row 198 r5: assertion diff for Mos's read (review file only)

2026-10-24 23:25:38 -05:00
151 changed files with 643 additions and 14123 deletions
@@ -5585,11 +5585,3 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 2026-10-24T23:37:46Z | Sage | Row 329 (#1827, P1 pinned model proxy, Magica) LANDED 61ebf2c34, pushed 23:31:27Z 10-24. Before: refactor at 669cdf42c. After: Magica's 4 commits (94cde633e, c65fb34ee, d1f6f2b19, 61ebf2c34) cherry-picked onto 669cdf42c, diff vs the gated tree limited to drift paths, range-diff in scratch. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r329l/wt (gate.sh 8b4978887 c8a9bcf94), started 23:08:12Z at load 14.35, GATE GREEN 23:29:14Z at load 8.67, no rerun, no test or timeout edit (mos-1634). Host note: two Codex workers cleaned T3 worktrees from about 23:14Z (mos-1639, Vikunja 632). Approvals: Dewey r2 c31643 rev 4047, Boyd r2 c31642 rev 4048. #1827 comment 31650, closed. Vikunja 237 comment 1109 (stays open for P2-P7); C4 P10 red filed as Vikunja 631. Queue: note rev 4063, done rev 4064, committed b24d917ec. DEFERRED: N2 and R2-N1 bound to row 331, N1 bound to P7. Overlap: row 284 (packages/bus/src/broker.mjs) and row 157 (scripts/mosaic-config.mjs) rebase onto 61ebf2c34 before their gates.
 2026-10-25T00:15:48Z | Sage | Row 284 (#1789, C2-05c library.get scope, Della) LANDED ce0b6ed41, pushed 00:09:52Z 10-25. Before: refactor at 9e2689dff (row 329 landing docs). After: fast-forward to Della's 7 rebased commits 78b932feb..ce0b6ed41; 8 paths, manifest-r4 de505cfd matches the landed tree. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r284l/wt (the 329 gate.sh with D and the compose project renamed), started 23:51:19Z at load 1.62, GATE GREEN 00:09:04Z at load 5.20, no rerun, no test or timeout edit. Counts: bus 1020/0, business 283/0, cli 999 pass 1 allowed skip (FED R7), harness 177/0, library 156/0, seat 218/0, webui 458/0, every scripts/test-*.sh rc 0; queue 34 and task 87/93 skips are the standing ones. Della's whole-file runs on ce0b6ed41: library-lookups 12/0, library-tools 5/0, query 34/0. Approval: Webby round 2 delta c31654 rev 4070 (round 1 rev 4062). Overlap sweep: rows 13, 157, 309, gyro/row310 and fethry/row332-p1 clean. #1789 comment 31655, closed. No Vikunja task for the row. Queue: note rev 4071, done rev 4072, committed 7c8dc2033. DEFERRED: Webby N1 (whole-tree listing per get) bound to the next library read-path row; N2 needs nothing; N3 is this gate.
 2026-10-25T00:18:35Z | Sage | Follow-up tasks for mos-1647 item 3 (Q109): Vikunja 633 (P7 cutover, CLIProxyAPI 8.0.42 startup Grok-npm and antigravity version refreshes, from row 332 isolated runs) and 634 (row 284 Webby N1, library get lists the whole tree). DEFERRED gains the 633 entry and the 634 number for row 284 N1. Filing script and receipt in agents/sage/work/vikunja-setup/.
-
-2026-10-24 Poe — row 330 / #1828 start: native Console proxy page and human-only bus verbs per Q250. Before: P1 client/config landed, no native page. Intended evidence: fake-management security/refusal tests, four named mutants, pinned offline upgrade acceptance, Gladstone/Filbert review. Tests remain held pending Sage CLEAR; P2 rebase required before gate. Notes: agents/poe/work/queue-330/BUILD.md.
-
-2026-10-25 Poe — row330 / #1828 focused block: first account RED6pass/4expected; source-only fixes; eight new files88/88 green, no skips. Offline PIN8.0.42 acceptance then exited1 before initial-account checkpoint and reported nice16 despite19 wrapper. Stopped at first unexpected red, returned slot to Sage, no rerun or mutants. Root cause unresolved; no full-gate or landing claim. Evidence: agents/poe/work/queue-330/BUILD.md and green-*.txt / upgrade-8.0.42.txt.
-
-2026-10-25 Poe — row330 focused retry per sage-4446: all8 files88/88 green again; uptime per step retained. After Store fixture correction, offline PIN8.0.42 acceptance reached broker-bound but refused proxy-down at initial-accounts (load5.98/15.98/16.44). Stopped, returned slot, no rerun or mutants. See agents/poe/work/queue-330/block2-* and BUILD.md. No full-gate or completion claim.
-
-2026-10-25 Poe — row330 sage-4469 block: approved fixed GET provider404 normalization after exact RED2fail/9pass; GREEN10whole files99/99, pinned8.0.42 offline acceptance passed (both priority read-backs), four named mutants killed/restored with all controls green. No retries, old assertions or timeout changes. Slot returned. Evidence agents/poe/work/queue-330/404-* and BUILD.md. P2 integration/full global gate/Q246 reviews still pending; no landing claim.
@@ -0,0 +1,628 @@
+# Row 198 r5: assertion diff
+
+Status: uncommitted working-tree review file. Nothing here has been committed or pushed, and no test has been run (CLEAR pending).
+
+- Base: `78b69e1e6` (refactor). Rebase paused on pick 1 (`4288b7b16`). Commit 1 is staged; later edits are in the working tree.
+- Groups: A = tests that existed on refactor before row 198 (Mos reads these, mos-1272). B = tests row 198 adds (Sage rules).
+- Hunks: 24 group A, 3 group B. Changed assert lines: 230 removed, 61 added (hunk sums; the file-level diff includes non-assert lines).
+- Retired test names: 36 (list below).
+
+Labels are from line-range attribution. A removed block can span several old tests, so the enclosing-test label is the first match only; the reason and the diff text are authoritative.
+
+## Group A (existed on refactor before row 198)
+
+### A1: control-board/tests/discord.test.mjs
+
+Enclosing test (first match, old or new side): server rescans connector discovery and refuses HTTP reply without transport
+
+Reason: Port: the HTTP /api/board fetch becomes board.index(); the 409 is the status board.reply returns in-process. Kept: state, connector.alive, registered null, forged task not used.
+
+```diff
+-     assert.equal(board.sessions[0].state, 'idle'); assert.equal(board.sessions[0].connector.alive, true);
+-     assert.equal(board.sessions[0].registered, null); assert.notEqual(board.sessions[0].task, 'forged');
+-     assert.equal(response.status, 409);
+     assert.equal(payload.sessions[0].state, 'idle'); assert.equal(payload.sessions[0].connector.alive, true);
+     assert.equal(payload.sessions[0].registered, null); assert.notEqual(payload.sessions[0].task, 'forged');
+     assert.equal(status, 409);
+```
+
+### A2: control-board/tests/discord.test.mjs
+
+Enclosing test (first match, old or new side): server rescans connector discovery and refuses HTTP reply without transport
+
+Reason: Port: the HTTP /api/board fetch becomes board.index(); zero-sessions assert unchanged.
+
+```diff
+-     assert.equal((await (await fetch(base + '/api/board')).json()).sessions.length, 0);
+     assert.equal((await board.index()).sessions.length, 0);
+```
+
+### A4: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): isLoopbackHost: rejects non-loopback hosts
+
+Reason: Retired writer HTTP asserts: page content-type and cache-control, healthz body, 404/405 and the 500 envelope. The writer opens no listener now. index.json and per-agent write asserts are not re-asserted here (gap).
+
+```diff
+-   assert.ok(caught instanceof ConfigError, "expected a ConfigError");
+-       assert.equal(res.status, 200, path);
+-       assert.equal(res.headers.get("content-type"), "text/html; charset=utf-8", path);
+-       assert.equal(res.headers.get("cache-control"), "no-store", path);
+-       assert.equal(await res.text(), page, path);
+-     assert.equal(health.status, 200);
+-     assert.deepEqual(await health.json(), { ok: true });
+-     assert.equal(first.status, 200);
+-     assert.equal(first.headers.get("content-type"), "application/json");
+-     assert.equal(first.headers.get("cache-control"), "no-store");
+-     assert.equal(firstBody.sessions[0].state, "idle");
+-     assert.ok(!firstBody.waitingOnYou.includes("proj/agent1"));
+-     assert.ok(existsSync(join(boardDir, "index.json")), "index.json must be written by the scan");
+-     assert.ok(existsSync(join(boardDir, "sessions", "proj", "agent1.json")), "per-agent file must be written by the scan");
+-     assert.equal(second.status, 200);
+-     assert.equal(secondBody.sessions[0].state, "working");
+-     assert.equal(missing.status, 404);
+-     assert.equal(posted.status, 405);
+-     assert.equal(res.status, 200);
+-     assert.equal(body.sessions[0].taskSource, "registration");
+-     assert.equal(body.sessions[0].task, "registered task");
+-     assert.deepEqual(body.registered, ["proj/agent1"]);
+-     assert.deepEqual(body.registrationErrors, []);
+-     assert.equal(res.status, 500);
+-     assert.equal(res.headers.get("content-type"), "application/json");
+-     assert.equal(typeof body.error, "string");
+-     assert.ok(body.error.length > 0);
+```
+
+### A5: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): CLI: serve refuses a non-loopback host with exit 2 and a refused: message
+
+Reason: Retired with serve: CLI refusal now asserted by cli.mjs:14 via board.test.mjs (group B hunk 0).
+
+```diff
+-   assert.equal(r.status, 2);
+-   assert.match(r.stderr, /^refused:/);
+```
+
+### A6: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): CLI: live serve prints its URL and answers /healthz
+
+Reason: Retired page.html source checks (esc, seen POST, healthz) and HTTP seen round-trip. page.html is deleted; markSeen order is in board.test.mjs. The esc() asserts have no in-process target (open gap).
