undefined) after = 0;\n'),
+    ('M12-fence', 'session-clearing', 'a clearing last member fences the whole send', '            this.#sessionFence(session);\n', ''),
+]
+
+def sha(data): return hashlib.sha256(data).hexdigest()
+
+def main():
+    OUT.mkdir(exist_ok=True)
+    original = SOURCE.read_bytes()
+    text = original.decode()
+    start = text.index("      case 'room.open':")
+    end = text.index("      // A thread belongs", start)
+    block = text[start:end]
+    for name, refusal, expected, old, new in MUTANTS:
+        if old is None:
+            needle = 'export const TESTER_VERBS = Object.freeze(['
+            assert text.count(needle) == 1
+            changed = text.replace(needle, needle + "\n  'room.open', 'room.send', 'room.read',", 1)
+        else:
+            assert block.count(old) == 1, (name, block.count(old))
+            changed = text[:start] + block.replace(old, new, 1) + text[end:]
+        # Save conventional original→mutant diff without relying on shell interpolation.
+        import difflib
+        (OUT / f'{name}.diff').write_text(''.join(difflib.unified_diff(text.splitlines(True), changed.splitlines(True), fromfile='broker.original', tofile=name)))
+        tmp = subprocess.check_output(['mktemp', '-d', '/mnt/storage/scratch/tmp/XXXXXX'], text=True).strip()
+        env = {**os.environ, 'TMPDIR': tmp}
+        log = OUT / f'{name}.log'
+        try:
+            SOURCE.write_text(changed)
+            with log.open('w') as stream:
+                for command in [['date', '-u'], ['uptime'], ['bash', '-c', 'bash /mnt/storage/scratch/sage-busy-now.sh 2>/dev/null | tail -1']]:
+                    subprocess.run(command, cwd=ROOT, env=env, stdout=stream, stderr=subprocess.STDOUT, check=True)
+                stream.write(f'TMPDIR={tmp}\nmutant={name} refusal={refusal} original_sha256={sha(original)}\n')
+                stream.flush()
+                result = subprocess.run(['timeout', '-k', '10', '120', 'node', '--test', '--test-reporter=tap', 'packages/bus/tests/rooms.test.mjs'],
+                                        cwd=ROOT, env=env, stdout=stream, stderr=subprocess.STDOUT)
+            output = log.read_text()
+            killed = result.returncode == 1 and re.search(r'(?m)^not ok \d+ - ' + re.escape(expected), output)
+            print(f'{name}: exit={result.returncode} target_killed={bool(killed)} log={log}', flush=True)
+            if not killed: return 1
+        finally:
+            SOURCE.write_bytes(original)
+            assert SOURCE.read_bytes() == original
+            assert sha(SOURCE.read_bytes()) == sha(original)
+            with log.open('a') as stream: stream.write(f'RESTORED sha256={sha(original)}\n')
+    return 0
+
+if __name__ == '__main__': sys.exit(main())
@@ -0,0 +1 @@
+No changed-file mention has a literal 64-hex digest within eight lines.
@@ -0,0 +1 @@
+No changed-product-file mention has a literal 64-hex digest within eight lines.
@@ -0,0 +1,6 @@
+packages/bus/src/store.mjs:15:const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
+packages/bus/src/store.mjs:16:export const SCHEMA_SHA256 = 'a2ba3a46f12e56139ecae9e55227d00847842aedec50c1d92aaae28844ca48e7';
+packages/bus/src/store.mjs:106:const hex = (value) => createHash('sha256').update(value).digest('hex');
+packages/bus/src/store.mjs:107:if (hex(ddl) !== SCHEMA_SHA256) throw Error('schema-source-mismatch');
+packages/bus/tests/schema.test.mjs:17:  db.exec(readFileSync(new URL('../schema.sql', import.meta.url), 'utf8'));
+packages/bus/tests/schema.test.mjs:90:  const hex = (s) => createHash('sha256').update(s).digest('hex');
@@ -0,0 +1,133 @@
+packages/bus/tests/session-compactions.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/console-decide.test.mjs:14:import { Broker, CONSOLE_VERBS } from '../src/broker.mjs';
+packages/harness/tests/runner.test.mjs:14:import { Broker, BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/project-files.test.mjs:8:import { PROJECT_FILE_VERBS } from '../src/broker.mjs';
+packages/cli/tests/lifecycle.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/lifecycle-verbs.test.mjs:11:import { Broker, LIFECYCLE_REQUEST_MS, TESTER_VERBS } from '../src/broker.mjs';
+packages/bus/tests/lifecycle-verbs.test.mjs:74:  for (const verb of ['instance.launch', 'instance.end', 'instance.request']) assert.ok(TESTER_VERBS.includes(verb), verb);
+packages/bus/tests/lifecycle-verbs.test.mjs:75:  assert.equal(TESTER_VERBS.includes('instance.regenerate'), false);
+packages/bus/tests/tasks.test.mjs:9:import { Broker, BusError, TASK_VERBS } from '../src/broker.mjs';
+packages/harness/tests/tools.test.mjs:4:import { ORGANIZATION_KEYS as BROKER_ORGANIZATION_KEYS, TASK_PAGE, TASK_PAGE_MAX } from "../../bus/src/broker.mjs";
+packages/seat/tests/session.test.mjs:11:import { Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/decision-route.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/thread-launch.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/seat/tests/sandbox.test.mjs:15:import { Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/host-run.test.mjs:16:import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
+packages/bus/tests/host-run.test.mjs:181:  // organization.set reaches the writer as limits.set (broker.mjs:1379).
+packages/cli/tests/helpers.mjs:10:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/tasks/tests/fields.test.mjs:10:import { TASK_VERBS } from '../../bus/src/broker.mjs';
+packages/tasks/tests/fields.test.mjs:226:      // decision back to that role (broker.mjs, decision.raise).
+packages/webui/tests/instances.test.mjs:15:import { BusError } from '../../bus/src/broker.mjs';
+packages/cli/tests/tester-threads.test.mjs:14:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/staff-request.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/tasks/tests/world.mjs:5:import { Broker } from '../../bus/src/broker.mjs';
+packages/cli/tests/processing-cli.test.mjs:7:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/grant-host.test.mjs:10:import { Broker, registrySha256 } from '../src/broker.mjs';
+packages/business/tests/workflow-roles.test.mjs:115:    // Q169 (broker.mjs END_PROTECTED, #hardWait): revoking the assistant is a hard wait as well.
+packages/business/tests/workflow-roles.test.mjs:136:  // sage-0709: only recordLand spends a decision (broker.mjs #spent). checkLand refuses decision-consumed after
+packages/cli/tests/thread-revoke.test.mjs:18:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/tester-writes.test.mjs:10:import { Broker, TESTER_VERBS, TESTER_ORGANIZATION_VERBS } from '../src/broker.mjs';
+packages/bus/tests/tester-writes.test.mjs:18:test('row 175: TESTER_VERBS and the organization branch tester set are pinned', () => {
+packages/bus/tests/tester-writes.test.mjs:19:  assert.deepEqual([...TESTER_VERBS], [
+packages/bus/tests/tester-writes.test.mjs:32:  assert.ok(Object.isFrozen(TESTER_VERBS) && Object.isFrozen(TESTER_ORGANIZATION_VERBS));
+packages/cli/tests/stack-release.test.mjs:1993: for(const [f,text] of [['packages/cli/src/cli.mjs',id===A?'// fixture host from before row 163\nprocess.exit(1);\n':script(rHost)],['packages/webui/src/cli.mjs',script(rConsole)],['packages/bus/src/store.mjs',rStore(v,froms)],['packages/bus/src/migrate-schema.mjs',script(rMigrate)],['packages/bus/src/broker.mjs','export class BusError extends Error { constructor(code) { super(code); this.code = code; } }\n']]){mkdirSync(dirname(join(d,f)),{recursive:true});writeFileSync(join(d,f),text)}
+packages/cli/tests/session-cli.test.mjs:94:  const { Broker } = await import('../../bus/src/broker.mjs');
+packages/cli/tests/session-launch.test.mjs:21:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/revoke-window.test.mjs:19:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/chief-of-staff.test.mjs:10:import { Broker, ACTIONS } from '../src/broker.mjs';
+packages/cli/tests/instances.test.mjs:13:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/thread-cli.test.mjs:14:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/processing.test.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/idle-stop-race.test.mjs:17:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/tester-reads.test.mjs:12:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/session-clear.test.mjs:18:import { BusError } from "../../bus/src/broker.mjs";
+packages/bus/tests/names.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/cli/tests/compactions-launch.test.mjs:24:import { BusError } from "../../bus/src/broker.mjs";
+packages/cli/tests/tester.test.mjs:7:import { BusError, Broker } from "../../bus/src/broker.mjs";
+packages/bus/tests/reload.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/agents.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/end-launch.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/decide-browser.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/credential-verbs.test.mjs:11:import { Broker, CREDENTIAL_VERBS } from '../src/broker.mjs';
+packages/webui/tests/send-browser.test.mjs:13:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/launch-notice.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/messages.test.mjs:3:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/workflow-roles.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/library-sync.test.mjs:11:import { Broker, LIBRARY_VERBS } from '../src/broker.mjs';
+packages/bus/tests/credential-status.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/gitea-grant-docker.test.mjs:15:import { Broker, GRANT_EVIDENCE } from '../src/broker.mjs';
+packages/bus/tests/thread-migration.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/comment-cursors.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/thread-claims.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/state.test.mjs:7:import { Broker, TASK_PAGE } from '../src/broker.mjs';
+packages/bus/tests/access-revoke.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/plugins-verb.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/transport.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/publish.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/publish.test.mjs:221:  const { ACTIONS, HARD_WAITS } = await import('../src/broker.mjs');
+packages/bus/tests/tester-threads.test.mjs:11:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/tester-threads.test.mjs:284:  // The row #specNotice (broker.mjs) writes for a human save of the spec in project stack. The save
+packages/bus/tests/approval-binding.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/fire-revokes-grants.test.mjs:15:import { Broker, GRANT_EVIDENCE, registrySha256 } from '../src/broker.mjs';
+packages/bus/tests/daily-quota-runtime.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limit-checks.test.mjs:323:  for (const file of ['../src/runtime.mjs', '../src/broker.mjs', '../src/process.mjs']) {
+packages/bus/tests/spec-fixtures.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/decisions.test.mjs:9:import { Broker, RECENT } from '../src/broker.mjs';
+packages/bus/tests/peer-transport.test.mjs:9:import { BusError } from '../src/broker.mjs';
+packages/bus/tests/peer-transport.test.mjs:47: const {TASK_VERBS,BusError}=await import('../src/broker.mjs');
+packages/bus/tests/messaging.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/rooms.test.mjs:8:import { Broker, THREAD_PAGE, THREAD_PAGE_MAX, TESTER_VERBS } from '../src/broker.mjs';
+packages/bus/tests/rooms.test.mjs:80:    assert.ok(!TESTER_VERBS.includes(verb));
+packages/bus/tests/web.test.mjs:8:import { Broker, BusError, WEB_UNTRUSTED } from '../src/broker.mjs';
+packages/bus/tests/replies.test.mjs:11:import { Broker, REPLIES } from '../src/broker.mjs';
+packages/bus/tests/thread-shares.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/message-citation.test.mjs:6:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limits.test.mjs:7:import {Broker} from '../src/broker.mjs';
+packages/bus/tests/host-fixtures.mjs:6:import { registrySha256, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/gitea-grant.test.mjs:12:import { Broker, GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/csuite-messaging.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/decision-close.test.mjs:9:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-scope.test.mjs:14:import { Broker, GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/project-await.test.mjs:7:import { Broker, BusError } from '../src/broker.mjs';
+packages/bus/tests/launcher-released.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/limit-stop.test.mjs:12:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/message-filter.test.mjs:12:import { Broker, REPLIES } from '../src/broker.mjs';
+packages/bus/tests/land.test.mjs:18:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/single-use.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/session-clear.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-migration.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/usage-broker.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/project-runtime.test.mjs:13:  const source = readFileSync(new URL('../src/broker.mjs', import.meta.url), 'utf8');
+packages/bus/tests/task-read.test.mjs:7:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/library.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/instances-verb.test.mjs:11:import { Broker, LIFECYCLE_HUMAN_VERBS, ORGANIZATION_KEYS, TESTER_ORGANIZATION_VERBS } from '../src/broker.mjs';
+packages/bus/tests/routes-verb.test.mjs:13:import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
+packages/bus/tests/broker.test.mjs:10:const { Broker } = await import('../src/broker.mjs').catch((e) => {
+packages/bus/tests/grant-enroll.test.mjs:10:import { Broker, BusError, writeGrantEvent, registrySha256 } from '../src/broker.mjs';
+packages/bus/tests/hard-waits.test.mjs:7:import { Broker, ACTIONS, HARD_WAITS } from '../src/broker.mjs';
+packages/bus/tests/requirements.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/grant-executor.test.mjs:15:import { Broker, registrySha256, writeGrantEvent } from '../src/broker.mjs';
+packages/bus/tests/sessions.test.mjs:10:import { Broker } from '../src/broker.mjs';
+packages/bus/tests/user-principal.test.mjs:14:  Broker, ACTIONS, USER_VERBS, TESTER_VERBS, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, CREDENTIAL_VERBS,
+packages/bus/tests/user-principal.test.mjs:16:} from '../src/broker.mjs';
+packages/bus/tests/user-principal.test.mjs:137:    ...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...LIBRARY_VERBS, ...CREDENTIAL_VERBS, ...HOSTS_VERBS,
+packages/bus/tests/tester.test.mjs:10:import { Broker, TASK_VERBS } from '../src/broker.mjs';
+packages/bus/tests/threads.test.mjs:9:import { Broker, THREAD_PAGE } from '../src/broker.mjs';
+packages/webui/tests/routes-browser.test.mjs:15:import {BusError} from '../../bus/src/broker.mjs';
+packages/bus/tests/creative.test.mjs:8:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/granted-user.test.mjs:16:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/task-page.test.mjs:7:import { Broker, TASK_PAGE, TASK_PAGE_MAX } from '../src/broker.mjs';
+packages/webui/tests/user-option-swap.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/webui/tests/board-held.test.mjs:20:import { Broker } from '../../bus/src/broker.mjs';
+packages/webui/tests/chat-sessions-access.test.mjs:10:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/review.test.mjs:14:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/sso-browser.test.mjs:14:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/revoke-window.test.mjs:13:import { Broker } from '../src/broker.mjs';
+packages/webui/tests/bus.test.mjs:13:import { Broker } from '../../bus/src/broker.mjs';
+packages/bus/tests/viewer.test.mjs:13:  Broker, ACTIONS, USER_VERBS, VIEWER_VERBS, BOARD_VERBS, TESTER_VERBS, TESTER_ORGANIZATION_VERBS, PROJECT_FILE_VERBS,
+packages/bus/tests/viewer.test.mjs:14:} from '../src/broker.mjs';
+packages/bus/tests/viewer.test.mjs:116:  const others = new Set([...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...BOARD_VERBS, 'no.such.verb']);
+packages/webui/tests/tester-fixture.mjs:12:import { Broker, BusError } from '../../bus/src/broker.mjs';
+packages/webui/tests/routes.test.mjs:12:import { BusError } from '../../bus/src/broker.mjs';
+packages/webui/tests/chat.test.mjs:191:  const { Broker } = await import('../../bus/src/broker.mjs');
+packages/webui/tests/bus-browser.test.mjs:11:import { Broker } from '../../bus/src/broker.mjs';
@@ -0,0 +1,56 @@
+# Row 326 / #1822 — five run-sheet gaps
+
+Goldie, 2026-10-24. Branch goldie/row-run-sheet in /home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row-run-sheet. Base local refactor4ec279dc43922b338a94718a2afdaba87ef89c15, explicitly assigned by sage-3893. Brief docs/plans/2026-10-24_run-sheet-doc-brief.md at4ec279dc4, blobce3e24fa, section Brief: five run-sheet gaps. Reviewer Gladstone; Sage posts review and owns landing/full gate.
+
+## Before / after and choices
+
+Before: the sheet omitted proof bytes/newline handling, treated render refusal without distinguishing metadata/content, omitted missing-project warning consequences and a pre-install key check, offered no first-install retry form, and omitted the bus-relative backup checksum form.
+
+After: the sheet covers all five cases in their existing sections6/9. Numbered section headings are unchanged. Only this BUILD.md and docs/guides/host-run-sheet.md are edited, per the brief's explicit two-file boundary. Session/build-phase registration and the manifest are recorded here rather than adding changes to SESSIONS.md, BUILD-LOG.md or a third manifest file. No host action or credential read. No suite or product command executed, and no CLEAR needed for this doc-only row (decision137).
+
+| Gap / claim | Source read and how it supports the text |
+| --- | --- |
+| Proof format, optional LF | webui/src/serve.mjs:257-267 opens no-follow, checks regular/uid/mode600-or400, strips exactly one trailing LF at263, then requires32+ ASCII base64url chars at264. Table states the allowed alphabet and one optional trailing LF. Extra newline/CR is outside that alphabet. |
+| Render versus start | case2-unit.sh:397-408 explicitly stats/realpaths the proof and never opens it. webui/src/serve.mjs:267 throws the content error; webui/src/cli.mjs:138-140 catches and sets exit2. Table now distinguishes metadata refusal at render from bad bytes at Console start. |
+| Missing project warning | business/src/cli.mjs:74-78 reports absent plus the no-project-variables warning, then continues. case2-install.sh:217-221 captures validate output and prints business-validates on success. Text makes that incomplete install possible and tells operators to stop on the missing-file warning, per Duckworth row323 N2. |
+| Pre-install key check | business/src/cli.mjs:71-82 checks every file-backed project, skips kind library, and requires loaded id==business key at80. Read-only inline Node uses only builtins and section2's pinned node, as mosaic. It reads the exact intended business input and files under each project's root, prints a match, and exits nonzero with STOP for read/JSON/id failure. Expected .53 output comes from .mosaic/project.json:3 and case1-business.mosaic-stack.json:10-11. Fixing business rather than project id is mos-1563. |
+| Why check before install | case2-install.sh:178 makes the copy before validation at217. New check is explicitly before case2-install.sh and needs no existing Mosaic config, npm modules or installed wrapper. |
+| Refused first-install residue | case2-install.sh:172/174 creates/bootstraps the config; bootstrap.sh:13 dispatches to mosaic-config.mjs, whose412-424 creates config.json or validates an existing one without rewriting it. case2-install.sh:200-211 may create businesses/file and library slots. case2-persona-import.mjs:300-308 may create library personas. Validation cleanup at case2-install.sh:217-219 removes only this run's new business file, retaining dirs. Copy may already exist under the path at install:80/178; stack-copy.sh:68 reuses an existing copy. |
+| Retry paths / refs | Mos-1565/ops-0291, as pinned in the brief, names exactly root checkout, mosaic clone and default config dir to move aside. UTC-suffixed mv is root-only documentation; no delete, chown or chmod. Destination collision/move failure prints STOP. Retry starts section6's first-install block again. The existing upgrade fetch targets only refs/remotes/origin/refactor; stack-copy.sh:44-48 requires reachability from both it and refs/heads/refactor. |
+| Credential re-placement | Existing sheet section9 names claude-session.env, library proof and library-gitea with owner/mode. Moving config aside preserves them but the new config needs Jason to re-place any already-filled files, under mos-1565. Existing per-agent slots still require credentials issue/Approve, never hand placement. No value or command to read a credential added. |
+| Backup hand check | stack-release.sh:475-482 creates activation/bus and writes SHA256SUMS from inside bus. restore at502 and rehearsal at2244 cd bus and check ../SHA256SUMS. New hand command does the same as mosaic, without --quiet so the expected bus.sqlite:OK is visible; ops-0292 records why checking in activation itself fails. |
+
+## Read-only grep gate
+
+Executed after editing, with no test/suite run:
+
+```
+git grep -n host-run-sheet -- 'packages/*/tests/*' 'scripts/*'
+# no output, exit1
+
+git grep -n case1-business.mosaic-stack.json -- 'packages/*/tests/*' 'scripts/*'
+packages/business/tests/case1-business-file.test.mjs:13:const DOCUMENT = join(REPO, "docs/guides/case1-business.mosaic-stack.json");
+packages/business/tests/case1-project-key.test.mjs:9:const CASE1 = join(REPO, "docs/guides/case1-business.mosaic-stack.json");
+# exit0: positive control, same command form, both tests read this document
+
+git grep -n -E '(host-run-sheet.*[0-9a-f]{64}|[0-9a-f]{64}.*host-run-sheet)' -- 'packages/*/tests/*'
+# no output, exit1: no 64-hex test pin beside the sheet name
+```
+
+An earlier positive control with case2-install.sh also found the real installer spawn in case1-business-file.test.mjs:39 and the CLI installer tests. The sheet-name search finds no reference at all in tests/scripts, stronger than just finding no same-line pin. No read/pin blocker.
+
+Static syntax only: extracted the three new shell snippets, replaced only the version placeholder for parsing, and ran bash-n3/3. Extracted Node heredoc parsed with node --check --input-type=module. No snippet body executed. git diff --check passes. Source citations checked against this base; no new em dash and section numbering unchanged.
+
+## Session / claimant receipt
+
+2026-10-24 | Goldie a13dd6d5-5e73-4b7d-8318-02abeff24940 | Row326/#1822 doc-only build | Five gaps documented with source lines and grep control; no suites/host/credential action. Claim goldie-0326-start-1 rev3793, briefed→in-progress. In-review follows the pushed candidate; expected tokenless pre-send failure will be handed to Sage.
+
+## Inline manifest
+
+Only the sheet needs a content pin; BUILD.md is this receipt in the same candidate commit. An inline manifest honors the brief's two-file limit:
+
+```
+e4c14516edff3bfbc81ea553a5a6ccebb6154942473540659d4681c2d56c9711  docs/guides/host-run-sheet.md
+```
+
+Reviewer validates the five source chains and operational order. Sage's landing gate owns suites. No code row265 work started; its brief comes separately.
@@ -0,0 +1,10 @@
+# Gyro
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1571, as the W2 brief names. Owns row 310, O2 W2:
+the WordCraft source import and reproducible restricted web build (docs/plans/2026-10-21_q195-writing-editor.md,
+"W2 WordCraft source import and reproducible restricted web build").
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
+own; it pushes only its own `gyro/*` branches through the repository credential helper (mos-0981), never `refactor`,
+`main` or another seat's branch. Claude seats orchestrate and give the Opus 5.5 landing review (mos-1571). Registered by
+Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -1622,3 +1622,6 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24T01:14Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row325 / #1821 verified | sage-3882: new3/3, business264/264, one key mutant killed/restored, new3/3 again, per-run fresh shortTMP/load/helperCLEAR. Four manifest entries verify; sole old assertion key change, no queue writes. Candidate push/report to Sage and Gladstone next.
 2026-10-24 | Poe | Q246 / mos-1566, row 208 / 193d (#1706), poe/row208 | Started; approved design hash verified; implementation and isolated acceptance pending.
 2026-10-24 | Poe | Row 208 / 193d (#1706), poe/row208 | Builder acceptance green: webui 418/418, plugins 119/119, four UI mutants killed with bus bypass proofs; candidate prepared for Gladstone then Duckworth guard review.
+2026-10-24T04:29Z | Duckworth (Opus 5.5) | row 208 (193d) second review, guards only, on 4a4bef6c1 (sage-3934) | APPROVE (static), no bus change, every hidden control has a broker refusal, grant hint per-grant and self-only, N1 5 s poll (duckworth-0302) |
+2026-10-24T04:27Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row265 / #1770 C2-09b rooms | Goldie owns build, Boyd reviews under sage-3915. New goldie/row265 worktree at ec86f2c84, claim rev3814; room verbs/parser/new tests prepared, no old tests changed. Sage-3932 slot: new parser14/14 and rooms18/18 passed; whole bus in progress before refusal mutants, stop rule active.
+2026-10-24T04:35Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row265 / #1770 verified | First slot stopped at project-runtime import pin. mos-1567 narrowly authorizes pin and pure-source mount correction. sage-3942 rerun: sandbox10/10, parser15/15, rooms18/18, bus957/957, twelve refusal mutants killed/restored SHA71b32ee4, parser15/15 + rooms18/18 again. Slot returned goldie-0034; no further test runs. Boyd reviews RUNNER_FILES alongside rooms; own-branch push/claimant in-review next.
@@ -1365,3 +1365,28 @@ public sign-in smoke and a forged-loopback 401 check; rollback drops flags
 before middleware. Same-uid callers can still read the file; separate service
 uid is Jason's question on #385. The Authentik allowed-uid file remains an
 identity input and is never reused for proof.
+
+## `scripts/push-check.sh` — verify a prospective push
+
+`scripts/push-check.sh SHA EXPECTED_LOG [--row N]... [--base-ref REF] [--fetch]`
+checks the repository at the caller's cwd; it never pushes or writes the queue.
+Git checks cover the full repository even from a subdirectory; EXPECTED_LOG is
+resolved relative to the original caller. Non-UTF-8 git paths refuse with exit 2.
+EXPECTED_LOG must contain exactly `git log --oneline BASE..SHA` (including its
+newlines). BASE defaults to `refs/remotes/origin/refactor`; `--base-ref` overrides
+it. Only `--fetch` fetches origin, before resolving BASE.
+
+Success prints `LOG_OK`, `FF_OK`, `NO_BINARY` or `BINARY_REVIEWED n`,
+`SECRETS_CLEAN`, `NO_ATTRIBUTION`, then `PUSH_READY BASE..SHA` as the last line.
+A changed present blob counts as binary when numstat marks it binary or its
+first 8000 committed bytes contain NUL, regardless of git attributes. Each
+present binary needs its committed blob sha256 and exact path in an approved
+latest-round candidate from a supplied row. A `changes` receipt blocks that round.
+Commit candidates authorize only changed paths with matching bytes and mode.
+Deleted binaries need no review. Queue reads retain canonical-checkout checks
+and refuse unconfirmed durable tails with exit 2.
+
+Exit 0 means ready; 1 means refusal (`STOP reason`, always the last line); 2 means
+usage or environment error. A refusal never prints later success tokens.
+`timeout -k 10 240 bash scripts/test-push-check.sh` exercises isolated scratch
+repositories and the six required mutants; set TMPDIR to a scratch filesystem.
@@ -207,6 +207,43 @@ install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha
 sudo -u mosaic -H git clone -q -b refactor /srv/mosaic/incoming/<sha>.bundle /srv/mosaic/src/mosaic-stack
 ```

+If the first install refuses, use Mos's retry path (mos-1565, ops-0291). Bootstrap can already have
+written `/srv/mosaic/.config/mosaic-dev/config.json` (`scripts/case2-install.sh:174`,
+`scripts/bootstrap.sh:13`, `scripts/mosaic-config.mjs:412-424`). The config dir can also hold
+`businesses/`, the business file, and library persona files and slot dirs
+(`scripts/case2-install.sh:200-211`, `scripts/case2-persona-import.mjs:300-308`). A validation refusal
+removes only the business file this run created; its directory remains (`scripts/case2-install.sh:217-219`).
+The copy may already exist under `/srv/mosaic/.local/share/mosaic-stack/copies/<sha>`
+(`scripts/case2-install.sh:80`, `scripts/stack-copy.sh:68`).