+
+```diff
+-     assert.equal(res.status, 200);
+-     assert.deepEqual(await res.json(), { ok: true });
+-   assert.ok(m, "esc() must exist in page.html");
+-   assert.equal(esc('<script>alert("x")</script>&\''), "&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;&amp;&#39;");
+-   assert.equal(esc(null), "");
+-   assert.equal(esc(undefined), "");
+-   assert.equal(esc(42), "42");
+-   assert.deepEqual(rawJoins, [], `API values concatenated into HTML without esc(): ${rawJoins.join(" | ")}`);
+-   assert.ok(escCalls >= 15, `expected many esc() calls, saw ${escCalls}`);
+-     assert.equal(postRes.status, 200);
+-     assert.ok(postBody.seen.includes("proj/agent1"));
+-     assert.ok(!postBody.waitingOnYou.includes("proj/agent1"));
+-     assert.equal(boardRes.status, 200);
+-     assert.ok(boardBody.seen.includes("proj/agent1"));
+-     assert.ok(!boardBody.waitingOnYou.includes("proj/agent1"));
+-     assert.equal(clearRes.status, 200);
+-     assert.ok(!clearBody.seen.includes("proj/agent1"));
+-     assert.ok(clearBody.waitingOnYou.includes("proj/agent1"));
+-     assert.equal(res.status, 400);
+-     assert.ok(!existsSync(join(boardDir, "seen.json")), "seen.json must not be written on a rejected content-type");
+-     assert.equal(res.status, 400);
+-     assert.ok(!existsSync(join(boardDir, "seen.json")));
+-     if (status !== null) assert.equal(status, 400);
+-     assert.ok(!existsSync(join(boardDir, "seen.json")), "seen.json must not be written for an oversized body");
+-     assert.equal(res.status, 400);
+-     assert.ok(!existsSync(join(boardDir, "seen.json")));
+-     assert.equal(board.status, 405);
+-     assert.equal(put.status, 405);
+```
+
+### A7: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): CLI: scan --print marks a seen row with 's' and the summary line ends with 'N seen)'
+
+Reason: Retired page.html source checks only (seenControl, Seen section, Hide seen, sourceTag escapes). No verified Console equivalent in this pass (open gap).
+
+```diff
+-   assert.ok(m, "seenControl() must exist in page.html");
+-   assert.match(body, /esc\(rec\.project\)/);
+-   assert.match(body, /esc\(rec\.agent\)/);
+-   assert.match(body, /esc\(rec\.lastActivity\)/);
+-   assert.match(html, /headers:\s*\{\s*"content-type":\s*"application\/json"\s*\}/, "the seen POST must send content-type: application/json");
+-   assert.match(html, /<details id="seenDetails">(?![^>]*\sopen)/, "the Seen section must start collapsed");
+-   assert.match(html, /<h2 id="seen-h">Seen<\/h2>/);
+-   assert.ok(m, "renderSeen() must exist in page.html");
+-   assert.match(m[0], /filter\(function \(r\) \{ return r\.seen; \}\)/, "the Seen section lists exactly the rows the API marks seen");
+-   assert.match(m[0], /buildRowPair\(r, true\)/, "seen rows reuse the escaped row builder, project column included");
+-   assert.match(html, /renderWaiting\(lastData\);\n\s*renderSeen\(lastData\);/, "renderAll must render the Seen section on every refresh");
+-   assert.ok(m, "renderProjects() must exist in page.html");
+-   assert.match(body, /if \(!\(project in hideSeenState\)\) hideSeenState\[project\] = true/, "Hide seen defaults to on and the choice survives re-render");
+-   assert.match(body, /class="hide-seen-toggle" data-project="' \+ esc\(project\)/, "the checkbox carries the escaped project name");
+-   assert.match(body, /hideSeen && r\.seen/, "seen rows are filtered when the box is ticked");
+-   assert.match(body, /" seen hidden"/, "the note reports how many seen rows are hidden");
+-   assert.match(html, /closest\("\.hide-offline-toggle, \.hide-seen-toggle"\)/, "one change handler serves both checkboxes");
+-   assert.ok(m, "renderProjects() must exist in page.html");
+-   assert.match(
+-   assert.match(body, /<span>\(' \+ headCount \+ "\)<\/span>/, "the header uses headCount, not the raw group length");
+-   assert.doesNotMatch(body, /<span>\(' \+ group\.length/, "the raw group length must no longer be rendered in the header");
+-   assert.ok(m, "buildRowPair() must exist in page.html");
+-   assert.match(body, /rec\.task\s*\?[\s\S]*esc\(rec\.task\)[\s\S]*:\s*'<span class="unknown">unknown<\/span>'/, "task is escaped, or reads unknown when null");
+-   assert.match(body, /rec\.activeProject\s*\?[\s\S]*esc\(rec\.activeProject\)[\s\S]*unknown/, "active project is escaped, or reads unknown when null");
+-   assert.match(body, /<dt>Task<\/dt>/, "detail lists the task");
+-   assert.match(body, /<dt>Active project<\/dt>/, "detail lists the active project");
+-   assert.match(body, /<dt>Workspace<\/dt><dd>" \+ \(rec\.workspace \? esc\(rec\.workspace\) : "unknown"\)/, "detail lists the workspace, escaped, or unknown");
+-   assert.match(body, /var span = showProject \? 7 : 6/, "the detail row spans the two new columns");
+-   assert.equal(heads.length, 3, "all three tables carry the two new headers");
+-   assert.match(html, /<td colspan="6" class="empty">No agents\.<\/td>/, "the empty project row spans every column");
+-   assert.ok(rowPair, "buildRowPair() must exist in page.html");
+-   assert.match(rowPair[0], /sourceTag\(rec\.taskSource\)/, "the task cell shows its source");
+-   assert.match(rowPair[0], /sourceTag\(rec\.activeProjectSource\)/, "the active project cell shows its source");
+-   assert.match(
+-   assert.match(rowPair[0], /esc\(rec\.agent\) \+ "<\/button>" \+ modelTag\(rec\)/, "the agent cell shows the model under the name");
+-   assert.match(rowPair[0], /<dt>Model<\/dt><dd>" \+ modelText\(rec\) \+ "<\/dd>/, "the detail list has a Model row");
+-     assert.ok(line, `${name}() must exist in page.html`);
+-     assert.match(line, /esc\(rec\.model\)/, `${name}() escapes the model`);
+-     if (name === "modelText") assert.match(line, /esc\(rec\.provider\)/, "modelText() escapes the provider");
+-   assert.ok(sourceLabelMatch, "SOURCE_LABEL must exist in page.html");
+-   assert.equal(sourceLabel.registration, "registered", 'SOURCE_LABEL must map "registration" to "registered"');
+-   assert.ok(sourceTagLine, "sourceTag() must exist in page.html");
+-   assert.match(sourceTagLine, /esc\(source\)/, "sourceTag() escapes the raw source value (used in the title)");
+-   assert.match(sourceTagLine, /esc\(sourceLabel\(source\)\)/, "sourceTag() escapes the label text it displays");
+-   assert.ok(fromSourceLine, "fromSource() must exist in page.html");
+-   assert.match(fromSourceLine, /esc\(sourceLabel\(source\)\)/, "fromSource() escapes the label text it displays");
+-   assert.ok(registeredTextFn, "registeredText() must exist in page.html");
+-     assert.match(line, /esc\(/, `every dynamic value read off reg must be escaped: ${line.trim()}`);
+```
+
+### A8: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): every refusal code the reader can raise has an HTTP status
+
+Reason: Moved in, not weakened: REFUSAL_STATUS table and code-count asserts from the retired conversation test (hunk 15), plus the DEFAULT_AGENT_SEND path asserts (hunk 12).
+
+```diff
+   assert.equal(DEFAULT_AGENT_SEND, resolve(pkgRoot, "..", "..", "tools", "tmux", "agent-send.sh"));
+   assert.ok(existsSync(DEFAULT_AGENT_SEND));
+   assert.ok(statSync(DEFAULT_AGENT_SEND).mode & 0o111);
+   assert.ok(codes.size >= 15, [...codes].join(" "));
+   assert.deepEqual([...codes].filter((c) => !(c in REFUSAL_STATUS)), []);
+   assert.deepEqual(Object.keys(REFUSAL_STATUS).filter((c) => !codes.has(c)), [], "no stale entries");
+   assert.deepEqual(REFUSAL_STATUS, {
+```
+
+### A9: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): POST /api/reply: a registration with a tmux socket adds -L <socket>
+
+Reason: Re-indent only: the same -L socket asserts move into the board.reply closure (identical text after trim).
+
+```diff
+-     assert.equal(status, 200);
+-     assert.equal(body.socket, "mosaic-fleet");
+-     assert.equal(argv[argv.indexOf("-L") + 1], "mosaic-fleet");
+   assert.equal(status, 200);
+   assert.equal(body.socket, "mosaic-fleet");
+   assert.equal(argv[argv.indexOf("-L") + 1], "mosaic-fleet");
+```
+
+### A10: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): POST /api/reply: refusals before the tool runs: empty or blank or long text 400, unknown row 404, no registration 409, stale registration 409, no tmux session 409, bad JSON 400; the tool is never called
+
+Reason: Re-indent only: the refusal asserts move into the ported reply test; the tool-not-run check is unchanged.
+
+```diff
+-       assert.equal(status, c.status, `${JSON.stringify(c.body).slice(0, 60)}: ${JSON.stringify(body)}`);
+-       assert.match(body.error, c.error);
+-       assert.equal(existsSync(f.capture), false, "the tool must not run on a refusal");
+     assert.equal(status, c.status, `${JSON.stringify(c.body).slice(0, 60)}: ${JSON.stringify(body)}`);
+     assert.match(body.error, c.error);
+     assert.equal(existsSync(f.capture), false, "the tool must not run on a refusal");
+```
+
+### A11: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): POST /api/reply: a missing agent-send.sh is a 500 with the path in the error, not a crash
+
+Reason: Re-indent only for the 500 and path asserts. The healthz status line is dropped with the HTTP server.
+
+```diff
+-     assert.equal(status, 500);
+-     assert.match(body.error, /missing-agent-send\.sh/);
+-     assert.equal(health.status, 200);
+   assert.equal(status, 500);
+   assert.match(body.error, /missing-agent-send\.sh/);
+```
+
+### A12: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): replyToRow: DEFAULT_AGENT_SEND is the repository's tools/tmux/agent-send.sh and it is executable
+
+Reason: Moved, not weakened: DEFAULT_AGENT_SEND asserts move to the refusal-table test (hunk 8).
+
+```diff
+-   assert.equal(DEFAULT_AGENT_SEND, resolve(pkgRoot, "..", "..", "tools", "tmux", "agent-send.sh"));
+-   assert.ok(existsSync(DEFAULT_AGENT_SEND));
+-   assert.ok(statSync(DEFAULT_AGENT_SEND).mode & 0o111);
+```
+
+### A13: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): page.html: the reply box appears only where canReply() holds (live registration with a tmux session), the detail has a Reply row, the submit posts JSON to /api/reply, receipts and drafts survive a refresh, and every receipt value is escaped
+
+Reason: Retired page.html source checks for the reply box (canReply, replyControl, postReply, receipts). Reply gate behaviour is covered in the Console by browser-edge.test (reply needs a registered seat, line 61; in-flight reply).
+
+```diff
+-   assert.ok(canReplyFn, "canReply() must exist");
+-   assert.match(canReplyFn[0], /reg\.alive !== false/, "a stale registration gets no box");
+-   assert.match(canReplyFn[0], /reg\.tmux && reg\.tmux\.session/, "a registration without a tmux session gets no box");
+-   assert.ok(replyControlFn, "replyControl() must exist");
+-   assert.match(replyControlFn[0], /if \(!canReply\(rec\)\) return '<span class="unknown">reply needs a registered seat<\/span>'/);
+-   assert.match(replyControlFn[0], /class="reply-form" data-id="' \+ esc\(id\)/);
+-   assert.match(replyControlFn[0], /value="' \+ esc\(replyDrafts\[id\] \|\| ""\)/, "an unsent draft is put back after a refresh");
+-   assert.match(rowPair[0], /<dt>Reply<\/dt><dd>" \+ replyControl\(rec\) \+ "<\/dd>/);
+-   assert.ok(receiptFn, "replyReceipt() must exist");
+-     assert.match(line, /esc\(/, `every receipt value must be escaped: ${line.trim()}`);
+-   assert.match(receiptFn[0], /esc\(r\.stderr \|\| r\.error/, "a failure shows the tool's stderr");
+-   assert.ok(postReplyFn, "postReply() must exist");
+-   assert.match(postReplyFn[0], /fetch\("\/api\/reply", \{\s*method: "POST",\s*headers: \{ "content-type": "application\/json" \}/);
+-   assert.match(postReplyFn[0], /JSON\.stringify\(\{ agent: id, text: text \}\)/);
+-   assert.match(postReplyFn[0], /replyReceipts\[id\] = body/);
+-   assert.ok(lines.some((l) => l.includes('main.addEventListener("submit"')), "the form submits through one delegated handler");
+-   assert.ok(lines.some((l) => l.includes('main.addEventListener("input"')), "drafts are captured as they are typed");
+-   assert.match(html, /function withReplyFocus\(render\)/, "a refresh gives the caret back to the reply box");
+-   assert.doesNotMatch(html, /send-keys/, "the page never talks tmux");
+ // Ported from the writer's HTTP test (refactor 78b69e1e6): the same assertions over board.index().
+```
+
+### A14: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): startServer: /api/board carries taskSetBy from a live registration and null for the derived rows
+
+Reason: Ported: byAgent taskSource, taskSetBy and registrationErrors asserts kept on board.index() (test renamed 'index: carries taskSetBy...'). Retired: page.html tag and detail checks and the HTTP Host/Origin fences (no listener).
+
+```diff
+-     assert.equal(byAgent.agent1.taskSource, "registration");
+-     assert.equal(byAgent.agent1.taskSetBy, "darkwing");
+-     assert.equal(byAgent.agent2.taskSource, "first-user-message");
+-     assert.equal(byAgent.agent2.taskSetBy, null);
+-     assert.deepEqual(body.registrationErrors, []);
+-   assert.ok(rowPair);
+-   assert.match(rowPair[0], /sourceTag\(rec\.taskSource\) \+ setByTag\(rec\)/, "the set-by tag follows the task's source tag on the row");
+-   assert.match(rowPair[0], /<dt>Task set by<\/dt><dd>" \+ setByText\(rec\) \+ "<\/dd>/, "the detail has a Task set by row");
+-   assert.ok(tagLine);
+-   assert.match(tagLine, /rec\.taskSetBy \?/, "nothing is shown without a value");
+-   assert.equal((tagLine.match(/esc\(rec\.taskSetBy\)/g) || []).length, 2, "the title and the text are both escaped");
+-   assert.match(tagLine, /not verified/);
+-   assert.ok(textLine);
+-   assert.match(textLine, /esc\(rec\.taskSetBy\)/);
+-   assert.match(textLine, /not verified/);
+-   assert.ok(canReplyFn);
+-   assert.equal(canReplyFn[0].includes("taskSetBy"), false);
+-   assert.equal(html.match(/function replyControl\(rec\) \{[\s\S]*?\n  \}/)[0].includes("taskSetBy"), false);
+-       assert.equal(board.status, 403, `GET /api/board, ${label}`);
+-       assert.deepEqual(JSON.parse(board.text), { error }, `GET /api/board, ${label}`);
+-       assert.equal(board.headers["access-control-allow-origin"], undefined);
+-       assert.equal(posted.status, 403, `POST /api/reply, ${label}`);
+-       assert.deepEqual(JSON.parse(posted.text), { error }, `POST /api/reply, ${label}`);
+-       assert.equal(posted.headers["access-control-allow-origin"], undefined);
+-     assert.equal((await rawRequest(port, {})).status, 400, "GET /api/board, missing Host");
+-     assert.equal((await rawRequest(port, { method: "POST", path: "/api/reply", headers: { "content-type": "application/json" }, body: reply })).status, 400, "POST /api/reply, missing Host");
+-     assert.equal(existsSync(f.capture), false, "agent-send was never run");
+-     assert.equal(existsSync(join(f.boardDir, "index.json")), false, "no refused request rescanned the board");
+-       assert.equal((await rawRequest(port, { path, headers: { host: `rebind.example:${port}` } })).status, 403, path);
+-     assert.equal((await rawRequest(port, { method: "POST", path: "/api/seen", headers: { host: `rebind.example:${port}`, "content-type": "application/json" }, body: "{}" })).status, 403);
+-       assert.equal((await rawRequest(port, { headers: { host } })).status, 200, host);
+-       assert.equal((await rawRequest(port, { headers: { host, origin: `http://${host}` } })).status, 200, `${host} with its own Origin`);
+-     assert.equal(posted.status, 200);
+-     assert.equal(JSON.parse(posted.text).delivered, true);
+-     assert.equal((await fetch(`http://${own}/api/board`)).status, 200, "fetch without Origin");
+-         assert.equal(r.status, 403, `${path}, ${label}`);
+-         assert.deepEqual(JSON.parse(r.text), { error }, `${path}, ${label}`);
+-         for (const h of Object.keys(r.headers)) assert.ok(!h.startsWith("access-control-"), `${path}, ${label}: ${h}`);
+-     assert.deepEqual(calls, [], "the reader never ran for a refused request");
+-     assert.equal((await rawRequest(port, { path: "/api/conversations", headers: { host: own, origin: `http://${own}` } })).status, 200, "same-origin passes");
+-     assert.deepEqual(calls, ["catalogue"]);
+   assert.equal(byAgent.agent1.taskSource, "registration");
+   assert.equal(byAgent.agent1.taskSetBy, "darkwing");
+   assert.equal(byAgent.agent2.taskSource, "first-user-message");
+   assert.equal(byAgent.agent2.taskSetBy, null);
+   assert.deepEqual(body.registrationErrors, []);
+```
+
+### A15: control-board/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): conversation routes: a reader listing that refuses gets its refusal status and body, not a 200
+
+Reason: Ported: status and refusal body kept on board.conversation (renamed 'conversation listing...'). Retired: HTTP content-type, nosniff, no-store and no-CORS asserts, now in the Console test (group B hunk 25). Retired: pi and claude catalogue and paging asserts, HTTP-only (gap).
+
+```diff
+-     assert.equal(res.status, 503);
+-     assert.deepEqual(await res.json(), { error: refusal.message, refusal: { code: refusal.code, reconcile: refusal.reconcile } });
+-   assert.ok(codes.size >= 15, [...codes].join(" "));
+-   assert.deepEqual([...codes].filter((c) => !(c in REFUSAL_STATUS)), []);
+-   assert.deepEqual(Object.keys(REFUSAL_STATUS).filter((c) => !codes.has(c)), [], "no stale entries");
+-   assert.deepEqual(REFUSAL_STATUS, {
+-     assert.equal(res.headers.get("content-type"), "application/json", path);
+-     assert.equal(res.headers.get("x-content-type-options"), "nosniff", path);
+-     assert.equal(res.headers.get("cache-control"), "no-store", path);
+-     assert.equal(res.headers.get("access-control-allow-origin"), null, path);
+-     assert.equal(cat.status, 200);
+-     assert.deepEqual([pi.seat, pi.title, pi.readOnly], ["agent1", "m0", true]);
+-     assert.deepEqual([link.refusal, claude.seat, claude.unsupportedReason], ["unsafe-path", "rocko", "unsupported-harness"]);
+-     assert.equal(first.status, 200);
+-     assert.deepEqual([first.body.page.kind, first.body.page.entries.length, first.body.page.hasMore, first.body.page.branch], ["page", 100, true, "main"]);
+-     assert.equal(second.status, 200);
+-     assert.deepEqual([second.body.page.entries.length, second.body.page.hasMore], [20, false]);
+-     assert.equal(second.body.page.entries.at(-1).content[0].text, "m119");
+-     assert.deepEqual([follow.status, follow.body.page.entries.length], [200, 0]);
+-     assert.equal(branch.status, 200);
+-       assert.equal(r.status, status, path);
+-       assert.deepEqual(r.body.refusal, { code, reconcile }, path);
+-       assert.equal(typeof r.body.error, "string");
+-       assert.equal(r.status, 400, path);
+-     assert.deepEqual(treePrint(f.sessionsDir), before, "the sessions directory is unchanged");
+-     assert.equal(existsSync(join(f.proj, ".pi", "state", "rocko")), false, "the Claude seat's directory was never created");
+   assert.equal(out.status, 503);
+   assert.deepEqual(out.body, { error: refusal.message, refusal: { code: refusal.code, reconcile: refusal.reconcile } });
+```
+
+### A16: webui/tests/browser.test.mjs
+
+Enclosing test (first match, old or new side): served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures
+
+Reason: CHANGED ASSERT: the error text must contain 'in the Console' instead of the board URL, since there is no board URL in-process. Not run; verify on CLEAR.
+
+```diff
+-     assert.ok(error.includes(f.boardURL)); assert.match(error, /Showing last known data/);
+     assert.ok(error.includes('in the Console')); assert.match(error, /Showing last known data/);
+```
+
+### A17: webui/tests/preview.test.mjs
+
+Enclosing test (first match, old or new side): loopback requests are unchanged in preview mode, and the bus views work with the board down
+
+Reason: CHANGED ASSERT: a dead board read now returns error 'invalid-response' at 502 (consoleRead, webui/src/serve.mjs:230-234). Status kept; the board echo field is gone.
+
+```diff
+-   assert.equal(board.status, 502); assert.equal(board.body.board, dead);
+   assert.equal(board.status, 502); assert.equal(board.body.error, 'invalid-response');
+```
+
+### A18: webui/tests/reads.test.mjs
+
+Enclosing test (first match, old or new side): settings: release, board, loopback address, notifier binding name only
+
+Reason: CHANGED ASSERT: settings.board is null, since the board is in-process (webui/src/serve.mjs:874, boardLabel).