+
+As root, move these three paths aside with a UTC suffix. Move, never delete, so their owner and mode
+stay with them (mos-1565). This is the default-instance retry for the paths in this sheet:
+
+```sh
+(
+  cd / || exit 1
+  retry_stamp="$(date -u +%Y%m%dT%H%M%SZ)" || exit 1
+  for retry_path in /root/mosaic-stack /srv/mosaic/src/mosaic-stack /srv/mosaic/.config/mosaic-dev; do
+    if [ -e "$retry_path" ] || [ -L "$retry_path" ]; then
+      retry_saved="$retry_path.$retry_stamp"
+      if [ -e "$retry_saved" ] || [ -L "$retry_saved" ]; then
+        echo "STOP: retry destination already exists: $retry_saved" >&2
+        exit 1
+      fi
+      mv -T -- "$retry_path" "$retry_saved" || exit 1
+    fi
+  done
+) || echo "STOP: could not move the first-install paths aside; do not continue"
+```
+
+Then rerun the first-install block from its first line. Never use the upgrade fetch below on clones
+whose first install has not finished: it updates `refs/remotes/origin/refactor`, while copy requires
+the commit to be reachable from both that ref and `refs/heads/refactor` (`scripts/stack-copy.sh:44-48`; mos-1565).
+Recheck section 9 before starting units. If Jason already filled `claude-session.env`, the library
+proof file or `library-gitea`, have him re-place those files under the new config dir with section 9's
+owner and mode. Per-agent slots still use `mosaic credentials issue` or Approve, never a hand copy
+(section 9; mos-1565). The moved config dir preserves the earlier files.
+
 After a first install, once both units are running (section 10), adopt the installed copy before
 any activate or upgrade. This step runs only on Mos's go, with Jason or Mos running it
 (`scripts/stack-release.sh:14`):
@@ -254,6 +291,19 @@ When a run doesn't exit 0, send Mos the exit and the last lines of `/var/log/mos
  the old copy. The next run refuses `args-differ`, and a render from that file would put the old copy back.
  Move the file the result line names into place with `mv -f`. The two differ only in the `--copy` value.

+To check a backup by hand before rollback or restore, run as the stack's user from its `bus/` directory:
+
+```sh
+sudo -u mosaic -H /bin/sh -c \
+  'cd "<dataRoot>/backups/stack/<activation>/bus" && sha256sum -c ../SHA256SUMS'
+```
+
+Expect `bus.sqlite: OK`; stop on a failed check. The set holds `bus/bus.sqlite`, and `SHA256SUMS` names
+`bus.sqlite` relative to `bus/` (`scripts/stack-release.sh:475-482`). Running `sha256sum -c SHA256SUMS`
+from the backup set's directory looks for `bus.sqlite` one directory too high (ops-0292). Restore and
+rehearsal use the same `bus/` form
+(`scripts/stack-release.sh:502`, `scripts/stack-release.sh:2244`).
+
 After `case2-install.sh` succeeds, create the human CLI wrapper before running
 `stack-copy.sh check --units external`. Creating this wrapper is a separate live
 step requiring Mos's go (`scripts/stack-copy.sh:3`); the install does not create it. Run only on that go:
@@ -275,11 +325,52 @@ it. The wrapper must name the same `<sha>` copy as the units.
 Precheck lines: none. Root's checkout at `<sha>` and the stack's user's clone: precheck line missing.
 After install, `stack-copy.sh check --units external` reads the copy the units run.

+Before running `case2-install.sh`, check the exact file you will pass as `--business-file`. Each
+non-library `projects` key must equal the `id` in `<root>/.mosaic/project.json`, and that file must exist
+in the stack's user's clone. Library entries are skipped by validate (`packages/business/src/cli.mjs:72`).
+Run this read-only check as `mosaic` with section 2's pinned node:
+
+```sh
+sudo -u mosaic -H /opt/mosaic-stack/node-<v>/bin/node --input-type=module - '<business-file>' <<'MOSAIC_PROJECT_KEYS'
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+try {
+  const business = JSON.parse(readFileSync(process.argv[2], 'utf8'));
+  const projects = Object.entries(business.projects);
+  if (!projects.length) throw new Error('business file declares no projects');
+  for (const [id, entry] of projects) {
+    if (entry.kind === 'library') continue;
+    const file = join(entry.root, '.mosaic', 'project.json');
+    const project = JSON.parse(readFileSync(file, 'utf8'));
+    if (project.id !== id)
+      throw new Error(`project file ${file} has id ${project.id}, but business ${business.id} declares it as ${id}`);
+    console.log(`ok project ${id}: ${file} has id ${project.id}`);
+  }
+} catch (error) {
+  console.error(`STOP: ${error.message}; do not install`);
+  process.exitCode = 1;
+}
+MOSAIC_PROJECT_KEYS
+```
+
+For .53 expect `ok project stack: /srv/mosaic/src/mosaic-stack/.mosaic/project.json has id stack`
+(`.mosaic/project.json:3`, `docs/guides/case1-business.mosaic-stack.json:10-11`). Any STOP or nonzero exit
+stops the install. Fix a mismatched business key, not the project id (mos-1563). The install otherwise
+reaches that refusal at step 7, after making the copy (`packages/business/src/cli.mjs:80`,
+`scripts/case2-install.sh:178`, `scripts/case2-install.sh:217`).
+
 The stack's user's `scripts/case2-install.sh` (C2-13b, design 10 step 2b) makes the first copy with
 `stack-copy.sh copy <sha>`. The copy runs `npm ci` from `package-lock.json`, which installs the pinned
 harness, so the host needs to reach the npm registry during the install. The install runs no
 `release.sh package` or `activate`.

+A missing `.mosaic/project.json` only warns: `project <id>: no project file at <path>; it has no project
+variables`. Validate reports that project `absent` and continues (`packages/business/src/cli.mjs:74-78`).
+An install can therefore pass step 7 without the project's variables. It captures validate's output
+and prints `business <id> validates` (`scripts/case2-install.sh:217-221`). Treat the missing-file warning as a stop,
+place the correct project file and repeat the check above before continuing (Duckworth 323 N2;
+`scripts/case2-install.sh:217-221`).
+
 ## 7. The args file

 `/etc/mosaic-stack/dev.args` holds the `case2-unit.sh` arguments, one per line, with the serve flags after a
@@ -318,7 +409,7 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
 | Path | File | Mode | Owner | Profile | Precheck line |
 |---|---|---|---|---|---|
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `ZAI_API_KEY=...` | 0600 | mosaic | library | `<path> sets ZAI_API_KEY` |
-| `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names | 0600 or 0400 | mosaic | library | none. `case2-unit.sh` refuses at render. Precheck line missing. |
+| `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names: one base64url line, at least 32 `[A-Za-z0-9_-]` characters, with one optional trailing LF (`packages/webui/src/serve.mjs:263-264`) | 0600 or 0400 | mosaic | library | none. Render checks metadata only and never opens the file (`scripts/case2-unit.sh:397-408`). Bad bytes refuse at Console start with exit 2 (`packages/webui/src/serve.mjs:267`, `packages/webui/src/cli.mjs:138-140`). Precheck line missing. |
 | `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | After a unit start, wait for loopback `/healthz` with the bounded retry in section 10 before `case2-precheck.sh --business <business> --library-status`: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |

@@ -27,8 +27,9 @@ pane, persistent chat in the right, a draggable divider, document navigation, pi
 right-click thesaurus. It is not a reskinned row 154 editor. The first useful release, opened at W7 after the required gates, must
 pass writing, footnote, comment, tracked-change and page-layout save/reopen tests together.

-D2. Q210/Q220 allow design and review now. O2 builds remain after the October 27 MVP work
-and never take its gate slot. S0 baseline clearance is conditional on M1–M14, Fenton/Filbert
+D2. Q210/Q220 allow design, review and builds ahead of the October 27 MVP work (mos-1571).
+O2 rows never take the gate slot ahead of a v1 row; they land only when the slot would
+otherwise sit idle. S0 baseline clearance is conditional on M1–M14, Fenton/Filbert
 at `origin/fenton/q195-s0` 74ec32013 (#1798, Sage PASS comment 30917). Q234 approves the
 exact measured frame CSP; the shell stays unchanged. mos-1363 requires W2 to remeasure zero
 violations with style-src 'self'; no rfd style hash is approved. These gates are satisfied
@@ -585,14 +586,15 @@ Their implementation gates remain separate. No code row W1/W2/W6/W3a/W3b/W3/W4b/
 before S0 PASS (recorded for this baseline, with M1–M14 still binding). Each also observes its explicit dependencies, source ownership, the CSP gate
 and the MVP gate-slot priority. Q177 permits chaining reviewed candidates, not overlapping
 owners. Sage assigns model-only seats. Each implementation reviewer is Opus 5.5 and did not
-author the code. Fenton reviews this design and can review code only when not its author.
+author the code. A Codex-built row gets its first reviews from a separate Codex thread (Q246);
+the Opus 5.5 review runs once, on the landing candidate (mos-1571). Fenton reviews this design and can review code only when not its author.

 Build order (mos-1470, Vikunja 571 comment 961): W7 first supplies reviewed conversion/format
 routing code with production import still closed, then W8 lands the Connections view, then
 W7's human opening step may open the first real chapter import. W8 is after W3/W4b and
 W7's closed routing candidate, before that W7 opening step. This is Mos's build-order rule,
 not a new REQ-LIB-8 condition or an addition to import acceptance. No converted real chapter
-exists without the view. O2 code remains after 10-27 and never ahead of MVP rows.
+exists without the view. O2 code may be built before 10-27 (mos-1571) but never lands ahead of MVP rows.

 G1. Future code acceptance runs each touched test file independently and affected package
 suites on Sage's slot after MVP priority, plus required repository checks. Source builds need
@@ -0,0 +1,103 @@
+# Push check in the repository, with reviewed binaries
+
+Written 2026-10-24 by Sage for Mos's mos-1572 ("Go with A for the guard"), after rows 265 and 310
+raised the binary question (mos-1570, sage-3978).
+
+## Brief: push-check.sh passes a binary only when the reviewed candidate lists its path and sha256
+
+**Why.** The lead's push check is a scratch script, `/mnt/storage/scratch/sage-r64/pushcheck.sh`
+(mos-0856/0857), so nobody has reviewed it and no test covers it. Its `NO_BINARY` step refuses any
+path that `git diff --numstat BASE SHA` reports as binary (`-` in the first column). Row 265 had to
+waive that step by hand for 22 gzip logs. Row 310 (W2) will need committed WASM, fonts and test blobs.
+Mos chose option A: keep the binary check, and let a binary through only when its path and sha256
+appear in the candidate a reviewer approved. Whether any large binary lands at all is a separate
+question for Jason (Vikunja 618). This row builds the guard, not that answer.
+
+**Read first.**
+- The scratch script, copied under "The scratch script today" at the end of this brief. Don't read
+  `/mnt/storage/scratch/sage-r64` itself; it's Sage's scratch.
+- `packages/queue/README.md`, sections on `move ID in-review` (manifest and commit candidates) and
+  `review verify-commit`. `packages/queue/src/review.mjs` for how a round's candidate and its receipts
+  are stored. Running `scripts/mosaic queue show N` prints them.
+- `docs/plans/2026-10-20_force-push-guard.md`, row 211 (Darkwing, in progress). That row owns
+  `scripts/git-hooks/pre-push`, the hook install and `scripts/slot-busy.sh`. Don't touch those files,
+  and don't wire this check into a hook.
+
+**What ships.**
+
+1. `scripts/push-check.sh SHA EXPECTED_LOG [--row N]...` (new). It runs the scratch script's steps in
+   the same order and prints the same tokens, so the lead's push sequence only changes its path:
+   `LOG_OK`, `FF_OK`, `NO_BINARY` or `BINARY_REVIEWED <n>`, `SECRETS_CLEAN`, `NO_ATTRIBUTION`, then
+   `PUSH_READY BASE..SHA` as the last line. Every refusal prints one `STOP <reason>` line and exits 1.
+   A usage or environment error exits 2. It works in the repository the caller's cwd is in. The base
+   ref defaults to `refs/remotes/origin/refactor`, and `--base-ref REF` overrides it for tests. A fetch
+   happens only when `--fetch` is given, and the lead's sequence passes it.
+2. The binary step. For each path that `git diff --numstat BASE SHA` marks binary and that exists at
+   SHA (a deleted binary needs no review):
+   - compute the sha256 of the blob at `SHA:path` (`git cat-file blob`, not the working tree);
+   - look for an approved candidate among the `--row` rows. A round counts only when it is the row's
+     latest round and has a receipt with verdict `approve` whose candidate equals that round's
+     candidate. A `changes` receipt in the same round blocks it;
+   - for a manifest candidate, the manifest must hold the line `<sha256>  <path>` exactly;
+   - for a commit candidate, use the same rule as `queue review verify-commit`. The path must be one the
+     candidate changed from its first parent, and the sha256 of the candidate's blob must equal SHA's;
+   - no match prints `STOP binary <path> <sha256> not in a reviewed candidate`. With no `--row`, any
+     binary stops, which is today's behaviour.
+   Read the queue only through `scripts/mosaic queue show N` or the queue package's read functions.
+   Never write the queue or post anything.
+3. The secret scan and the attribution check stay as they are. A binary passes the secret scan only
+   through the review above. Decompressing gzip to scan it is a separate row if anyone wants it
+   (mos-1570). Don't add it here.
+4. `scripts/test-push-check.sh` (new), run by `timeout -k 10` like the other suites. It builds a
+   scratch bare remote, a scratch clone and a scratch queue. It never touches origin, the canonical
+   `docs/plans/queue.json` or a seat's queue lock. If the queue CLI can't read a scratch queue without a
+   full scratch copy of the repository, use a scratch copy. If that is impractical too, stop and ask
+   Sage before inventing a test-only override. Cases:
+   - a text-only range prints `NO_BINARY` and `PUSH_READY`;
+   - an unlisted binary stops, naming the path;
+   - a listed path with a different sha256 stops;
+   - an approved manifest candidate passes and prints `BINARY_REVIEWED 1`;
+   - an approved commit candidate passes. One whose blob for that path differs from SHA's stops;
+   - a round with a `changes` receipt, a superseded earlier round, and an approve receipt for a
+     different candidate each stop;
+   - a deleted binary passes with no `--row`;
+   - a non-fast-forward SHA, a log mismatch, an attribution line and a planted fake secret each stop,
+     and nothing after the stop prints;
+   - the last line is `PUSH_READY` only on success, so `| tail -1 | grep -q '^PUSH_READY '` is safe.