+
+```diff
+-   assert.deepEqual({ ...body, launch: undefined, at: undefined }, { release: '0.0.99', business: 'acme', notifier: { binding: 'jason-dm' }, board: 'http://127.0.0.1:7331', address: `${base}/`, launch: undefined, at: undefined });
+   assert.deepEqual({ ...body, launch: undefined, at: undefined }, { release: '0.0.99', business: 'acme', notifier: { binding: 'jason-dm' }, board: null, address: `${base}/`, launch: undefined, at: undefined });
+```
+
+### A19: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): loopback host and board origin fail closed
+
+Reason: Retired: boardURL() is removed with the HTTP board address, so its asserts go with it.
+
+```diff
+-   for (const u of ['https://127.0.0.1', 'http://example.com', 'http://127.0.0.1/path', 'http://user:[email protected]', 'http://127.0.0.1?x', 'http://127.0.0.1#x']) assert.throws(() => boardURL(u));
+-   assert.equal(boardURL('http://localhost:7331'), 'http://127.0.0.1:7331');
+-   assert.equal(boardURL('http://[::1]:7331'), 'http://[::1]:7331');
+```
+
+### A20: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
+
+Reason: BEHAVIOUR CHANGE, not a re-expression: the refactor forwarded this request and returned the board's 409. The Console now answers 403 when send is off or the seat is unnamed (webui/src/serve.mjs ~843-846). The oversized-body 400 is also dropped here; no Console test covers the 4096 limit (open gap).
+
+```diff
+-       assert.equal(res.status, 409); assert.equal(await res.text(), '{"error":"fixture refusal <unsafe>"}');
+-       assert.deepEqual(requests.at(-1), { url: path, method: 'POST', body: raw });
+-       try { assert.equal((await post(base, '/api/reply', raw)).status, 400); } catch (err) { if (raw.length < 4096) throw err; }
+       assert.equal(res.status, 403, path); assert.equal((await res.json()).sent, false);
+```
+
+### A21: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
+
+Reason: Dropped: text/plain 400 (Console body() at serve.mjs:58 refuses non-JSON, mapped to 400 at :191; no test, open gap), the request-count checks (no HTTP hop) and the board-down 502 (board is in-process). Added: 405 for GET /api/reply and OPTIONS /api/board; 'the board never ran a write' check on f.captures.
+
+```diff
+-     assert.equal((await post(base, '/api/reply', '{}', { 'content-type': 'text/plain' })).status, 400);
+-     assert.equal(requests.length, 2);
+-     assert.equal((await fetch(base + '/api/board')).status, 502);
+-     assert.equal(requests.length, 3);
+     assert.equal(f.captures.length, 0, 'the board never ran a write');
+     assert.equal((await fetch(base + '/api/reply')).status, 405);
+     assert.equal((await fetch(base + '/api/board', { method: 'OPTIONS' })).status, 405);
+```
+
+### A22: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
+
+Reason: CHANGED ASSERT: the exact 404 body and refusal object become a want.status and want.body table. The table must match the same body (check in the file, not run).
+
+```diff
+-       assert.equal(res.status, 404, path);
+-       assert.equal(await res.text(), '{"error":"fixture unknown <x>","refusal":{"code":"unknown-branch","reconcile":true}}');
+-       assert.deepEqual(requests.at(-1), { url: path, method: 'GET', body: '' });
+       assert.equal(res.status, want.status, path);
+       assert.deepEqual(await res.json(), want.body, path);
+```
+
+### A23: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
+
+Reason: WEAKENED: the exact 'refused before the board' check (request count unchanged, last url /api/board) becomes a status >= 400 check. This drops the proof the board was not reached. Flagged for Mos.
+
+```diff
+-     assert.equal((await post(base, '/api/conversation?id=x', '{}')).status, 405);
+-     assert.equal((await post(base, '/api/conversations', '{}')).status, 405);
+-     assert.equal((await fetch(base + '/api/conversation?id=x', { headers: { origin: 'https://evil.example' } })).status, 403);
+-     assert.equal(requests.length, before, 'refused before the board');
+-     assert.equal(requests.at(-1).url, '/api/board');
+     assert.ok((await fetch(base + '/api/board')).status >= 400);
+```
+
+### A24: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): unreachable board reports URL; CLI rejects unsupported options
+
+Reason: CHANGED ASSERT: the 502 with the board URL becomes 503 not-configured for /api/board and /api/conversations. No board URL appears in any response now.
+
+```diff
+-     assert.equal(res.status, 502); const result = await res.json(); assert.equal(result.board, url); assert.ok(result.error.includes(url));
+     assert.equal((await fetch(base + '/api/board')).status, 503);
+     assert.equal((await fetch(base + '/api/conversations')).status, 503);
+```
+
+### A26: webui/tests/service.test.mjs
+
+Enclosing test (first match, old or new side): render carries every serve flag, the preview set included
+
+Reason: CHANGED ASSERT: the expected ExecStart drops the --board flag (in-process board; webui/src/cli.mjs and scripts/webui-service.sh changed in commit 1).
+
+```diff
+-   assert.equal(execStart(r.stdout), `ExecStart=${process.execPath} ${REPO}/packages/webui/src/cli.mjs serve --port 7340 --business mosaic.dev_1 --board http://127.0.0.1:7331 --public-host console.example.com --auth-header X-authentik-uid --allow-user ${UID}`);
+   assert.equal(execStart(r.stdout), `ExecStart=${process.execPath} ${REPO}/packages/webui/src/cli.mjs serve --port 7340 --business mosaic.dev_1 --public-host console.example.com --auth-header X-authentik-uid --allow-user ${UID}`);
+```
+
+## Group B (added by row 198; Sage rules)
+
+### B0: control-board/tests/board.test.mjs
+
+Enclosing test (first match, old or new side): cli serve refuses and points to the Console
+
+Reason: New in row 198: cli serve refusal (cli.mjs:14) and the 'serve' retirement message, plus the markSeen order and answer asserts.
+
+```diff
+ import assert from "node:assert/strict";
+   assert.deepEqual(events, ["write", "bump", "scan"]);
+   assert.deepEqual(before.seen, []);
+   assert.deepEqual(index.seen, ["proj/agent1"]);
+   const board = createBoard({ specs, boardDir, isAlive, onEvent: (name) => events.push(name), exec: async () => assert.fail("no send on refusal") });
+   assert.equal(out.status, 409);
+   assert.equal(events.includes("send"), false);
+   assert.equal(events.includes("bump"), false);
+   assert.equal(r.status, 2);
+   assert.match(r.stderr, /retired on 7331/);
+   assert.match(r.stderr, /webui/);
+```
+
+### B3: control-board/tests/relaunch.test.mjs
+
+Enclosing test (first match, old or new side): without the pid seam, a null-pid registration is undecided: kept, alive null, no relaunch
+
+Reason: New in row 198: null-pid relaunch test. Correction: a null pid makes registeredAlive undecided (scan.mjs:372, 377, 381), not dead. The seam only affects relaunch; the default stays () => true.
+
+```diff
+     assert.notEqual(row.registered, null);
+     assert.equal(row.registered.alive, null);
+     assert.equal(row.relaunchedAt, null);
+```
+
+### B25: webui/tests/serve.test.mjs
+
+Enclosing test (first match, old or new side): conversation routes: nosniff, no-store, no CORS header, and every board refusal keeps its status
+
+Reason: New in row 198: Console conversation headers test (nosniff, no-store, no CORS header) and the REFUSAL_STATUS table through the Console route.
+
+```diff
+     assert.equal(hostile, 403);
+     assert.equal((await fetch(f.base + path, { headers: { origin: 'https://evil.example' } })).status, 403);
+         assert.equal(res.status, status, `${code} ${path}`);
+         assert.deepEqual(await res.json(), { error: code }, `${code} ${path}`);
+         assert.equal(res.headers.get('x-content-type-options'), 'nosniff', path);
+         assert.equal(res.headers.get('cache-control'), 'no-store', path);
+         assert.equal(res.headers.get('access-control-allow-origin'), null, path);
+```
+
+## Retired, not ported
+
+One line per test name that exists on refactor and not in the current tree. Name-based check: `comm` on test names in the three files.
+
+- `control-board/tests/serve.test.mjs`: startServer: refuses a non-loopback host with ConfigError, never opens a socket — Listener refusal. No listener remains in control-board.
+- `control-board/tests/serve.test.mjs`: startServer: serves page, healthz, and a rescanning /api/board — HTTP-only page, healthz and /api/board. No listener remains; page content is not re-asserted (open gap).
+- `control-board/tests/serve.test.mjs`: startServer: a seatsDir registration overrides the row and index.registered reflects it — HTTP-only seatsDir override check. Not re-asserted in this port (open gap).
+- `control-board/tests/serve.test.mjs`: startServer: /api/board returns 500 JSON with an error field when scan throws — HTTP error envelope. A throwing board read is covered by the preview dead-board test (502 invalid-response, hunk 17); the 500 shape is not re-asserted.
+- `control-board/tests/serve.test.mjs`: CLI: serve refuses a non-loopback host with exit 2 and a refused: message — serve is retired; the refusal is asserted by board.test.mjs 'cli serve refuses and points to the Console' (group B hunk 0).
+- `control-board/tests/serve.test.mjs`: CLI: live serve prints its URL and answers /healthz — serve is retired (cli.mjs:14). The writer's HTTP healthz and page are gone; no listener remains (see Board listeners).
+- `control-board/tests/serve.test.mjs`: page.html: esc() escapes every HTML-significant character — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/seen marks a row; GET /api/board still shows it seen; seen:false clears it — Seen POST HTTP test removed, no port (no hunk, no phrase). markSeen write, bump, scan order is covered by board.test.mjs. Body-parsing gap below.
+- `control-board/tests/serve.test.mjs`: POST /api/seen without a JSON content-type returns 400 and does not write a mark — Body-parsing gap. Console body() refuses non-JSON content-type (webui/src/serve.mjs:58) then 400 at :191. No Console test (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/seen with invalid JSON returns 400 — Body-parsing gap. Console answers 400 (webui/src/serve.mjs:191). No Console test (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/seen with a body over 4096 bytes returns 400 (or resets the connection) and writes no mark — Body-parsing gap. Console body() default max 4096 (webui/src/serve.mjs:56) answers 400 via :191. No Console test (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/seen with a missing agent returns 400 — Body-parsing gap. Console answers 400 with the error message (webui/src/serve.mjs:197). No Console test (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/board returns 405; PUT /api/seen returns 405 — Writer HTTP method refusal. Console 405s are asserted by group A hunk 21 (GET /api/reply, OPTIONS /api/board).