+5. Mutants, each killed by the test: skip the sha256 comparison; accept a `changes` round; accept an
+   earlier round; read the working tree instead of the blob; let a binary through when `--row` is absent.
+6. `docs/TOOLS.md`: one entry for `push-check.sh` with usage, the tokens and the exit codes.
+
+**Files owned.** `scripts/push-check.sh`, `scripts/test-push-check.sh`, the new `docs/TOOLS.md` entry,
+and your `agents/<seat>/work/queue-<row>/` packet (BUILD.md, plain-text evidence). Anything else needs a
+brief amendment.
+
+**Out of scope.** The pre-push hook and slot check (row 211). Deciding whether W2's WASM or W1's data
+lands (Jason, Vikunja 618). Gzip scanning. Retiring the scratch script, which Sage does after landing.
+
+**Gate.** A separate Codex thread does the first review. Dewey reviews once on the landing candidate
+(guards go to a Claude reviewer, mos-1542). `scripts/test-push-check.sh` and every other
+`scripts/test-*.sh` are green on Sage's landing gate, and the mutants are killed. Done when Sage's next
+push runs through `scripts/push-check.sh` instead of the scratch script. Evidence is plain text
+(BRIEF-TEMPLATE, mos-1570). Use a TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/XXXXXX`.
+
+### The scratch script today
+
+```bash
+#!/bin/bash
+# Push checks for an explicit sha (mos-0856/0857). Usage: pushcheck.sh SHA EXPECTED_LIST_FILE
+# EXPECTED_LIST_FILE holds the exact `git log --oneline origin/refactor..SHA` lines, newest first.
+set -o pipefail
+cd /mnt/storage/src/mosaic-stack || exit 9
+SHA=$(git rev-parse --verify "$1^{commit}") || { echo "STOP sha"; exit 9; }
+git fetch -q origin || { echo "STOP fetch"; exit 9; }
+BASE=$(git rev-parse refs/remotes/origin/refactor) || exit 9
+diff <(git log --oneline "$BASE..$SHA") "$2" && echo LOG_OK || { echo "STOP log"; exit 1; }
+git merge-base --is-ancestor "$BASE" "$SHA" && echo FF_OK || { echo "STOP ff"; exit 1; }
+[ "$(git diff --numstat "$BASE" "$SHA" | awk '$1=="-"' | wc -l)" = 0 ] && echo NO_BINARY || { echo "STOP binary"; exit 1; }
+if git diff "$BASE" "$SHA" | grep -E '^\+' | grep -iqE 'BEGIN [A-Z ]*PRIVATE KEY|ghp_[A-Za-z0-9]{20}|sk-ant-[A-Za-z0-9-]{10}|xox[bp]-|AKIA[0-9A-Z]{16}|(token|secret|password)["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9_\-]{24,}'; then echo "STOP secrets"; exit 1; fi
+echo SECRETS_CLEAN
+if git log --format=%B "$BASE..$SHA" | grep -iqE 'co-authored-by|generated with'; then echo "STOP attribution"; exit 1; fi
+echo NO_ATTRIBUTION
+echo "PUSH_READY $BASE..$SHA"
+```
@@ -59,6 +59,13 @@ fails it on any commit (row 323, mos-1561). A builder whose cli suite
 can't run says so in the row, and the cli suite counts from the lead's
 landing gate.

+Evidence that lands with a row is plain text: logs, diffs, manifests. No
+gzip or other binary file, so the lead's push guard runs its binary and
+secret checks with no waiver. If a log is too big, cut it to the lines
+that prove the claim. Or keep it off refactor, in the seat's scratch, and
+cite its path and sha256 in BUILD.md (mos-1570, after row 265's 22 gzip
+logs).
+
 ### Handoffs

 Every seat hands off directly (DECISIONS Q210, mos-1221). When the owner
@@ -756,3 +756,15 @@ The guard is right. The test is the weak part: its prefix leaves no margin, and
 timeout. Fix: shorten the prefix and fail on a launch-failed log line instead of waiting 20 s. That's an
 old-test change, so it needs Mos's go (mos-1272). Bound to the next row that edits revoke-window.test.mjs.
 Until then, docs/plans/BRIEF-TEMPLATE.md's Gate section sets TMPDIR to `mktemp -d /mnt/storage/scratch/tmp/XXXXXX`.
+
+## ops-0282 B2-2 closed by row 326
+
+Sage. Row 326 (#1822) landed in f58049de0 (33f49f7d5). docs/guides/host-run-sheet.md now gives the Console
+proof file format in the .54 library table, so the B2-2 entry above is closed. Row226 N1-N4 stay open.
+
+## Row 208 N1: user.js re-renders every 5 seconds
+
+Sage, for Duckworth's N1 on row 208 (c31496, landed f58049de0). packages/webui/src/public/user.js:16
+re-renders the user view on a 5 s timer while the tab is visible, whether or not anything changed. That's a
+steady client and server load per open tab, not a correctness or guard issue. Fix: render on change, or poll the bus only for a change
+marker. Bound to the next row that edits user.js.
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 3788 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3844 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -193,7 +193,7 @@ Generated from `docs/plans/queue.json` revision 3788 by `queue render`. Do not e
 | 154 | A WYSIWYG Console editor built from reviewable source (Q168) | researcher; reviewers dewey, filbert | #1648 | done | 148 done | Mos's decision 123 go on the license and candidate before any code is imported, and later on the public/ diff; Dewey and Filbert approve naming the candidate manifest; webui, bus, cli, project suites and every scripts/test-*.sh green. Needs row 148 done. (sage) | `docs/plans/2026-10-16_q168-wysiwyg-editor.md` § A WYSIWYG Console editor built from reviewable source | — |
 | 155 | The human and the chief of staff configure the assistant (Q169) | darkwing; reviewers dewey, filbert | #1649 | done | 139 done, 141 done | Dewey and Filbert approve on #1649 naming the candidate manifest; Mos's decision 123 go on the public/ diff; bus, business, harness, cli, webui suites and every scripts/test-*.sh green; own window and tested migration if schema changes. Needs rows 139 and 141 done. (sage) | `docs/plans/2026-10-16_q169-assistant-config.md` § The human and the chief of staff configure the assistant | — |
 | 156 | The host starts the landing run once a merge decision is approved | dewey; reviewers filbert | #1651 | done | 125 done, 149 done | Filbert approves on #1651 naming the candidate manifest; Sage's full gate rerun at the landing target; the re-pin needs Mos's go (sage) | `docs/plans/2026-10-18_landing-run-launch.md` § The host starts the landing run once a merge decision is approved | — |
-| 157 | I2 install images, the install config key, the endpoint helper and the egress proxy | researcher; reviewers darkwing, filbert | #1652 | queued | 87 done, 163 done | Filbert and Darkwing approve on #1652 naming the candidate manifest, and Mos's provider-host output is on the issue; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I2 install images, the install config key, the endpoint helper and the egress proxy | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority |
+| 157 | I2 install images, the install config key, the endpoint helper and the egress proxy | bentina; reviewers boyd, darkwing | #1652 | in-review, round 2, request posted | 87 done, 163 done | Boyd (Codex, first review) and Darkwing approve on #1652 naming the candidate manifest, and Mos's provider-host output is on the issue; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I2 install images, the install config key, the endpoint helper and the egress proxy | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority |
 | 158 | I3 two broker listeners, the human-socket via value and the host relay | dewey; reviewers darkwing, filbert | #1653 | queued | 157 done | Filbert and Darkwing approve on #1653 naming the candidate manifest; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I3 two broker listeners, the human-socket via value and the host relay | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority |
 | 159 | I4 the Console in a container with signed-in human authority | darkwing; reviewers dewey, filbert | #1654 | queued | 158 done | Filbert and Dewey approve on #1654 naming the candidate manifest; Sage's full gate green on the landing tree; lands before M3 (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I4 the Console in a container with signed-in human authority | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority. B1 is decision 147 |
 | 160 | I5 managed sessions as containers | researcher; reviewers dewey, filbert | #1655 | queued | 158 done | Filbert and Dewey approve on #1655 naming the candidate manifest; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I5 managed sessions as containers | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority |
@@ -244,7 +244,7 @@ Generated from `docs/plans/queue.json` revision 3788 by `queue render`. Do not e
 | 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | done | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | Landed ce6a96ad6 fast-forward on 0fa7bf421 (3 commits, 4 paths, manifest 858463b1). Duckworth APPROVE r1 c30375 (signed :124 test diff, mos-1262). Gate: Morgana slot205 10 files, bus 652/0, M1 M11-M14 killed, 0 skips; Sage test-*.sh 10/10, 3 by-design skips. N1/N3 to 205b or R3, N2 to 193b2 brief, N4 = #1782 before any user thread. Rebase next: 268 r4, 194, 236, 253, 274. |
 | 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | launchpad; reviewers duckworth | #1704 | done | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | Landed 0cbe2e9b3 fast-forward on 17f415792 (10 commits, 22 paths), pushed 19:47Z. Duckworth APPROVE rev 3322 c30795 on 0cbe2e9b3; request rev 3320/3321 c30793 posted as jarvis. Gate (Launchpad, 9538e0fc8, tip differs in BUILD.md only): bus 850/0, cli 869/0, ten scripts/test-*.sh rc=0, touched files whole green, M2-M4 M7-M9 and Q2 killed. One placed fixture red (mos-1272). Schema 3l to 3m; live --migrate is Mos's go under Q173. |
 | 207 | 193c: mosaic access user verbs and --level viewer (#1691) | megavolt; reviewers duckworth | #1705 | done | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | LANDED c4f77373f 22:49Z 10-22 (fast-forward from f0e3dcdf4). Rebuild of gated 9bb406c6c: range-diff 4/4 =, patch-ids equal, 4 manifest blobs equal. Duckworth APPROVE c30849 rev 3356. Gate on 712f79c0a under sage-3041: access.test 31/31, M1-M8 killed, cli 894/894, ten scripts green. N1 DEFERRED (next access.test row). No live change. |
-| 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done, 294 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
+| 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | poe; reviewers duckworth, gladstone | #1706 | done | 192 done, 206 done, 294 done | Gladstone (Codex, first review) and Duckworth approve the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | LANDED f58049de0 (build 4a4bef6c1, Duckworth note f58049de0), combined with row 326 on one full gate 04:36-04:51Z: all package suites except queue 0 fail 0 skip (webui 418, plugins 119, cli 986), every scripts/test-*.sh green. Gladstone c31495, Duckworth c31496. #1706 closed c31504. N1 user.js 5 s re-render to DEFERRED. Bundle 9fc7754a. |
 | 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
 | 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | done | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Landed f5753c0e8 on refactor (base 9d165be8c), pushed. Patch-id 723b1c83 matches git diff ad95c888c..0485384e9 on the 23 manifest paths; landed files pass r5 manifest 688d38b9. Duckworth approve r2 rev 2592, r3 29851. Mutants 52/53, M22b equivalent (rev 2584). Gate on ad95c888c+patch: packages 2796/0, scripts 429/0; landed blobs equal the gate tree. |
 | 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | darkwing; reviewers dewey | #1709 | in-progress | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |
@@ -301,7 +301,7 @@ Generated from `docs/plans/queue.json` revision 3788 by `queue render`. Do not e
 | 262 | Email E06: IMAP source module (post-v1) | unassigned | #1767 | queued | 261 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E06 IMAP source module | — |
 | 263 | Email E07: address and rule evaluator (post-v1) | unassigned | #1768 | queued | 258 done, 259 done, 260 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E07 address and rule evaluator | — |
 | 264 | T1 item 7: independent sessions, compaction counts and clear context | gizmoduck; reviewers duckworth | #1769 | done | — | The named reviewer approves the manifest. The design's T1-T7 acceptance tests run whole plus every touched suite on Sage's slot; T3 waits on Vikunja 466 (N2, Claude's compaction count format and the managed dataRoot reader). The design's section 6 mutants are killed. (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | LANDED 84f53540d ff on e479521d3 14:18:23Z, 21 commits = gizmoduck/row264-r13 tip (no rewrite, range-diff identity). Manifest 257408e9 approved Duckworth rev 3214 (c30640). Gate r13 2cc34aef8: 20 files, bus 827, cli 837, webui 345/1 skip, 10 shells; M1-M4 assertion kills (mos-1279 B, M2 4 files). Overlap none (13, 257). N1 actor_run binds row 269; N2 esbuild skip later gate (sage-2695). |
-| 265 | Case 2 C2-09b rooms: room.open, room.send with @tags, room.read | rocko; reviewers dewey | #1770 | queued | 219 done | Dewey approves the manifest. The brief's tests run whole plus the bus suite and every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09b rooms: room.open, room.send with @tags, room.read | — |
+| 265 | Case 2 C2-09b rooms: room.open, room.send with @tags, room.read | goldie; reviewers boyd | #1770 | done | 219 done | Boyd approves the manifest. The brief's tests run whole plus the bus suite and every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09b rooms: room.open, room.send with @tags, room.read | LANDED 200dd396c (cherry-pick of ef4c93853, 50 blobs equal, log appends equal) 05:13Z on full gate 04:57-05:12Z: all package suites except queue 0 fail 0 skip (bus 957, cli 986, seat 218), every scripts/test-*.sh green. Boyd c31501 incl mos-1567 mount read. 22 gzip logs scanned decompressed, clean. #1770 closed c31510. Bundle 02c3c286. |
 | 266 | Case 2 C2-10c Console room view: merged timeline and @name completion | researcher; reviewers dewey | #1771 | queued | 225 done, 265 done | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every touched suite. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10c Console room view: merged timeline and @name completion | Haiku high subagent under decision 129. |
 | 267 | Case 2 C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | morgana; reviewers filbert | #1772 | queued | 216 done, 217 done, 224 done | Filbert approves the manifest. The brief's tests and the end-to-end crossover run whole plus every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | R8 accepted (sage-2218). Webby's R8 noise note (gosalyn-0127) is for the builder. |