+- `control-board/tests/serve.test.mjs`: page.html: seenControl() escapes rec.project/agent/lastActivity, and the POST uses a JSON content-type — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: page.html: has a collapsed Seen section that lists seen rows with the shared row builder — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: page.html: each project has a Hide seen checkbox (default on) beside Hide offline, with a hidden-count note — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: page.html: a project header reads \ — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: page.html: every row shows Task and Active project, derived or the word unknown, with the workspace in the detail — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: page.html: task and active project cells show their source via sourceTag(); the detail has a Registered row via registeredText(); SOURCE_LABEL maps registration to registered; every dynamic value in sourceTag/fromSource/registeredText is escaped — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: POST /api/reply: runs agent-send.sh with -s from the registration, -S <host>:control-board, -m text plus the fixed trailer, no -L on the default socket, MOSAIC_TMUX_SOCKET stripped; answers delivered with the exit code and both streams — Renamed; the phrase is still present in the current tree (rename only, no assert hunk).
+- `control-board/tests/serve.test.mjs`: POST /api/reply: a registration with a tmux socket adds -L <socket> — Name not carried over; the -L socket asserts stay (hunk 9, re-indent only).
+- `control-board/tests/serve.test.mjs`: POST /api/reply: a non-zero tool exit is a 200 with delivered false, the exit code and the stderr verbatim — Renamed; the phrase is still present in the current tree (rename only, no assert hunk).
+- `control-board/tests/serve.test.mjs`: POST /api/reply: refusals before the tool runs: empty or blank or long text 400, unknown row 404, no registration 409, stale registration 409, no tmux session 409, bad JSON 400; the tool is never called — Name not carried over; the refusal table stays (hunk 10, re-indent only).
+- `control-board/tests/serve.test.mjs`: POST /api/reply: a missing agent-send.sh is a 500 with the path in the error, not a crash — Name not carried over; the 500 and path asserts stay in the ported reply test (hunk 11).
+- `control-board/tests/serve.test.mjs`: page.html: the reply box appears only where canReply() holds (live registration with a tmux session), the detail has a Reply row, the submit posts JSON to /api/reply, receipts and drafts survive a refresh, and every receipt value is escaped — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: startServer: /api/board carries taskSetBy from a live registration and null for the derived rows — Renamed 'index: carries taskSetBy...'; asserts ported (hunk 14).
+- `control-board/tests/serve.test.mjs`: page.html: the task cell and detail show who set a registered task via setByTag()/setByText(), both escaped, only from rec.taskSetBy; the reply gate does not read it — page.html is deleted. Source-shape asserts (esc, Hide seen, reply gate, source tags) have no in-process target. Console app.js coverage NOT verified in this pass (open gap).
+- `control-board/tests/serve.test.mjs`: Host/Origin guard: GET /api/board and POST /api/reply refuse a foreign Host, a wrong port and a cross-origin Origin with 403 JSON, before any scan or send, and never send CORS headers — Writer HTTP fence. control-board opens no listener (see Board listeners). Console fences at webui/src/serve.mjs:713-717 and :726 covered by the F16 test.
+- `control-board/tests/serve.test.mjs`: Host/Origin guard: loopback names on this port are accepted, with or without a same-origin Origin — Writer HTTP fence; same reason as the other Host/Origin guard test.
+- `control-board/tests/serve.test.mjs`: conversation routes (F16): a foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers — Writer HTTP fence. Replaced by the Console F16 test (webui serve.test.mjs, 'conversation route: a non-local Host or a foreign Origin is refused 403').
+- `control-board/tests/serve.test.mjs`: conversation routes: a reader listing that refuses gets its refusal status and body, not a 200 — Renamed 'conversation listing: ...' and ported to board.conversation (hunk 15). HTTP header asserts moved to the Console test (group B hunk 25).
+- `control-board/tests/serve.test.mjs`: conversation routes: catalogue, first page, next page and follow over HTTP; refusals map to 4xx with their code; nothing is written — HTTP-only catalogue and paging. No in-process port; page-content asserts are not re-asserted (open gap).
+- `control-board/tests/discord.test.mjs`: server rescans connector discovery and refuses HTTP reply without transport — Renamed in place to 'board rescans connector discovery and refuses reply without transport'; HTTP fetch and 409 ported to board.index()/board.reply() (hunks 1-2).
+- `webui/tests/serve.test.mjs`: loopback host and board origin fail closed — boardURL() removed with the HTTP board address (hunk 19).
+- `webui/tests/serve.test.mjs`: proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect — Writer HTTP proxy test; the Console has no proxy hop in-process. Changed and weakened asserts in hunks 20-23 (see Weakened).
+- `webui/tests/serve.test.mjs`: unreachable board reports URL; CLI rejects unsupported options — No board URL to report in-process; replaced by 503 not-configured asserts (hunk 24).
+
+## Weakened and changed asserts (for Mos)
+
+- Hunk 20: 409 becomes 403 (behaviour change, see below); the oversized-body 400 is dropped.
+- Hunk 21: the text/plain 400 and the request-count and board-502 checks are dropped.
+- Hunk 22: exact 404 body text becomes a table comparison.
+- Hunk 23: exact 'refused before the board' check becomes status >= 400.
+
+## Behaviour changes to report
+
+1. POST /api/reply in the Console: 403 when send is off or the seat is unnamed (webui/src/serve.mjs ~843-846). The refactor forwarded the request unconditionally (hunk 20).
+2. /api/settings reports `board: null` in-process (hunk 18).
+3. A dead board read returns 502 `invalid-response` (hunk 17).
+4. Null-pid correction: a null pid is undecided (scan.mjs:372, 377, 381), not dead. The default `() => true` only matters for relaunch, and the new relaunch test (group B hunk 3) covers that.
+5. creative-hidden.test.mjs: ported from `startServer` to `createBoard` and `board.conversation`. Assertions unchanged. `startServer` is no longer exported by control-board/src/serve.mjs.
+
+## Board listeners after 198
+
+Command: `grep -rn "createServer\|\.listen(\|startServer\|startBoard" packages/control-board/src`
+
+Result: no matches (exit 1). control-board/src opens no listener.
+
+CLI entry: packages/control-board/src/cli.mjs:14 refuses `serve` with `ConfigError` (RETIRED message, line 11). No listener.
+
+Not in the board's code, for completeness: the Console (packages/webui/src/serve.mjs:1 imports `createServer`; :684 creates the server; :909 listens) hosts the board in-process. packages/webui/src/tester-socket.mjs:24 listens on a separate tester socket, not the board.
+
+So the Host/Origin tests in control-board are retired on this basis. The Console's Host and Origin fences are covered by the F16 test in webui/tests/serve.test.mjs.
+
+## Open items (not closed in this pass)
+
+- page.html source checks are retired with no verified Console equivalent in app.js (open gap).
+- Seen POST body parsing (400 for invalid JSON, missing agent, 4096 limit, non-JSON content-type) has no board test and no Console test. Gap recorded; no new test added (sage-4373).
+- Catalogue and paging over HTTP, seatsDir registration override, and the 500 shape are not re-asserted (see retire list).
+- Not run: chat-replies-browser (line 71 `startServer({ port: 0, board: f.board })`) and the shell 'board unavailable' text (ReadError message path, serve.mjs:230-234). Verify on CLEAR.
+- The webui F16 test (serve.test.mjs:93) is a new test; the hunk map does not isolate it as its own hunk. Confirm its add lines are in group B hunk 25's range.
+- webui/tests/discord.test.mjs needs no isPidAlive seam: its registration uses pid `process.pid`.
+- conversation/tests/flows.test.mjs imports replyToRow from control-board/src/serve.mjs; the export still exists. Not run.
+- Syntax: `node --check` passes for all touched JS files (no tests run).
+
@@ -1,2 +0,0 @@
-2026-10-25T07:47:01Z
- 02:47:01 up 11 days, 18:06,  2 users,  load average: 13.77, 14.23, 20.51
@@ -1,2 +0,0 @@
-2026-10-25T07:46:54Z
- 02:46:54 up 11 days, 18:06,  2 users,  load average: 13.49, 14.18, 20.53
@@ -1,20 +0,0 @@
-P4 offline upgrade version=8.0.42 nice=16
-P4 diagnostic {"stage":"binary-start","nodePriority":16,"childPriority":16,"lastClientErrorCode":null,"nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"management-ready","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"store-open","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"broker-bound","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 empty-provider diagnostic {"httpStatus":404,"type":"object","isArray":true,"count":0}
-proxy.accounts initial empty; GET /credentials + GET /config/api-keys/claude
-proxy.login.start claude GET /oauth/auth-url; fields=url,state only
-proxy.login.submit POST /oauth/callback; fake code never ok; GET /oauth/status=wait
-proxy.login.cancel DELETE /oauth/session confirmed
-proxy.login.start codex GET /oauth/auth-url; fields=url,state only
-proxy.login.submit POST /oauth/callback; fake code never ok; GET /oauth/status=wait
-proxy.login.cancel DELETE /oauth/session confirmed
-proxy.apikey.add PUT /config/api-keys/claude; account fields=accountId,provider,displayName,status,priority; id from auth_index
-proxy.priority.set API-key PUT /config/api-keys/claude; priority read-back=7
-proxy.keys GET /config/access/api-keys; fields=keyId,management,agent,issuedAt,state; sentinel labelled; values absent
-proxy.priority.set OAuth PATCH /credentials/fields body={name,priority}; priority read-back=8
-PASS offline native-page bus contract and secret-free receipts
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":null,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":null,"childExitCode":0,"childSignal":null}
@@ -1,19 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/ICE0YV
-✔ accounts have exactly the allowlisted public fields, id from credential identifier (28.859027ms)
-✔ token-like data in every upstream field never reaches public accounts (5.070752ms)
-✔ API key account is derived from proxy auth_index, never api-key, and can set priority (12.225188ms)
-✔ OAuth priority uses top-level name/priority and confirms it through list (4.580885ms)
-✔ priority-unconfirmed: accepted API-key write with unchanged read-back refuses (5.588673ms)
-✔ priority-write-refused: OAuth PATCH status 201 (3.491938ms)
-✔ priority-write-refused: OAuth PATCH status 400 (4.410853ms)
-✔ priority-invalid: unknown account refuses before any write (2.983779ms)
-✔ proxy-down: a closed management listener refuses once (1.996951ms)
-✔ client keys return ids, sentinel/foreign labels and only scoped record metadata (3.672515ms)
-ℹ tests 10
-ℹ suites 0
-ℹ pass 10
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 183.915712
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/WlQ8bY
-✔ fresh404 yields no accounts, then adds the first key once with no value leakage (32.08173ms)
-✔ malformed200 null remains proxy-down, no retry or write (7.8998ms)
-✔ malformed200 object remains proxy-down, no retry or write (3.878116ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 147.324337
@@ -1,2 +0,0 @@
-2026-10-25T07:46:23Z
- 02:46:23 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:22Z
- 02:46:22 up 11 days, 18:06,  2 users,  load average: 13.76, 14.37, 20.83
@@ -1,26 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/zFmWGh
-✔ proxy.login.start: provider-not-allowed (32.675653ms)
-✔ proxy.apikey.add: provider-not-allowed (0.468026ms)
-✔ apikey-invalid empty (0.345583ms)
-✔ apikey-invalid too long (0.330348ms)
-✔ apikey-invalid charset (0.281139ms)
-✔ callback-url-invalid not URL (1.581908ms)
-✔ callback-url-invalid oversize (0.382376ms)
-✔ callback-url-invalid repeated state (0.344928ms)
-✔ login-state-unknown callback never reaches proxy (0.456109ms)
-✔ login state is scoped to the human and business (0.514738ms)
-✔ accepted callback wait is pending; only a status ok completes and retires state (0.915716ms)
-✔ expiry reports login-timeout once with no management call and retires state (0.306001ms)
-✔ cancel calls DELETE and retires state (0.39506ms)
-✔ upstream OAuth error body never crosses bus response (0.266204ms)
-✔ priority-invalid {"accountId":"bad","priority":1} (0.216492ms)
-✔ priority-invalid {"accountId":"aaaaaaaaaaaa","priority":1.5} (0.206751ms)
-✔ priority-invalid {"accountId":"aaaaaaaaaaaa","priority":1001} (0.245944ms)
-ℹ tests 17
-ℹ suites 0
-ℹ pass 17
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 107.671923
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,50 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/WXpqyV
-✔ proxy.accounts: owner calls page once with business/human scope (26.116796ms)
-✔ proxy.accounts: tester human-required (20.297319ms)
-✔ proxy.accounts: agent human-required (16.822485ms)
-✔ proxy.accounts: user human-required (17.662186ms)
-✔ proxy.accounts: not-configured (23.121015ms)
-✔ proxy.login.start: owner calls page once with business/human scope (17.138825ms)
-✔ proxy.login.start: tester human-required (17.581147ms)
-✔ proxy.login.start: agent human-required (20.879742ms)
-✔ proxy.login.start: user human-required (24.234711ms)
-✔ proxy.login.start: not-configured (19.75879ms)
-✔ proxy.login.submit: owner calls page once with business/human scope (22.157242ms)
-✔ proxy.login.submit: tester human-required (25.380596ms)
-✔ proxy.login.submit: agent human-required (21.217295ms)
-✔ proxy.login.submit: user human-required (23.521967ms)
-✔ proxy.login.submit: not-configured (24.585017ms)
-✔ proxy.login.status: owner calls page once with business/human scope (22.913517ms)
-✔ proxy.login.status: tester human-required (21.7594ms)
-✔ proxy.login.status: agent human-required (28.198167ms)
-✔ proxy.login.status: user human-required (18.344285ms)
-✔ proxy.login.status: not-configured (20.030294ms)
-✔ proxy.login.cancel: owner calls page once with business/human scope (16.420549ms)
-✔ proxy.login.cancel: tester human-required (20.486195ms)
-✔ proxy.login.cancel: agent human-required (17.871874ms)
-✔ proxy.login.cancel: user human-required (20.801042ms)
-✔ proxy.login.cancel: not-configured (24.049445ms)
-✔ proxy.apikey.add: owner calls page once with business/human scope (20.743633ms)
-✔ proxy.apikey.add: tester human-required (20.590224ms)
-✔ proxy.apikey.add: agent human-required (20.621701ms)
-✔ proxy.apikey.add: user human-required (23.304327ms)
-✔ proxy.apikey.add: not-configured (26.176447ms)
-✔ proxy.priority.set: owner calls page once with business/human scope (18.750335ms)
-✔ proxy.priority.set: tester human-required (19.039252ms)
-✔ proxy.priority.set: agent human-required (18.745218ms)
-✔ proxy.priority.set: user human-required (17.214992ms)
-✔ proxy.priority.set: not-configured (17.152828ms)
-✔ proxy.keys: owner calls page once with business/human scope (18.060003ms)
-✔ proxy.keys: tester human-required (17.424731ms)
-✔ proxy.keys: agent human-required (14.943668ms)
-✔ proxy.keys: user human-required (16.025103ms)
-✔ proxy.keys: not-configured (16.373436ms)
-✔ API-key canary never enters broker events or unknown error output (15.813479ms)
-ℹ tests 41
-ℹ suites 0
-ℹ pass 41
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 994.095736
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:23Z
- 02:46:23 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,17 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/qBvaqm
-✔ empty provider GET404 yields empty array, discards body and receipts actual404 once (23.337829ms)
-✔ provider GET401 remains proxy-client-refused, no retry (5.03975ms)
-✔ provider GET403 remains proxy-client-refused, no retry (2.874184ms)
-✔ provider GET500 remains proxy-client-refused, no retry (2.839998ms)
-✔ getCredentials404 remains proxy-client-refused, no retry (3.031846ms)
-✔ getKeys404 remains proxy-client-refused, no retry (2.739596ms)
-✔ provider PUT404 remains proxy-client-refused, never treated as empty GET (1.681292ms)
-✔ provider GET200 array passes through, with receipt and no retry (1.893456ms)
-ℹ tests 8
-ℹ suites 0
-ℹ pass 8
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 148.993332
@@ -1,2 +0,0 @@
-2026-10-25T07:46:22Z
- 02:46:22 up 11 days, 18:06,  2 users,  load average: 13.76, 14.37, 20.83
@@ -1,2 +0,0 @@
-2026-10-25T07:46:22Z
- 02:46:22 up 11 days, 18:06,  2 users,  load average: 13.76, 14.37, 20.83
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/NaZhtr
-✔ OAuth management calls keep URL and state out of receipts (25.417454ms)
-✔ upstream key goes only in request body and upstream refusal body is discarded (5.332331ms)
-✔ redirected management calls are not followed or retried (2.562305ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 139.356091
@@ -1,2 +0,0 @@
-2026-10-25T07:46:23Z
- 02:46:23 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:23Z
- 02:46:23 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,10 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/UVkG6Q
-✔ Console production module graph cannot import the model-proxy client (93.862563ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 177.142216
@@ -1,2 +0,0 @@
-2026-10-25T07:46:30Z
- 02:46:30 up 11 days, 18:06,  2 users,  load average: 12.40, 14.06, 20.66
@@ -1,2 +0,0 @@
-2026-10-25T07:46:29Z
- 02:46:29 up 11 days, 18:06,  2 users,  load average: 12.40, 14.06, 20.66
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/HkzUFL
-✔ proxy browser clears write-only key immediately, sends once and renders data as text (923.252097ms)
-✔ proxy browser OAuth opens safely, callback wait stays pending, status ok completes (2763.533016ms)
-✔ proxy browser read-only disables account changes (662.846864ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 4447.991189
@@ -1,2 +0,0 @@
-2026-10-25T07:46:29Z
- 02:46:29 up 11 days, 18:06,  2 users,  load average: 12.40, 14.06, 20.66
@@ -1,2 +0,0 @@
-2026-10-25T07:46:25Z
- 02:46:25 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,11 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/MVzxL3
-✔ API-key canary reaches fake once and zero responses/logs/receipts/store files (49.859682ms)
-✔ OAuth URLs, state and code stay out of broker records and management receipts (21.222227ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 266.31653
@@ -1,2 +0,0 @@
-2026-10-25T07:46:25Z
- 02:46:25 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:25Z
- 02:46:25 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,20 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/pooz0I
-✔ owner proxy routes each make exactly one allowlisted call (30.857128ms)
-✔ proxy write refuses signed-out (3.336504ms)
-✔ proxy write refuses loopback (2.704228ms)
-✔ proxy write refuses cross-origin (1.698264ms)
-✔ proxy write refuses missing Fetch Metadata (1.705732ms)
-✔ all proxy writes are read-only without --send (4.69854ms)
-✔ granted user never reaches owner page or any proxy route (7.577808ms)
-✔ native page offers write-only key input and no panel script (2.379451ms)
-✔ Console caller rejects every non-proxy verb (1.337229ms)
-✔ tester socket refuses proxy page, reads and writes before any owner call (8.577124ms)
-✔ malformed API-key JSON never appears in errors or logs (1.827938ms)
-ℹ tests 11
-ℹ suites 0
-ℹ pass 11
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 255.783124
@@ -1,2 +0,0 @@
-2026-10-25T07:46:25Z
- 02:46:25 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,2 +0,0 @@
-2026-10-25T07:46:24Z
- 02:46:24 up 11 days, 18:06,  2 users,  load average: 13.22, 14.25, 20.76
@@ -1,10 +0,0 @@