 | 268 | Case 2 C2-01c playground levels: universe-level prefixes and draft universes | gizmoduck; reviewers webby | #1773 | done | — | Webby approves the manifest. The brief's tests run whole plus the library suite and every touched suite on Sage's slot; the brief's gate grep over packages and docs/case2 finds no library-playground-outside-book. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01c playground levels: universe-level prefixes and draft universes | Landed c27207f6e fast-forward on ce6a96ad6 (1 commit, 9 paths, digest caa0fa4e). r4 is a carry of r3 aca53c4f0: range-diff =, patch-id 2942acc8 equal, blobs equal. Webby APPROVE round 2 on ecd9b35eb stands; carries webby-0112 (r3) and webby-0113 (r4, notes 34e1ab2bf). Gate: Gizmoduck r4 rerun brief 14/14, library 83/83, business 209/209, 0 skips; gate grep empty. 194 rebases next (business.test.mjs). |
@@ -361,7 +361,8 @@ Generated from `docs/plans/queue.json` revision 3788 by `queue render`. Do not e
 | 322 | F8/F9: case2-install.sh runs the library persona import from the stack copy, and its refusal carries the error line (433 Run B, ops-0273) | goldie; reviewers morgana | #1818 | required; done | — | Morgana approves (install path). The new case2-install test fails on 094124b4e and passes on the candidate; a mutant restoring REPO at :185 is killed; Sage's full landing gate runs every package suite and scripts/test-*.sh. Then ops-01 reruns Run B P1. (sage) | `docs/plans/2026-10-23_host-fixes-1816-brief.md` § Brief: F8 and F9, the library persona import runs without the clone's node_modules | LANDED 467b05fe2, cherry-pick of 7b4ea4217 on 860afc2b6; added and removed lines identical, patch-id differs only by BUILD-LOG/SESSIONS append context (both sides kept). Pushed with tip 3569bf54f 23:32:54Z 10-23. Morgana APPROVE c31451 rev 3758, N1-N3 non-blocking. Sage full gate GREEN 23:32:28Z on 3569bf54f, all suites 0 fail, every scripts/test-*.sh rc 0. Next: ops-01 Run B P1 rerun on 467b05fe2 (mos-1553). Live unchanged 45dca69f6. |
 | 323 | Case 1 factory business file for .53: docs/guides/case1-business.mosaic-stack.json plus a loader and factory-check test (#414 stage 2, ops-0277) | goldie; reviewers duckworth | #1819 | done | — | Sage full gate: all package suites except queue plus every scripts/test-*.sh (mos-1455); Duckworth review; new test file and one bus.tester mutant on CLEAR (sage) | `docs/plans/2026-10-23_case1-business-file-brief.md` § Brief: the Case 1 factory business file | LANDED 571376c30 + evidence 6a0f0f4f8 (ff from dd6cb5872), tip 99930362e. Duckworth approve c31477 rev 3778 on 6a0f0f4f8. Sage gate green 00:54Z on 6a0f0f4f8: all package suites 0 fail, every scripts/test-*.sh rc 0. Root cause of the revoke-window red: TMPDIR length, tools.sock over 107 bytes (session.mjs:278). Brief template rule and DEFERRED entry in c25799928 (mos-1561). N1/N2 doc only. |
 | 324 | Tracker optional in the business file (Q247) | goldie; reviewers duckworth | #1820 | done | — | New tests only. Absent tracker: loader and validate pass, the bus boots with no credential-file error and no @sync. Present tracker unchanged. A mutant that skips the presence check is killed. Then whole touched test files, then the full landing gate. (sage) | `docs/plans/2026-10-23_optional-tracker-brief.md` § Brief: tracker becomes optional in the business file | LANDED 7e59ba8b3 + evidence dbdfcfd52 (ff from 3569bf54f), pushed with tip dd6cb5872 00:06:58Z 10-24. Duckworth APPROVE c31470 rev 3770 (static, N1 doc only). Goldie: new 5/5 and 4/4, business.test 21/21, presence mutant killed. Sage full gate GREEN 00:05:49Z on 64ea54083: every package suite 0 fail 0 skip (business 254, cli 986, bus 924, plugins 119, webui 411), every scripts/test-*.sh rc 0. Live unchanged 45dca69f6. Run B N1 for ops-01 P2/P3 (mos-1558). |
-| 325 | Case 1 business file: re-key project to stack to match .mosaic/project.json, plus a project-file test (#414 stage 2, ops-0288, mos-1563) | goldie; reviewers gladstone | #1821 | in-review, round 1, request posted | — | New test file and packages/business whole on CLEAR; one key mutant killed; Gladstone review; Sage full landing gate (mos-1455) (sage) | `docs/plans/2026-10-24_case1-project-key-brief.md` § Brief: re-key the Case 1 project to stack | — |
+| 325 | Case 1 business file: re-key project to stack to match .mosaic/project.json, plus a project-file test (#414 stage 2, ops-0288, mos-1563) | goldie; reviewers gladstone | #1821 | done | — | New test file and packages/business whole on CLEAR; one key mutant killed; Gladstone review; Sage full landing gate (mos-1455) (sage) | `docs/plans/2026-10-24_case1-project-key-brief.md` § Brief: re-key the Case 1 project to stack | LANDED c5f96836d (ff from 99930362e), tip 3d2569ce2. Gladstone approve c31484 rev 3788 on c5f96836d. Sage gate green 01:31Z on c5f96836d: all package suites 0 fail (business 264, cli 986), every scripts/test-*.sh rc 0. Project key is now stack, matching .mosaic/project.json; new case1-project-key test checks the real project file. Old-test line :70 under mos-1564. |
+| 326 | Host run sheet: five operator gaps (B2-2 proof format, 323 N2, pre-install key check, failed-first-install retry, backup SHA256SUMS form) | goldie; reviewers gladstone | #1822 | done | — | Gladstone approves the manifest; every new claim cites its line; no test reads the sheet; Sage's full landing gate green (sage) | `docs/plans/2026-10-24_run-sheet-doc-brief.md` § Brief: five run-sheet gaps | LANDED 33f49f7d5 (cherry-pick of a1b13c60e, patch-id match, sheet e4c14516) in f58049de0 with row 208 on one full gate 04:36-04:51Z, all suites green. Gladstone c31489. #1822 closed c31507. B2-2 closes in DEFERRED. Bundle 9fc7754a. |

 <!-- mosaic-queue:end -->

@@ -242,6 +242,9 @@ a receipt with empty `changes`. A refusal is `action.refused` with its code alon
 | `replies` | `{id}`: a message UUID; human and reader sessions only. The messages whose `in_reply_to` is that id, oldest first, at most 50. Writes nothing. |
 | `project.create` | `{name,repo?}`; human sessions only (row 121, #1615). `repo` must name one of the business's `projects` (`unknown-repo`); a second project with the same name refuses `project-exists`. Returns `{id}`. |
 | `project.list` | No args; human sessions only. The business's projects, oldest first. |
+| `room.open` | `{project}`; human only. Creates/reuses the caller's canonical member threads, named by sorted `THREAD_DEFINITIONS` instance keys. A taken name/owner/instance refuses `room-thread-name-taken` atomically. Returns `{project,threads:[{id,instance,name}]}`. |
+| `room.send` | `{project,body}`; human only, room must be fully open (`room-not-open`). Leading whitespace and `@name` tokens (including a final EOF tag) address current display names or member keys; no tags broadcasts, repeats send once. Unknown/ambiguous members refuse `unknown-addressee`/`addressee-ambiguous`; tags-only refuses `invalid-request`. Stores the original body, one normal message/route/human.input per target in one transaction, with one shared message timestamp. Returns `{ids,to}` in member-key order. |
+| `room.read` | `{project,after?,limit?}`; human only, complete owned room. Oldest first across all sessions of member threads. Returns entries with first-message fields plus `thread`, `session`, `instance`, `ids` and `to`. Only consecutive human rows with equal at/body/class and distinct instances merge; repeated instances split identical sends. `limit` counts merged entries (default 50, 1–200). Continue after the last entry's last `ids` element; an `after` outside the room refuses `message-not-found`. No tester access or schema change. |
 | `thread.create` | `{project,name}`; human sessions only. The thread belongs to the caller and to the business's one thread instance (Projects and threads, below). Returns `{id,instance}`. Refuses `project-not-found`, `thread-exists`, `thread-instance-missing` or `thread-instance-ambiguous`. |
 | `thread.list` | `{project?,shared?}`; human sessions only. The caller's own threads, oldest first. With `shared: true` (row 206), the threads others own that the caller may read (Thread shares, below), each row adding `owner`. |
 | `thread.open` | `{thread,session?}`; human sessions only. Records a `thread_opens` row, which asks the launcher to start the thread's session. Returns `{opened}`. |
@@ -0,0 +1,14 @@
+// C2-09b: a pure leading-address parser, shared with the room UI's parity test.
+// The remainder is for empty-body checks; the broker always stores the original input.
+export function parseAddress(input) {
+  if (typeof input !== 'string') throw new TypeError('body must be a string');
+  const tags = [];
+  let body = input.trimStart();
+  while (true) {
+    const token = /^@(\S+)(?:\s+|$)/u.exec(body);
+    if (!token) break;
+    tags.push(token[1]);
+    body = body.slice(token[0].length);
+  }
+  return { tags, body };
+}
@@ -1,4 +1,5 @@
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
+import { parseAddress } from './address.mjs';
 import { isAbsolute, dirname } from 'node:path';
 import { initializeControl, processingStatus } from '../../processing-control/src/state.mjs';
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
@@ -6418,6 +6419,99 @@ export class Broker {
          .all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business)
          .filter((p) => !s.user || this.#granted(s, 'project.list', p.id, null));
      }
+      // C2-09b: canonical per-instance threads form one human-owned project room.
+      case 'room.open':
+      case 'room.send':
+      case 'room.read': {
+        this.#human(s);
+        const opening = verb === 'room.open';
+        const sending = verb === 'room.send';
+        keys(a, opening ? ['project'] : sending ? ['project', 'body'] : ['project', 'after', 'limit'],
+          sending ? ['project', 'body'] : ['project']);
+        const project = identifier(a.project);
+        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', project, s.business)) fail('project-not-found');
+        const members = Object.keys(b.roles).filter((instance) => this.#threaded(s.business, instance)).sort();
+        if (!members.length) fail('thread-instance-missing');
+        const owner = this.#owner(s);
+        // Preflight all collisions/missing threads before open creates or send writes anything.
+        const threads = members.map((instance) => {
+          const t = this.#store.get('SELECT * FROM threads WHERE project=? AND name=?', project, instance);
+          if (t && (t.instance !== instance || t.owner !== owner))
+            fail(opening ? 'room-thread-name-taken' : 'room-not-open');
+          if (!t && !opening) fail('room-not-open');
+          return t ?? { instance, name: instance };
+        });
+        if (opening) {
+          return { project, threads: threads.map((t) => ({
+            id: t.id ?? this.#dispatch(s, 'thread.create', { project, name: t.name, instance: t.instance }).id,
+            instance: t.instance, name: t.name,
+          })) };
+        }
+        if (sending) {
+          string(a.body, 32768);
+          const addressed = parseAddress(a.body);
+          if (!addressed.body.trim()) fail('invalid-request');
+          const selected = new Set();
+          for (const tag of addressed.tags) {
+            const candidates = new Set([this.#named(s.business, tag), tag].filter((instance) => members.includes(instance)));
+            if (!candidates.size) fail('unknown-addressee');
+            if (candidates.size > 1) fail('addressee-ambiguous');
+            selected.add([...candidates][0]);
+          }
+          const targets = threads.filter((t) => !addressed.tags.length || selected.has(t.instance));
+          const sessions = targets.map((t) => {
+            const session = this.#defaultSession(t.id);
+            this.#sessionFence(session);
+            this.#checkMessaging(s.business, 'human', t.instance);
+            return session;
+          });
+          const at = this.#now();
+          const ids = targets.map((t, i) => {
+            const mid = randomUUID();
+            this.#store.run(
+              'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+              mid, at, s.business, 'human', 'human-cli', t.instance, 'INFO', null, null, null, a.body,
+            );
+            this.#route(s.business, mid, t.instance, sessions[i]);
+            this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid);
+            return mid;
+          });
+          return { ids, to: targets.map((t) => t.instance) };
+        }
+        const limit = a.limit ?? THREAD_PAGE;
+        if (!Number.isInteger(limit) || limit < 1 || limit > THREAD_PAGE_MAX) fail('invalid-request');
+        const tids = threads.map((t) => t.id);
+        const placeholders = tids.map(() => '?').join(',');
+        let after = 0;
+        if (a.after !== undefined) {
+          after = this.#store.get(
+            `SELECT m.seq FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE m.id=? AND m.business=? AND mt.thread IN (${placeholders})`,
+            identifier(a.after), s.business, ...tids,
+          )?.seq;
+          if (after === undefined) fail('message-not-found');
+        }
+        // At most one row per instance joins a group; one lookahead row completes the last page.
+        const rows = this.#store.all(
+          `SELECT m.*,mt.thread,mt.session,t.instance FROM messages m JOIN message_threads mt ON mt.message=m.id JOIN threads t ON t.id=mt.thread
+           WHERE m.business=? AND mt.thread IN (${placeholders}) AND m.seq>? ORDER BY m.seq LIMIT ${limit * members.length + 1}`,
+          s.business, ...tids, after,
+        );
+        const entries = [];
+        let previous;
+        for (const m of rows) {
+          const entry = entries.at(-1);
+          if (entry && m.from_role === 'human' && previous.from_role === 'human' && m.seq === previous.seq + 1
+              && m.at === previous.at && m.body === previous.body && m.class === previous.class && !entry.to.includes(m.instance)) {
+            entry.ids.push(m.id);
+            entry.to.push(m.instance);
+          } else {
+            if (entries.length === limit) break;
+            entries.push({ ...m, ids: [m.id], to: [m.instance] });
+          }
+          previous = m;
+        }
+        return entries;
+      }
      // A thread belongs to the user who made it and to one declared thread instance.
      // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
      case 'thread.create': {
@@ -3,3 +3,4 @@ export { startBroker } from './runtime.mjs';
 export { Client } from './client.mjs';
 export { views } from './views.mjs';
 export { busBusiness } from './business.mjs';
+export { parseAddress } from './address.mjs';
@@ -0,0 +1,16 @@
+// C2-09b / C2-10c: reusable parser vectors. Keep the expected result independent of the parser.
+export const addressCases = [
+  ['one', '@continuity x', { tags: ['continuity'], body: 'x' }],
+  ['many', '@bean @chet hello', { tags: ['bean', 'chet'], body: 'hello' }],
+  ['repeat', '@bean @bean hi', { tags: ['bean', 'bean'], body: 'hi' }],
+  ['plain', 'hello @bean', { tags: [], body: 'hello @bean' }],
+  ['stop', '@bean hello @chet', { tags: ['bean'], body: 'hello @chet' }],
+  ['EOF tag', '@continuity', { tags: ['continuity'], body: '' }],
+  ['EOF last tag', '@bean @chet', { tags: ['bean', 'chet'], body: '' }],
+  ['leading whitespace', ' \t\n@bean\t@chet\nhello ', { tags: ['bean', 'chet'], body: 'hello ' }],
+  ['tags only', '@bean \t\n', { tags: ['bean'], body: '' }],
+  ['empty', '', { tags: [], body: '' }],
+  ['whitespace', ' \t', { tags: [], body: '' }],
+  ['bare at', '@ hello', { tags: [], body: '@ hello' }],
+  ['punctuation is a name', '@unknown, hi', { tags: ['unknown,'], body: 'hi' }],
+];
@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { parseAddress } from '../src/address.mjs';
+import { addressCases } from './address-cases.mjs';
+
+for (const [label, input, expected] of addressCases) {
+  test(`parseAddress: ${label}`, () => assert.deepEqual(parseAddress(input), expected));
+}
+test('parseAddress rejects non-text without coercion', () => {
+  for (const input of [null, undefined, {}, 1]) assert.throws(() => parseAddress(input), TypeError);
+});
+
+// mos-1567: new coverage, separate from the pre-existing broker import pin.
+test('the mounted address parser has no import dependency', () => {
+  assert.doesNotMatch(readFileSync(new URL('../src/address.mjs', import.meta.url), 'utf8'), /\bimport\b/);
+});
@@ -14,6 +14,8 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
  assert.deepEqual([...source.matchAll(/^import .*;$/gm)].map(m => m[0]), [
    // Row 210 (#1707): createHash gives host.run events the argv, stdin and output sha256 values.
    "import { randomUUID, randomBytes, createHash } from 'node:crypto';",
+    // Row 265 (#1770): pure room address parsing, mounted in RUNNER_FILES beside the broker.
+    "import { parseAddress } from './address.mjs';",
    // Row 65 (#1558): bindLaunch checks a run's transcript path is absolute.
    "import { isAbsolute, dirname } from 'node:path';",
    // Row 191 / sage-1367: the one additional read-only CODE source, with no project/git imports.
@@ -0,0 +1,247 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { randomUUID } from 'node:crypto';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Store } from '../src/store.mjs';
+import { Broker, THREAD_PAGE, THREAD_PAGE_MAX, TESTER_VERBS } from '../src/broker.mjs';
+
+const MEMBERS = ['bean', 'chet', 'continuity'];
+const shipped = (name) => JSON.parse(readFileSync(new URL(`../../../roles/${name}.json`, import.meta.url), 'utf8'));
+function setup(t, { deny = false, empty = false } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-rooms-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const role = (definition) => ({ definition, authority: { withinRole: ['message.send'], crossRole: [] } });
+  // Deliberately unsorted, with two instances of one definition and a non-member chief.
+  const roles = { continuity: role('continuity'), chet: role('companion'), bean: role('companion'), chief: role('chief-of-staff') };
+  const definitions = {
+    'chief-of-staff': {}, companion: { messaging: shipped('companion').messaging },
+    continuity: { messaging: deny ? { sendTo: ['human'], receiveFrom: [] } : shipped('continuity').messaging },
+  };
+  const b = new Broker({ store, businesses: { demo: {
+    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: empty ? { chief: roles.chief } : roles, definitions,
+    projects: { stack: { root: '/nonexistent' } }, vars: { 'bus.tester': true },
+  } } });
+  const caps = {
+    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
+    tester: b.bindTester({ business: 'demo' }),
+  };
+  const call = (verb, args = {}, who = 'human') => b.request(caps[who], { verb, args });
+  caps.chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  call('role.claim', {}, 'chief');
+  const project = call('project.create', { name: 'room', repo: 'stack' }).id;
+  const open = () => call('room.open', { project });
+  const send = (body, extra = {}) => call('room.send', { project, body, ...extra });
+  const read = (extra = {}) => call('room.read', { project, ...extra });
+  const effects = () => ['messages', 'message_threads', 'deliveries'].map((table) => store.get(`SELECT count(*) n FROM ${table}`).n)
+    .concat(store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n);
+  const refuse = (code, fn) => {
+    const before = effects();
+    assert.throws(fn, { code });
+    assert.deepEqual(effects(), before, `${code}: no message, route, delivery or human.input`);
+  };
+  return { b, caps, store, call, project, open, send, read, effects, refuse };
+}
+
+test('room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads', (t) => {
+  const { open, call, project, store } = setup(t);
+  const existing = call('thread.create', { project, name: 'chet', instance: 'chet' }).id;
+  const result = open();
+  assert.equal(result.project, project);
+  assert.deepEqual(result.threads.map(({ instance, name }) => [instance, name]), MEMBERS.map((x) => [x, x]));
+  assert.equal(result.threads[1].id, existing);
+  for (const thread of result.threads) {
+    assert.equal(store.get('SELECT owner FROM threads WHERE id=?', thread.id).owner, 'jason');
+    assert.equal(call('session.list', { thread: thread.id }).filter((s) => s.default).length, 1);
+  }
+  assert.deepEqual(open(), result);
+  assert.equal(store.get('SELECT count(*) n FROM threads').n, 3);
+});
+
+for (const collision of ['instance', 'owner']) {
+  test(`room.open preflights ${collision} collisions atomically`, (t) => {
+    const { call, project, open, store } = setup(t);
+    call('thread.create', { project, name: 'continuity', instance: collision === 'instance' ? 'bean' : 'continuity' },
+      collision === 'owner' ? 'tester' : 'human');
+    assert.throws(open, { code: 'room-thread-name-taken' });
+    assert.deepEqual(store.all('SELECT name FROM threads').map((r) => r.name), ['continuity']);
+    assert.equal(store.get('SELECT count(*) n FROM sessions').n, 1);
+  });
+}
+
+test('room verbs require the human, and none is a tester verb', (t) => {
+  const { call, project, open, refuse } = setup(t);
+  open();
+  for (const verb of ['room.open', 'room.send', 'room.read']) {
+    const args = { project, ...(verb === 'room.send' ? { body: 'hello' } : {}) };
+    assert.ok(!TESTER_VERBS.includes(verb));
+    refuse('tester-refused', () => call(verb, args, 'tester'));
+    refuse('human-required', () => call(verb, args, 'chief'));
+  }
+});
+
+test('room verbs refuse missing projects and zero member businesses', (t) => {
+  const { call, refuse } = setup(t);
+  for (const verb of ['room.open', 'room.send', 'room.read']) {
+    refuse('project-not-found', () => call(verb, { project: randomUUID(), ...(verb === 'room.send' ? { body: 'hello' } : {}) }));
+  }
+  const empty = setup(t, { empty: true });
+  assert.throws(empty.open, { code: 'thread-instance-missing' });
+});
+
+for (const state of ['missing', 'foreign-owner', 'wrong-instance']) {
+  test(`send/read refuse a ${state} canonical member without effects`, (t) => {
+    const { call, project, send, read, refuse } = setup(t);
+    for (const instance of MEMBERS) {
+      if (instance === 'continuity' && state === 'missing') continue;
+      call('thread.create', { project, name: instance, instance: instance === 'continuity' && state === 'wrong-instance' ? 'bean' : instance },
+        instance === 'continuity' && state === 'foreign-owner' ? 'tester' : 'human');
+    }
+    refuse('room-not-open', () => send('hello'));
+    refuse('room-not-open', read);
+  });
+}
+
+test('room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows', (t) => {
+  const { open, send, store, read } = setup(t);
+  const threads = open().threads;
+  const one = send('@continuity x');
+  assert.deepEqual(one.to, ['continuity']);
+  assert.equal(one.ids.length, 1);
+  assert.equal(store.get('SELECT thread FROM message_threads WHERE message=?', one.ids[0]).thread, threads[2].id);
+  const body = ' \t@bean @chet hello @continuity';
+  const two = send(body);
+  assert.deepEqual(two.to, ['bean', 'chet']);
+  const all = send('hello @bean');
+  assert.deepEqual(all.to, MEMBERS);
+  const rows = store.all('SELECT * FROM messages ORDER BY seq');
+  assert.deepEqual(rows.map((r) => r.body), ['@continuity x', body, body, ...MEMBERS.map(() => 'hello @bean')]);
+  assert.equal(new Set(rows.slice(-3).map((r) => r.at)).size, 1);
+  assert.ok(rows.every((r) => r.from_role === 'human' && r.from_run === 'human-cli' && r.class === 'INFO'));
+  assert.equal(store.get('SELECT count(*) n FROM message_threads').n, 6);
+  assert.equal(store.get("SELECT count(*) n FROM deliveries WHERE op='routed'").n, 6);
+  assert.equal(store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n, 6);
+  assert.deepEqual(read().map((r) => r.to), [['continuity'], ['bean', 'chet'], MEMBERS]);
+});
+
+test('current display names and repeated tags resolve once; a replaced display name is unknown', (t) => {
+  const { open, call, send, refuse } = setup(t);
+  open();
+  call('name.set', { instance: 'bean', name: 'beanie' });
+  assert.deepEqual(send('@beanie @bean @beanie hi').to, ['bean']);
+  call('name.set', { instance: 'bean', name: 'newbeanie' });
+  refuse('unknown-addressee', () => send('@beanie hi'));
+  assert.deepEqual(send('@newbeanie hi').to, ['bean']);
+});
+
+test('a legacy name colliding with another member key is ambiguous; its own key resolves once', (t) => {
+  const { open, send, store, refuse } = setup(t);
+  open();
+  // Naming policy now forbids key collisions; legacy data can still contain them. Append real rows.
+  store.run('INSERT INTO instance_names(at,business,instance,name,by) VALUES(?,?,?,?,?)', new Date().toISOString(), 'demo', 'bean', 'chet', 'fixture');
+  refuse('addressee-ambiguous', () => send('@chet hi'));
+  store.run('INSERT INTO instance_names(at,business,instance,name,by) VALUES(?,?,?,?,?)', new Date().toISOString(), 'demo', 'bean', 'bean', 'fixture');
+  assert.deepEqual(send('@bean @bean hi').to, ['bean']);
+});
+
+test('unknown or non-member addressees and tags-only bodies leave no message effects', (t) => {
+  const { open, send, refuse } = setup(t);
+  open();
+  for (const body of ['@nobody x', '@chief x', '@bean @nobody x']) refuse('unknown-addressee', () => send(body));
+  for (const body of ['@continuity', ' \t@bean\n@chet ', '', ' \t']) refuse('invalid-request', () => send(body));
+});
+
+test('messaging denial on the last target rolls back the entire broadcast; allowed subset still works', (t) => {
+  const { open, send, refuse } = setup(t, { deny: true });
+  open();
+  refuse('message-sender-refused', () => send('all'));
+  assert.deepEqual(send('@bean @chet okay').to, ['bean', 'chet']);
+});
+
+test('a clearing last member fences the whole send; another active target still accepts', (t) => {
+  const { b, caps, open, call, send, refuse } = setup(t);
+  const thread = open().threads[2].id;
+  caps.worker = b.bindLaunch({ business: 'demo', role: 'continuity', run: 'continuity-run', harness: 'pi', thread });
+  call('role.claim', {}, 'worker');
+  const session = call('session.list', { thread })[0].id;
+  call('session.clear', { thread, session, revision: 0, op: 'room-clear', confirm: true });
+  refuse('session-clearing', () => send('all'));
+  assert.deepEqual(send('@bean okay').to, ['bean']);
+});
+
+test('room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors', (t) => {
+  const { open, send, read, call, project, refuse } = setup(t);
+  const threads = open().threads;
+  const first = send('first');
+  const second = send('@continuity second');
+  const page = read({ limit: 1 });
+  assert.equal(page.length, 1);
+  assert.deepEqual(page[0].ids, first.ids);
+  assert.deepEqual(page[0].to, MEMBERS);
+  assert.equal(page[0].thread, threads[0].id);
+  assert.equal(page[0].instance, 'bean');
+  assert.deepEqual(read({ after: first.ids.at(-1), limit: 1 }).map((r) => r.ids), [second.ids]);
+  assert.deepEqual(read({ after: second.ids[0] }), []);
+  const other = call('project.create', { name: 'other', repo: 'stack' }).id;
+  const thread = call('thread.create', { project: other, name: 'bean', instance: 'bean' }).id;
+  const foreign = call('thread.send', { thread, body: 'elsewhere' }).id;
+  const noncanonical = call('thread.create', { project, name: 'side', instance: 'bean' }).id;
+  const side = call('thread.send', { thread: noncanonical, body: 'side' }).id;
+  for (const after of [foreign, side, randomUUID()]) refuse('message-not-found', () => read({ after }));
+  for (const limit of [0, -1, 1.1, THREAD_PAGE_MAX + 1, '1']) refuse('invalid-request', () => read({ limit }));
+});
+
+test('room.read keeps identical sends at the same timestamp separate and includes every session', (t) => {
+  const { open, call, project, store, read } = setup(t);
+  const threads = open().threads;
+  const at = '2026-10-24T00:00:00.000Z';
+  const batches = [[], []];
+  // Broker clocks are monotonic. Append two independently valid transaction-shaped batches to
+  // exercise the historical same-at boundary without altering production clocks or existing rows.
+  for (const batch of batches) for (const thread of threads) {
+    const id = randomUUID();
+    batch.push(id);
+    const session = call('session.list', { thread: thread.id })[0].id;
+    store.run('INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES(?,?,?,?,?,?,?,?)',
+      id, at, 'demo', 'human', 'human-cli', thread.instance, 'INFO', 'same');
+    store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', id, thread.id, session);
+  }
+  assert.deepEqual(read().map((r) => r.ids), batches);
+  assert.deepEqual(read({ limit: 1 })[0].ids, batches[0]);
+  assert.deepEqual(read({ after: batches[0].at(-1) }).map((r) => r.ids), [batches[1]]);
+  const created = call('session.create', { thread: threads[0].id, name: 'later', op: 'new-later' });
+  call('thread.send', { thread: threads[0].id, session: created.id, body: 'later session' });
+  assert.equal(read().at(-1).body, 'later session');
+  assert.equal(read().at(-1).session, created.id);
+  assert.equal(read().at(-1).thread, threads[0].id);
+  assert.equal(store.get('SELECT count(*) n FROM threads WHERE project=?', project).n, 3);
+});
+
+test('room.read defaults and caps the number of merged entries, not recipient rows', (t) => {
+  const { open, send, read } = setup(t);
+  open();
+  for (let i = 0; i <= THREAD_PAGE_MAX; i++) send(`message ${i}`);
+  assert.equal(read().length, THREAD_PAGE);
+  assert.equal(read({ limit: THREAD_PAGE_MAX }).length, THREAD_PAGE_MAX);
+  assert.ok(read({ limit: 1 })[0].to.length === 3);
+});
+
+test('room.read includes an agent reply with its thread and instance without merging it with human rows', (t) => {
+  const { b, caps, open, call, send, read, refuse, project } = setup(t);
+  const thread = open().threads[0].id;
+  send('question');
+  caps.worker = b.bindLaunch({ business: 'demo', role: 'bean', run: 'bean-run', harness: 'pi', thread });
+  call('role.claim', {}, 'worker');
+  const reply = call('message.send', { to: 'human', body: 'answer' }, 'worker');
+  const entries = read();
+  assert.equal(entries.length, 2);
+  assert.deepEqual(entries[0].to, MEMBERS);
+  assert.equal(entries[1].id, reply.id);
+  assert.equal(entries[1].from_role, 'bean');
+  assert.equal(entries[1].thread, thread);
+  assert.equal(entries[1].instance, 'bean');
+  refuse('human-required', () => call('room.read', { project }, 'worker'));
+});
@@ -57,6 +57,7 @@ export const RUNNER_FILES = Object.freeze([
  "packages/harness/src/pi-extension.mjs",
  "packages/bus/src/client.mjs",
  "packages/bus/src/broker.mjs",
+  "packages/bus/src/address.mjs",
  "packages/bus/src/landing.mjs",
  "packages/business/src/vocabulary.mjs",
  "packages/plugins/src/kinds.mjs",
@@ -0,0 +1,127 @@
+#!/bin/bash
+# Check an explicit committed push range. Fetch is opt-in; never pushes.
+command -v node >/dev/null 2>&1 || { echo 'STOP node unavailable'; exit 2; }
+exec node --input-type=module - "$@" <<'JS'
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const stop = (reason, code = 1) => { console.log(`STOP ${reason}`); process.exit(code); };
+let gitRoot = process.cwd();
+const git = (...args) => {
+  const r = spawnSync('git', args, { cwd: gitRoot, maxBuffer: 256 * 1024 * 1024 });
+  if (r.error || r.status !== 0) throw new Error('git');
+  return r.stdout;
+};
+// Git paths must round-trip as UTF-8 before comparing them with queue paths.
+const pathsText = bytes => new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+const shownPath = path => /[\r\n]/.test(path) ? JSON.stringify(path) : path;
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+const text = (...args) => git(...args).toString('utf8').trimEnd();
+const resolve = ref => text('rev-parse', '--verify', '--end-of-options', `${ref}^{commit}`);
+const argv = process.argv.slice(2);
+if (argv.length < 2) stop('usage: push-check.sh SHA EXPECTED_LOG [--row N]... [--base-ref REF] [--fetch]', 2);
+const [ref, expectedFile] = argv.splice(0, 2);
+let baseRef = 'refs/remotes/origin/refactor', fetch = false;
+const rowIds = new Set();
+while (argv.length) {
+  const flag = argv.shift();
+  if (flag === '--fetch' && !fetch) fetch = true;
+  else if (flag === '--row' && /^[1-9][0-9]*$/.test(argv[0] ?? '') && Number.isSafeInteger(Number(argv[0]))) rowIds.add(Number(argv.shift()));
+  else if (flag === '--base-ref' && argv[0] && !argv[0].startsWith('-')) baseRef = argv.shift();
+  else stop('usage', 2);
+}
+let sha, base, expected;
+try {
+  // Resolve the log against the original caller, then anchor every Git command
+  // at the repository root. Queue reads retain their production cwd checks.
+  expected = readFileSync(expectedFile);
+  gitRoot = text('rev-parse', '--show-toplevel');
+  sha = resolve(ref);
+}
+catch { stop('sha or expected log unavailable', 2); }
+if (fetch) { try { git('fetch', '-q', 'origin'); } catch { stop('fetch', 2); } }
+try { base = resolve(baseRef); } catch { stop('base ref unavailable', 2); }
+try {
+  if (!git('log', '--oneline', `${base}..${sha}`).equals(expected)) stop('log');
+  console.log('LOG_OK');
+  try { git('merge-base', '--is-ancestor', base, sha); } catch { stop('ff'); }
+  console.log('FF_OK');
+
+  // --no-renames keeps -z numstat to exactly one path per record. Never parse
+  // quoted path output or consult working-tree bytes.
+  const changedPaths = pathsText(git('diff', '--no-relative', '--no-color', '--no-ext-diff', '--no-textconv', '--no-renames', '--numstat', '-z', base, sha))
+    .split('\0').filter(Boolean).map(record => {
+      const first = record.indexOf('\t'), second = record.indexOf('\t', first + 1);
+      return { path: record.slice(second + 1), binary: record.startsWith('-\t-\t') };
+    });
+  const tree = commit => {
+    const entries = new Map();
+    for (const entry of pathsText(git('ls-tree', '--full-tree', '-r', '-z', commit)).split('\0').filter(Boolean)) {
+      const tab = entry.indexOf('\t');
+      const [mode, type, oid] = entry.slice(0, tab).split(' ');
+      entries.set(entry.slice(tab + 1), { mode, type, oid });
+    }
+    return entries;
+  };
+  const have = tree(sha);
+  // Attributes can force a binary to appear as text in numstat. Inspect raw
+  // committed bytes as well, following Git's first-8000-byte NUL rule.
+  const present = changedPaths.filter(({ path, binary }) => {
+    const entry = have.get(path);
+    if (!entry || entry.type !== 'blob') return false;
+    return binary || git('cat-file', 'blob', entry.oid).subarray(0, 8000).includes(0);
+  }).map(({ path }) => path);
+  let approved = [];
+  if (present.length && rowIds.size) {
+    let rows;
+    try {
+      const root = text('rev-parse', '--show-toplevel');
+      const { rows: readRows } = await import(pathToFileURL(join(root, 'packages/queue/src/store.mjs')).href);
+      const result = readRows({ cwd: process.cwd(), env: process.env });
+      if (result.code !== 0) throw new Error('queue');
+      if (result.err.some(note => /unconfirmed tail|not confirmed durable/.test(note))) stop('queue unconfirmed tail', 2);
+      rows = result.rows;
+      for (const id of rowIds) if (!rows.some(r => r.id === id)) throw new Error('row');
+    } catch { stop('queue unavailable or invalid', 2); }
+    for (const row of rows.filter(r => rowIds.has(r.id))) {
+      const round = row.review?.rounds.at(-1);
+      if (!round || round.receipts?.some(r => r.verdict === 'changes')) continue;
+      if (!round.receipts?.some(r => r.verdict === 'approve' && r.candidate === round.candidate.digest)) continue;
+      approved.push(round.candidate);
+    }
+  }
+  const candidates = new Map();
+  for (const c of approved) {
+    if (c.kind !== 'commit') continue;
+    const candidateTree = tree(c.digest);
+    let parent;
+    try { parent = text('rev-parse', '--verify', `${c.digest}^1`); }
+    catch { parent = text('hash-object', '-t', 'tree', '/dev/null'); }
+    const changed = new Set(pathsText(git('diff-tree', '--no-relative', '-r', '--no-renames', '--name-only', '-z', parent, c.digest)).split('\0').filter(Boolean));
+    candidates.set(c.digest, { candidateTree, changed });
+  }
+  for (const path of present) {
+    const h = have.get(path);
+    const digest = hash(git('cat-file', 'blob', h.oid));
+    const matches = approved.some(c => {
+      if (c.kind === 'manifest') return c.text.split('\n').includes(`${digest}  ${path}`);
+      const { candidateTree, changed } = candidates.get(c.digest);
+      const entry = candidateTree.get(path);
+      return changed.has(path) && entry?.type === 'blob' && entry.mode === h.mode && hash(git('cat-file', 'blob', entry.oid)) === digest;
+    });
+    if (!matches) stop(`binary ${shownPath(path)} ${digest} not in a reviewed candidate`);
+  }
+  console.log(present.length ? `BINARY_REVIEWED ${present.length}` : 'NO_BINARY');
+
+  const diff = git('diff', '--no-relative', '--no-color', '--no-ext-diff', '--no-textconv', base, sha).toString('utf8');
+  const secret = /BEGIN [A-Z ]*PRIVATE KEY|ghp_[A-Za-z0-9]{20}|sk-ant-[A-Za-z0-9-]{10}|xox[bp]-|AKIA[0-9A-Z]{16}|(token|secret|password)["' ]*[:=] *["'][A-Za-z0-9_\-]{24,}/i;
+  if (diff.split('\n').some(line => line.startsWith('+') && secret.test(line))) stop('secrets');
+  console.log('SECRETS_CLEAN');
+  if (/co-authored-by|generated with/i.test(text('log', '--format=%B', `${base}..${sha}`))) stop('attribution');
+  console.log('NO_ATTRIBUTION');
+  console.log(`PUSH_READY ${base}..${sha}`);
+} catch { stop('git or environment error', 2); }
+JS
@@ -0,0 +1,256 @@
+#!/bin/bash
+# All repositories, queue writes, remotes and mutants are disposable scratch.
+set -euo pipefail
+ROOT=$(cd -- "$(dirname -- "$0")/.." && pwd)
+exec node --input-type=module - "$ROOT" "$@" <<'JS'
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createHash } from 'node:crypto';
+const root = process.argv[2];
+const { scratchRepo, genesisCommitted, cli } = await import(pathToFileURL(join(root, 'packages/queue/tests/helpers.mjs')));
+const target = process.argv[3] ?? join(root, 'scripts/push-check.sh');
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+const binary = Buffer.from([0, 1, 2, 3]);
+const digest = sha256(binary);
+const cleanups = [];
+let count = 0;
+function fixture() {
+  const repo = scratchRepo({ after: fn => cleanups.push(fn) });
+  genesisCommitted(repo);
+  const run = (args, by = 'darkwing', allow = false) => {
+    const r = cli(repo, args, { by });
+    assert.ok(r.code === 0 || allow, r.err);
+    return r;
+  };
+  run(['move', '6', 'blocked', '--reason', 'paused', '--op', 'block-six-0001']);
+  run(['move', '9', 'in-progress', '--op', 'start-nine-0001']);
+  run(['set', '9', 'reviewers', 'dewey,filbert', '--op', 'set-reviewers-0001'], 'sage');
+  // A real local bare remote and clone, with no network or origin access.
+  const bare = join(repo.base, 'remote.git');
+  repo.g('init', '--bare', '-q', bare);
+  repo.g('clone', '-q', bare, join(repo.base, 'clone'));
+  repo.g('remote', 'add', 'origin', bare);
+  const base = repo.g('rev-parse', 'HEAD').trim();
+  repo.g('update-ref', 'refs/remotes/origin/refactor', base);
+  const commit = (path, bytes, message = 'content') => {
+    if (bytes === null) repo.g('rm', '--', path);
+    else { writeFileSync(join(repo.root, path), bytes); repo.g('add', '--', path); }
+    repo.g('commit', '-q', '-m', message);
+    return repo.g('rev-parse', 'HEAD').trim();
+  };
+  const check = (sha, extra = [], expectedCode = 0, reason = null, script = target, cwd = repo.root) => {
+    const log = join(repo.base, 'expected.log');
+    writeFileSync(log, repo.g('log', '--oneline', `${base}..${sha}`));
+    const r = spawnSync('bash', [script, sha, log, ...extra], { cwd, env: repo.env, encoding: 'utf8' });
+    assert.equal(r.status, expectedCode, `${r.stdout}\n${r.stderr}`);
+    const lines = r.stdout.trim().split('\n');
+    if (expectedCode === 0) assert.match(lines.at(-1), /^PUSH_READY /);
+    else {
+      assert.equal(lines.filter(s => s.startsWith('STOP ')).length, 1, r.stdout);
+      assert.match(lines.at(-1), reason ?? /^STOP /);
+      assert.ok(!r.stdout.includes('PUSH_READY'), r.stdout);
+    }
+    count++;
+    return r.stdout;
+  };
+  let n = 0;
+  const round = (candidate, verdict = 'approve') => {
+    n++;
+    const r = run(['move', '9', 'in-review', '--candidate', candidate, '--op', `review-nine-000${n}`], 'darkwing', true);
+    // Missing dummy transport credentials fails the request, after opening a
+    // valid round. Recording a receipt is cooperative and needs no credential.