-packages/model-proxy/tests/empty-provider.test.mjs
-packages/bus/tests/proxy-page-empty-provider.test.mjs
-packages/model-proxy/tests/page-client.test.mjs
-packages/bus/tests/proxy-page.test.mjs
-packages/bus/tests/proxy-page-state.test.mjs
-packages/bus/tests/proxy-page-accounts.test.mjs
-packages/webui/tests/proxy-page.test.mjs
-packages/webui/tests/proxy-canary.test.mjs
-packages/webui/tests/proxy-browser.test.mjs
-packages/webui/tests/proxy-architecture.test.mjs
@@ -1,2 +0,0 @@
-2026-10-25T07:47:52Z
- 02:47:52 up 11 days, 18:07,  2 users,  load average: 9.43, 13.06, 19.79
@@ -1,2 +0,0 @@
-2026-10-25T07:47:50Z
- 02:47:50 up 11 days, 18:07,  2 users,  load average: 9.43, 13.06, 19.79
@@ -1,8 +0,0 @@
-{"mutant":"accounts-unfiltered-field","test":"packages/bus/tests/proxy-page-accounts.test.mjs","exit":1,"nice":19,"failures":2,"passes":8,"failingTests":["accounts have exactly the allowlisted public fields, id from credential identifier","token-like data in every upstream field never reaches public accounts"],"killed":true,"restored":true,"originalSha256":"14acdb4d3fdaabad508eec7378740b13c175d4bdd0c6e707a673138eff82365b"}
-{"mutant":"accounts-unfiltered-field","positiveControl":true,"test":"packages/bus/tests/proxy-page-accounts.test.mjs","exit":0,"nice":19,"failures":0,"passes":10,"failingTests":[],"positive":true}
-{"mutant":"callback-skips-state","test":"packages/bus/tests/proxy-page-state.test.mjs","exit":1,"nice":19,"failures":2,"passes":15,"failingTests":["login-state-unknown callback never reaches proxy","accepted callback wait is pending; only a status ok completes and retires state"],"killed":true,"restored":true,"originalSha256":"14acdb4d3fdaabad508eec7378740b13c175d4bdd0c6e707a673138eff82365b"}
-{"mutant":"callback-skips-state","positiveControl":true,"test":"packages/bus/tests/proxy-page-state.test.mjs","exit":0,"nice":19,"failures":0,"passes":17,"failingTests":[],"positive":true}
-{"mutant":"proxy-route-accepts-granted-user","test":"packages/webui/tests/proxy-page.test.mjs","exit":1,"nice":19,"failures":1,"passes":10,"failingTests":["granted user never reaches owner page or any proxy route"],"killed":true,"restored":true,"originalSha256":"7b7bee91604b7bd973027b177de83205db9aed366e694072fc6343b46465b5ba"}
-{"mutant":"proxy-route-accepts-granted-user","positiveControl":true,"test":"packages/webui/tests/proxy-page.test.mjs","exit":0,"nice":19,"failures":0,"passes":11,"failingTests":[],"positive":true}
-{"mutant":"apikey-logged","test":"packages/webui/tests/proxy-canary.test.mjs","exit":1,"nice":19,"failures":1,"passes":1,"failingTests":["API-key canary reaches fake once and zero responses/logs/receipts/store files"],"killed":true,"restored":true,"originalSha256":"14acdb4d3fdaabad508eec7378740b13c175d4bdd0c6e707a673138eff82365b"}
-{"mutant":"apikey-logged","positiveControl":true,"test":"packages/webui/tests/proxy-canary.test.mjs","exit":0,"nice":19,"failures":0,"passes":2,"failingTests":[],"positive":true}
@@ -1,26 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/zwP2zD
-✖ fresh404 yields no accounts, then adds the first key once with no value leakage (31.629717ms)
-✔ malformed200 null remains proxy-down, no retry or write (10.121658ms)
-✔ malformed200 object remains proxy-down, no retry or write (5.73007ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 2
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 218.324391
-
-✖ failing tests:
-
-test at packages/bus/tests/proxy-page-empty-provider.test.mjs:7:1
-✖ fresh404 yields no accounts, then adds the first key once with no value leakage (31.629717ms)
-  Error [ProxyError]: proxy-down
-      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/poe-row330/packages/model-proxy/src/common.mjs:8:39)
-      at ProxyPage.request (file:///home/jwoltje/.t3/worktrees/mosaic-stack/poe-row330/packages/bus/src/proxy-page.mjs:80:7)
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-      at async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/poe-row330/packages/bus/tests/proxy-page-empty-provider.test.mjs:10:17)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
-    code: 'proxy-down'
-  }
@@ -1,2 +0,0 @@
-2026-10-25T07:46:06Z
- 02:46:06 up 11 days, 18:05,  2 users,  load average: 15.17, 14.64, 21.02
@@ -1,2 +0,0 @@
-2026-10-25T07:46:06Z
- 02:46:06 up 11 days, 18:05,  2 users,  load average: 15.17, 14.64, 21.02
@@ -1,35 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/gJcxnP
-✖ empty provider GET404 yields empty array, discards body and receipts actual404 once (30.718928ms)
-✔ provider GET401 remains proxy-client-refused, no retry (8.324236ms)
-✔ provider GET403 remains proxy-client-refused, no retry (2.996504ms)
-✔ provider GET500 remains proxy-client-refused, no retry (2.838583ms)
-✔ getCredentials404 remains proxy-client-refused, no retry (3.923009ms)
-✔ getKeys404 remains proxy-client-refused, no retry (4.502681ms)
-✔ provider PUT404 remains proxy-client-refused, never treated as empty GET (2.271108ms)
-✔ provider GET200 array passes through, with receipt and no retry (2.585158ms)
-ℹ tests 8
-ℹ suites 0
-ℹ pass 7
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 192.563954
-
-✖ failing tests:
-
-test at packages/model-proxy/tests/empty-provider.test.mjs:35:1
-✖ empty provider GET404 yields empty array, discards body and receipts actual404 once (30.718928ms)
-  Error [ProxyError]: proxy-client-refused
-      at ClientRequest.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/poe-row330/packages/model-proxy/src/client.mjs:30:49)
-      at ClientRequest.wrapper (node:events:639:12)
-      at ClientRequest.emit (node:events:514:20)
-      at HTTPParser.parserOnIncomingClient (node:_http_client:973:27)
-      at HTTPParser.parserOnHeadersComplete (node:_http_common:125:17)
-      at Socket.socketOnData (node:_http_client:808:22)
-      at Socket.emit (node:events:514:20)
-      at addChunk (node:internal/streams/readable:575:12)
-      at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
-      at Readable.push (node:internal/streams/readable:406:5) {
-    code: 'proxy-client-refused'
-  }
@@ -1,2 +0,0 @@
-2026-10-25T07:46:06Z
- 02:46:06 up 11 days, 18:05,  2 users,  load average: 15.17, 14.64, 21.02
@@ -1,2 +0,0 @@
-2026-10-25T07:46:05Z
- 02:46:05 up 11 days, 18:05,  2 users,  load average: 15.17, 14.64, 21.02
@@ -1,618 +0,0 @@
-# Row 330 / P4 Console proxy page — #1828
-
-2026-10-24 Poe. Base: refactor 78b69e1e6; branch poe/row330.
-
-## Requirements and boundaries
-
-Replacement brief blob 4c005dc4936c, heading line 17. At 78b69e1e6 the
-0ce22dde6 line references remain unchanged: verbs 27–36; accounts 37–44;
-OAuth 45–61; upstream API keys 62–74; priority 75–78; client keys 79–83;
-usage 84–85; Console routes/page 86–98; upgrade check 99–110;
-tests 112–132; order 142–143; gate and named mutants 145–150.
-Rows document Rules for every row remain at line 12.
-
-No live proxy/config/credential access. No host proxy calls. Work uses its own
-node_modules. No tests until Sage CLEAR; run list derived from imports before
-whole-file runs. P2 must land and be rebased before gate; P4 lands after P2.
-Gladstone first review; Filbert landing review. No refactor push authority.
-
-## Proposed implementation contract
-
-Verbs: proxy.accounts, proxy.login.start, proxy.login.submit,
-proxy.login.status, proxy.login.cancel, proxy.apikey.add,
-proxy.priority.set, proxy.keys. The broker checks human transport before
-configuration, including granted users (human-required). Missing proxy:
-not-configured. Management connection failure: proxy-down, no retry.
-
-Accounts return only accountId, provider, displayName, status, priority.
-accountId hashes the proxy credential identifier (12 hex SHA256), never a token.
-Provider/status values must be constrained and names must be derived from safe
-metadata; arbitrary credential field values must not be reflected. Exact pinned
-8.0.42 endpoint/field mapping still to be confirmed on the offline stand-in.
-
-Login sessions live in bus memory, scoped to the owning business/human, with
-300-second default expiry. A pasted URL is bounded, parsed and matched to a
-pending state started by this bus. Finished/expired/unknown state refuses
-login-state-unknown; malformed URL refuses callback-url-invalid. Only status ok
-finishes sign-in; callback acceptance/wait never does. No URLs, states or codes
-in logs/receipts/errors. Start allows claude/codex only; API-key add allows z.ai
-only. API keys are write-only printable ASCII, bounded, never echoed.
-
-Owner-only /proxy page; /api/proxy/accounts and /api/proxy/keys reads;
-/api/proxy/login/start, /submit, /status, /cancel; /api/proxy/apikey/add;
-/api/proxy/priority/set. Each maps to exactly one allowlisted bus call.
-Writes require named host, owner sign-in, own Origin, same-origin Fetch Metadata
-and --send. Tester, granted user and loopback refuse. Console holds no client,
-proxy settings or management key. Usage placeholder accepts P5's later view;
-P4 creates no usage source.
-
-## Test plan (not yet run)
-
-Management client: pinned endpoint/method/body contract, loopback-only auth,
-redirect refusal, bounded response, safe receipts, no retry.
-Bus: all eight verbs against fake server; separate refusal cases for missing
-config, tester/agent/granted user human-required, both provider allowlists,
-unknown/expired/finished state, invalid callback URL, each API-key invalid case,
-invalid priority/account id, and proxy-down. Explicit wait-is-not-ok test.
-Accounts: strict allowlist, ids from identifier, toxic-field fake, API-key account
-and priority round-trip. Keys: ids only, sentinel and foreign-key labels, P2 join.
-Console: owner success; granted/tester/loopback/signed-out/cross-origin/missing
-Fetch Metadata refusals; every write refuses without --send; caller allowlist;
-no webui import of management client or proxy config access.
-Canary: fake management receives API key exactly once, and all responses, logs,
-receipts, errors and store files contain zero copies. OAuth secrets likewise.
-Named mutants: unfiltered account field; skipped callback state check; granted
-user accepted at /api/proxy/; API-key echoed by error/log.
-Full model-proxy, bus, webui (MOSAIC_REQUIRE_EDITOR_BUILD=1), touched test files;
-Sage landing gate all packages except queue and scripts/test-*.sh. Upgrade check
-under unshare -rn on PIN 8.0.42; output must land here. No runs claimed yet.
-
-## Design clarification (Sage sage-4347)
-
-Committed researcher/P1 artifacts may be read in this checkout. Read v8.0.27
-management reference and P1 BUILD/REVIEW. P1 confirms 8.0.42 key list is an array
-and OAuth redirect URLs localhost:54545/callback (Claude) and
-localhost:1455/auth/callback (Codex). P1 does not record credential response
-fields, z.ai upstream config schema or credentials/fields PATCH payload.
-Those remain unconfirmed, not guessed as a pinned contract.
-
-Expiry behavior: status for an expired pending state returns
-{status:"error", reason:"login-timeout"}, deletes the state and makes no proxy
-call. It is not signed in; later status/submit/cancel refuses login-state-unknown.
-No code or upstream error body is returned. Timeout can be provided as a trusted
-host setting, default300s; no page/agent verb may widen it.
-
-Setup: npm ci --ignore-scripts --no-audit --no-fund completed in worktree root
-(128 packages) and packages/webui (2 packages), both launched at nice19 with
-fresh shell-created short TMPDIR. No canonical npm or node_modules links.
-Canonical queue next completed with view-unknown warning; move returned
-ok poe-330-start rev4077 row330 briefed→in-progress. No repair performed.