+    assert.equal(r.code, 1, r.out + r.err);
+    const row = JSON.parse(run(['show', '9']).out);
+    const c = row.review.rounds.at(-1).candidate.digest;
+    run(['review', 'record', '9', '--verdict', verdict, '--candidate', c, '--comment', String(n), '--op', `verdict-nine-00${n}`], 'filbert');
+  };
+  const manifest = (d = digest, path = 'asset.bin') => {
+    const file = join(repo.base, 'manifest.sha256');
+    writeFileSync(file, `${d}  ${path}\n`);
+    return file;
+  };
+  return { repo, run, base, commit, check, round, manifest };
+}
+try {
+  {
+    const f = fixture();
+    const sha = f.commit('text.txt', 'hello\n');
+    assert.match(f.check(sha), /NO_BINARY\nSECRETS_CLEAN\nNO_ATTRIBUTION\nPUSH_READY /);
+    f.check(sha, ['--base-ref', f.base]);
+    f.check(sha, ['--bad-option'], 2, /^STOP usage/);
+    // Explicit fetch goes only to the scratch remote.
+    f.check(sha, ['--fetch']);
+    const wrong = join(f.repo.base, 'wrong.log'); writeFileSync(wrong, 'wrong\n');
+    const r = spawnSync('bash', [target, sha, wrong], { cwd: f.repo.root, env: f.repo.env, encoding: 'utf8' });
+    assert.equal(r.status, 1); assert.equal(r.stdout, 'STOP log\n'); count++;
+    f.repo.g('update-ref', 'refs/remotes/origin/refactor', sha);
+    const log = join(f.repo.base, 'empty.log'); writeFileSync(log, '');
+    const ff = spawnSync('bash', [target, f.base, log], { cwd: f.repo.root, env: f.repo.env, encoding: 'utf8' });
+    assert.equal(ff.status, 1); assert.equal(ff.stdout, 'LOG_OK\nSTOP ff\n'); count++;
+  }
+  // B1: attributes may add binary classifications, never hide NUL blobs.
+  for (const source of ['tree', 'info', 'config']) {
+    const f = fixture();
+    if (source === 'tree') f.commit('.gitattributes', '*.bin diff\n');
+    if (source === 'info') writeFileSync(join(f.repo.gitDir, 'info/attributes'), '*.bin diff\n');
+    if (source === 'config') {
+      const attributes = join(f.repo.base, 'attributes'); writeFileSync(attributes, '*.bin diff\n');
+      f.repo.g('config', 'core.attributesFile', attributes);
+    }
+    const sha = f.commit('asset.bin', binary);
+    f.check(sha, [], 1, /^STOP binary asset.bin /);
+    f.round(f.manifest());
+    assert.match(f.check(sha, ['--row', '9']), /BINARY_REVIEWED 1\n/);
+  }
+  // The content rule includes byte 7999, and excludes byte 8000.
+  for (const offset of [7999, 8000]) {
+    const f = fixture(), bytes = Buffer.alloc(8001, 65); bytes[offset] = 0;
+    f.commit('.gitattributes', '*.bin diff\n');
+    const sha = f.commit('asset.bin', bytes);
+    if (offset === 7999) f.check(sha, [], 1, /^STOP binary asset.bin /);
+    else assert.match(f.check(sha), /NO_BINARY\n/);
+  }
+  // N4: an approval beyond the durable witness is visible, not authority.
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    const witness = join(f.repo.gitDir, 'mosaic-queue.head');
+    const durable = readFileSync(witness);
+    f.round(f.manifest());
+    writeFileSync(witness, durable);
+    const visible = f.run(['show', '9']);
+    assert.match(visible.err, /not confirmed durable/);
+    f.check(sha, ['--row', '9'], 2, /^STOP queue unconfirmed tail$/);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.check(sha, [], 1, /^STOP binary asset.bin /);
+    f.round(f.manifest('0'.repeat(64)));
+    f.check(sha, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.round(f.manifest());
+    writeFileSync(join(f.repo.root, 'asset.bin'), 'working tree differs');
+    assert.match(f.check(sha, ['--row', '9']), /BINARY_REVIEWED 1\n/);
+    f.check(sha, [], 1, /^STOP binary asset.bin /);
+    const other = f.commit('asset.bin', Buffer.from([0, 8, 9]));
+    // The working tree is the approved version; the pushed blob isn't.
+    writeFileSync(join(f.repo.root, 'asset.bin'), binary);
+    f.check(other, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.round(sha);
+    assert.match(f.check(sha, ['--row', '9']), /BINARY_REVIEWED 1\n/);
+    const other = f.commit('asset.bin', Buffer.from([0, 7]));
+    f.check(other, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('space tab\tasset.bin', binary);
+    f.round(sha);
+    assert.match(f.check(sha, ['--row', '9']), /BINARY_REVIEWED 1\n/);
+  }
+  {
+    const f = fixture(), sha = f.commit('line\nbreak.bin', binary);
+    f.check(sha, [], 1, /^STOP binary "line\\nbreak.bin" /);
+    writeFileSync(Buffer.concat([Buffer.from(f.repo.root + '/'), Buffer.from([255]), Buffer.from('.bin')]), binary);
+    f.repo.g('add', '-A'); f.repo.g('commit', '-q', '-m', 'invalid UTF-8 path');
+    f.check(f.repo.g('rev-parse', 'HEAD').trim(), [], 2, /^STOP git or environment error$/);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    const cwd = join(f.repo.root, 'nested'); mkdirSync(cwd);
+    f.repo.g('config', 'diff.relative', 'true');
+    f.check(sha, [], 1, /^STOP binary asset.bin /, target, cwd);
+    f.round(f.manifest());
+    assert.match(f.check(sha, ['--row', '9'], 0, null, target, cwd), /BINARY_REVIEWED 1\n/);
+    const relativeLog = spawnSync('bash', [target, sha, '../../expected.log', '--row', '9'], { cwd, env: f.repo.env, encoding: 'utf8' });
+    assert.equal(relativeLog.status, 0, relativeLog.stdout + relativeLog.stderr);
+    assert.match(relativeLog.stdout.trim().split('\n').at(-1), /^PUSH_READY /); count++;
+  }
+  {
+    const f = fixture(), cwd = join(f.repo.root, 'nested'); mkdirSync(cwd);
+    const sha = f.commit('nested/asset.bin', binary);
+    f.repo.g('config', 'diff.relative', 'true');
+    f.check(sha, [], 1, /^STOP binary nested\/asset.bin /, target, cwd);
+    f.round(sha);
+    assert.match(f.check(sha, ['--row', '9'], 0, null, target, cwd), /BINARY_REVIEWED 1\n/);
+  }
+  {
+    const f = fixture();
+    f.commit('asset.bin', binary);
+    const unrelated = f.commit('text.txt', 'unrelated\n');
+    f.round(unrelated);
+    f.check(unrelated, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.round(f.manifest(), 'changes');
+    const row = JSON.parse(f.run(['show', '9']).out);
+    f.run(['review', 'record', '9', '--verdict', 'approve', '--candidate', row.review.rounds.at(-1).candidate.digest, '--comment', '2', '--op', 'approve-dewey-0001'], 'dewey');
+    f.check(sha, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.round(f.manifest());
+    f.run(['move', '9', 'in-progress', '--op', 'revise-nine-0001']);
+    f.round(f.manifest('0'.repeat(64)));
+    f.check(sha, ['--row', '9'], 1, /^STOP binary asset.bin /);
+  }
+  {
+    const f = fixture(), sha = f.commit('asset.bin', binary);
+    f.round(f.manifest());
+    // This shape cannot be recorded by the queue. Its read API must reject
+    // tampered receipts before the guard can treat them as authority.
+    const path = f.repo.queuePath;
+    const doc = JSON.parse(readFileSync(path));
+    doc.rows.find(r => r.id === 9).review.rounds.at(-1).receipts[0].candidate = '0'.repeat(64);
+    writeFileSync(path, JSON.stringify(doc));
+    f.check(sha, ['--row', '9'], 2, /^STOP queue unavailable or invalid$/);
+  }
+  {
+    const f = fixture(), added = f.commit('asset.bin', binary);
+    f.repo.g('update-ref', 'refs/remotes/origin/refactor', added);
+    const deleted = f.commit('asset.bin', null);
+    // Explicit base retains the check helper's original expected log range.
+    f.repo.g('update-ref', 'refs/remotes/origin/refactor', f.base);
+    assert.match(f.check(deleted, ['--base-ref', added], 1, /^STOP log$/), /STOP log/);
+    const log = join(f.repo.base, 'delete.log'); writeFileSync(log, f.repo.g('log', '--oneline', `${added}..${deleted}`));
+    const r = spawnSync('bash', [target, deleted, log, '--base-ref', added], { cwd: f.repo.root, env: f.repo.env, encoding: 'utf8' });
+    assert.equal(r.status, 0, r.stdout); assert.match(r.stdout, /NO_BINARY\n/); assert.match(r.stdout.trim().split('\n').at(-1), /^PUSH_READY /); count++;
+  }
+  for (const [message, content, reason, prefix] of [
+    ['content', 'password="' + 'a'.repeat(30) + '"\n', 'secrets', 'LOG_OK\nFF_OK\nNO_BINARY\n'],
+    ['Generated with example', 'hello\n', 'attribution', 'LOG_OK\nFF_OK\nNO_BINARY\nSECRETS_CLEAN\n'],
+  ]) {
+    const f = fixture(), sha = f.commit('text.txt', content, message);
+    assert.equal(f.check(sha, [], 1), `${prefix}STOP ${reason}\n`);
+  }
+  console.log(`PASS push-check ${count} checks`);
+  if (!process.argv[3]) {
+    const dir = mkdtempSync(join(tmpdir(), 'push-check-mutants-'));
+    cleanups.push(() => rmSync(dir, { recursive: true, force: true }));
+    const source = readFileSync(target, 'utf8');
+    const mutants = [
+      ['skip-hash', "c.text.split('\\n').includes(`${digest}  ${path}`)", "c.text.split('\\n').some(line => line.endsWith(`  ${path}`))"],
+      ['accept-changes', "round.receipts?.some(r => r.verdict === 'changes')", 'false'],
+      ['earlier-round', 'row.review?.rounds.at(-1)', 'row.review?.rounds.at(0)'],
+      ['working-tree', "hash(git('cat-file', 'blob', h.oid))", 'hash(readFileSync(path))'],
+      ['no-row', 'if (!matches) stop(', 'if (!matches && rowIds.size) stop('],
+      ['skip-nul-scan', " || git('cat-file', 'blob', entry.oid).subarray(0, 8000).includes(0)", ''],
+    ];
+    for (const [name, before, after] of mutants) {
+      assert.ok(source.includes(before), name);
+      const file = join(dir, `${name}.sh`); writeFileSync(file, source.replace(before, after));
+      const r = spawnSync('timeout', ['-k', '10', '120', 'bash', join(root, 'scripts/test-push-check.sh'), file], { encoding: 'utf8', maxBuffer: 4 << 20 });
+      assert.equal(r.status, 1, `${name} survived or infrastructure failed: ${r.status}\n${r.stdout}\n${r.stderr}`);
+      assert.match(r.stderr, /AssertionError/, r.stderr);
+      console.log(`KILLED ${name}`);
+    }
+  }
+} finally { for (const fn of cleanups.reverse()) fn(); }
+JS
Author	SHA1	Message	Date
jason.woltje	d858c9f8b7	Detect binaries despite git attributes and reject unconfirmed reviews (#1825 )	2026-10-24 01:40:16 -05:00
jason.woltje	704910ca3b	Fix push-check binary checks from repository subdirectories (#1825 )	2026-10-24 01:12:15 -05:00
jason.woltje	cceea407e2	Add reviewed-binary push check and scratch regression suite (#1825 )	2026-10-24 01:02:29 -05:00
jason.woltje	b617b80f68	agents: register Codex seat Bradford for the push check row (#1825 , mos-1572); doc only	2026-10-24 00:52:34 -05:00
jason.woltje	93200bb446	docs: brief for scripts/push-check.sh, the repo push check that passes a binary only when an approved review candidate lists its path and sha256 (mos-1572 option A); doc only	2026-10-24 00:52:13 -05:00
jason.woltje	d16958bcfd	docs: W brief D2 lets O2 rows build before 10-27 and land only on an idle slot, Opus 5.5 review once at landing (mos-1571); register Codex seats Glomgold (row 309, W1) and Gyro (row 310, W2); doc only	2026-10-24 00:26:11 -05:00
jason.woltje	48f1627be2	queue: revs 3789-3844 (sage briefs/reviewer moves 157/208/265, requests, notes and done for 208/326/265; goldie 265 and 326; poe 208; bentina 157 r1/r2; gladstone 208 approve; boyd 157 r1 changes, r2 approve, 265 approve; duckworth 208 approve; darkwing 157 r2 approve)	2026-10-24 00:19:05 -05:00
jason.woltje	17f056787f	docs: brief template, landed evidence is plain text with no gzip or binary waiver (mos-1570); doc only	2026-10-24 00:16:26 -05:00
jason.woltje	200dd396c4	feat(bus): add human project rooms with addressed sends (cherry picked from commit `ef4c938532`)	2026-10-23 23:57:31 -05:00
jason.woltje	537902d261	docs: DEFERRED closes ops-0282 B2-2 (row 326 landed) and carries row 208 N1, the 5 s user.js re-render; doc only	2026-10-23 23:56:43 -05:00
jason.woltje	f58049de02	duckworth: row 208 (193d) second review approve (static, guards) on `4a4bef6c1`, no bus change, every hidden control has a broker refusal, grant hint per-grant and self-only, N1 (duckworth-0302) (cherry picked from commit c36a0dc0d0a9f762bc74078dd53cce53df75642a)	2026-10-23 23:30:38 -05:00
jason.woltje	33f49f7d5a	docs(host): close five first-install run-sheet gaps (#1822 ) (cherry picked from commit `a1b13c60e1`)	2026-10-23 23:30:30 -05:00
				`@@ -0,0 +1 @@`
				`No changed-file mention has a literal 64-hex digest within eight lines.`
				`@@ -0,0 +1 @@`
				`No changed-product-file mention has a literal 64-hex digest within eight lines.`