-
-## Pre-run list (no execution)
-
-Static esbuild import parsing of the initial RED entrypoints (no tests executed)
-produced red-import-graph.json and red-run-list.txt. Whole-file list:
-packages/model-proxy/tests/page-client.test.mjs;
-packages/bus/tests/proxy-page.test.mjs;
-packages/bus/tests/proxy-page-state.test.mjs;
-packages/webui/tests/proxy-page.test.mjs.
-The new state test's dynamic URL import points at the not-yet-implemented
-packages/bus/src/proxy-page.mjs; expected first RED is missing implementation.
-No case1-accept file is selected. Probe.sh is also slot work, on a random
-loopback port inside unshare-rn, using only the verified own fixture executable.
-No test or binary probe has run yet. The three open pinned contracts remain
-probe-pending. Priority tests currently choose integer range -1000..1000.
-
-Sage sage-4352 authorizes P1 fetch into this fresh fixture. Fetch succeeded at
-nice19, verified archive, executable and panel hashes against PIN8.0.42, and
-installed only under /mnt/storage/scratch/tmp/76TDtz/download/opt/cliproxyapi/8.0.42.
-Receipt fetch.txt contains paths only. No host executable was used or inspected.
-
-2026-10-24T04:04Z: node --check on all four new test files and probe.mjs,
-bash -n probe.sh, and git diff --check passed. Syntax checks only: no test
-module or pinned executable ran. No production implementation changed yet;
-RED-first requirement and Sage CLEAR slot gate remain in force. Canonical
-queue start is complete; waiting for the authorized test slot, not a Jason
-decision. No commit or push made.
-
-## First RED and pinned contract probe (sage-4391 CLEAR)
-
-2026-10-24T04:24Z. Four whole files ran serially, absolute paths, a fresh
-shell-created short TMPDIR per run, nice19 recorded in each receipt. No old
-test file ran and no test was rerun. All four exited1 as expected:
-
- page-client: 0pass/3fail. OAuth receipt test fails because oauthStart is
-  undefined; upstream refusal/canary test because putUpstreamGroups is undefined;
-  redirect test because getCredentials is undefined. Receipt red-page-client.txt.
- broker proxy-page: 0pass/41fail. For each of the eight verbs, the owner gets
-  unknown-verb instead of a page response, tester gets tester-refused instead of
-  human-required, agent gets unknown-verb instead of human-required, granted user
-  gets access-refused instead of human-required, and missing configuration gets
-  unknown-verb instead of not-configured. Canary error test gets unknown-verb
-  instead of proxy-down. All are the missing P4 dispatch boundary, not a fixture
-  setup failure. Receipt red-broker.txt enumerates every failing test.
- proxy-page-state: 0pass/17fail. Every named provider/key/callback/state/expiry/
-  cancellation/priority case fails ERR_MODULE_NOT_FOUND for the not-yet-created
-  packages/bus/src/proxy-page.mjs. Receipt red-state.txt enumerates each case.
- webui proxy-page: 6pass/3fail. Owner routes return404; native page returns404;
-  Console caller proxyCall is undefined. Signed-out, loopback, cross-origin,
-  absent Fetch Metadata, no-send and granted-user boundary cases pass through
-  existing general refusals. Receipt red-webui.txt.
-
-probe.sh exited0 under unshare-rn, random loopback port, own config and made-up
-short key, verified PIN8.0.42 binary, nice19. Child exited and namespace closed.
-No host proxy or real instance state was used. probe.txt is shape-only output:
-
- GET /credentials:200 {files:[], observed_at:string}.
- GET /oauth/auth-url?provider=claude and provider=codex:200 with url/state/status
-  strings. DELETE /oauth/session?state=[redacted]:200 cancelled/status.
- PUT /config/api-keys/claude with
-  [{name,base-url,priority,keys:[{api-key}]}]:200 status/config-version.
-  Used z.ai's Claude-compatible endpoint; no request reached that endpoint.
- GET /config/api-keys/claude: array of groups, name/base-url/priority; keys
-  include api-key and a proxy-generated auth_index. Values were not printed.
- GET /credentials after API-key add remains files:[]: API-key credentials are
-  not listed here. Accounts must join the provider config's safe metadata.
- The script's priority PATCH branch required a credential row; no row existed,
-  so it did NOT run. Credentials field payload and populated OAuth response fields
-  remain unconfirmed. Reported rather than treating rc0 as full contract proof.
-
-Slot returned to Sage after this report. GREEN, mutants and further binary probes
-require separate CLEAR. No implementation run, commit or push claimed.
-
-## Probe 2 observed contract (sage-4394 CLEAR)
-
-2026-10-24T04:25Z. probe2.sh exited0 under unshare-rn, own random loopback
-port/config/short made-up key, nice19. Fixture child exited; EXIT trap removed
-the entire shell-created fixture TMPDIR, including fabricated credential/config.
-Only verified fetched binary outside this temporary runtime root was retained.
-Receipt probe2.txt contains types/shapes only, no credential values.
-
-POST /v8/management/credentials?name=[fixture filename] with JSON
-{type,access_token,refresh_token,expired,email} returns200 {status:string}.
-No multipart fallback was needed. Populated GET /credentials returns
-{files:[...],observed_at:string}. Credential row fields/types:
-account/string, account_type/string, auth_index/string, cooldowns/array,
-created_at/string, disabled/boolean, email/string, failed/number, id/string,
-label/string, modtime/string, name/string, path/string, provider/string,
-quota/object, recent_requests/array, runtime_only/boolean, size/number,
-source/string, status/string, status_message/string, success/number,
-type/string, unavailable/boolean, updated_at/string. priority/number appears
-after setting it. Fields other than the explicit public projection are dropped.
-
-PATCH /credentials/fields observations:
- {id,priority}400; {id,fields:{priority}}400.
- {name:<OAuth id>,priority}200; {name:<OAuth name>,priority}200.
- {name:<OAuth name>,fields:{priority}}200, but200 alone does not prove it changed
-  priority (this may be an ignored unknown field); use top-level priority.
- {auth_index,priority}400; {auth_index,fields:{priority}}400 for both OAuth
-  and API-key identifiers.
- {name:<auth_index>,priority}404 for both OAuth and API key.
-Final OAuth list has numeric priority and changed to one of the requested values.
-API-key group priority did not change. Consequently priority uses top-level
-{name,priority} for OAuth files; API-key priority must update its provider config,
-not credentials/fields. A future upgrade acceptance must verify both read-backs.
-
-Slot returned after probe2. No GREEN or mutant run authorized yet.
-
-## Candidate implementation (not GREEN-verified)
-
-Written after the first RED run: fixed client operations and receipts, human-only
-broker dispatch before generic tester/user gates, bus-owned pending-state machine,
-strict public account projection, native owner-only HTTP routes and /proxy page.
-No management client/config access in the Console's new code. Reads use the owner
-human transport and writes independently require --send/Origin/Fetch Metadata.
-
-Generated display names use the constrained provider and credential-id hash,
-rather than upstream label/email/group-name strings. This is a consequential
-security/usability tradeoff: the toxic-all-fields fake cannot reflect a credential,
-but the list identifies accounts by stable ids rather than email addresses.
-
-P2 join remains provisional until P2 lands and this branch rebases. Current
-runtime seam projects model status metadata by business and does not read key
-files. New refusal tests for priority-unconfirmed (read-back mismatch) and
-priority-write-refused (PATCH other than200) are written FIRST; their source fixes
-await the next authorized first RED run. Provider config read-only auth_index
-must not be echoed in a config write; its preservation test is also pending.
-
-Sage sage-4394 explicitly authorizes committing/pushing incremental candidate
-commits before GREEN on poe/row330; refactor landing remains gated on all green
-checks and reviews. No candidate commit is a verification/completion claim.
-
-## Prepared next slot (not run)
-
-Sage sage-4400 accepts the two priority paths. New code-specific first-RED tests
-are in proxy-page-accounts.test.mjs for priority-unconfirmed and
-priority-write-refused. This file must run first, then those source fixes may
-be written; no assertion is loosened. No second RED has occurred.
-
-Focused list is eight whole files in focused-run-list.txt, generated by esbuild's
-import parser (focused-import-graph.json). Additional tests exercise actual
-Chromium UI behavior and the parsed Console import boundary. The canary now
-intercepts process stdout/stderr during the API-key operation, as well as
-structured HTTP/client logs and durable bus files. Deliberate log mutants cannot
-print their made-up key. Four slot-only named mutants are prepared in mutants.mjs;
-no mutant has executed. The upgrade check is prepared in acceptance.sh/mjs;
-it has not run. New refusal source fixes remain pending first RED.
-
-Broader import inventory: gate-imports.mjs statically parses package test imports,
-traces paths to changed production modules, and adds all mandatory model-proxy,
-bus and webui test files. Exact paths are gate-run-list.txt; summary includes
-additional collateral files. case1-accept.test.mjs is explicitly excluded even
-if imported, per mos-1612. No text search of fixture payloads selects a run.
-Webui's eventual full gate requires editor build and MOSAIC_REQUIRE_EDITOR_BUILD=1.
-These inventory commands parse source only; they do not import/execute tests.
-
-Sage-authorized incremental candidate40dcbabcb pushed successfully to poe/row330.
-No PR or review request yet, no refactor modification/push, no live change.
-
-2026-10-24T04:42Z refactor input check requested by sage-4411:
-`git diff --name-only 78b69e1e6 775bbe236` names45 paths; intersection with
-focused-import-graph.json's111 parsed inputs is empty. Exact receipts:
-refactor-775bbe236-paths.txt and refactor-775bbe236-input-check.json.
-
-Correction to the shorthand report poe-330-0011: the generated broader inventory
-contains280 selected files, not281. Mandatory199 (model-proxy/bus/webui), plus81
-additional import dependents. case1-accept remains excluded. Preserve the exact
-list, not the mistaken shorthand count. The large full graph is kept off Git;
-gate-import-summary.json cites its scratch path and SHA256. A compact per-file
-import witness and the reproducible parser script land instead.
-
-Sage sage-4411 accepts first-RED account test → source fix → eight focused whole
-files → offline acceptance → four mutants. No CLEAR yet: slot order is Bubba288,
-Magica331 GREEN, then this block. Full gate follows P2 landing/rebase/key join.
-
-## Focused block sage-4430 — stopped at offline acceptance failure
-
-2026-10-25T05:39Z precheck on candidate48c7c3283:
-`git diff --name-only 78b69e1e6 e1d8756b5` names47 paths; none overlaps the111
-focused parsed inputs. refactor-e1d8756b5-input-check.json records the check.
-
-First RED of proxy-page-accounts.test.mjs:6pass/4expected failures, rc1. Failed
-API priority write included derived auth_index; mismatch refusal was proxy-down;
-PATCH201 and400 refusals were proxy-down. Receipt red-accounts.txt.
-
-Source fix only, no test edits: remove derived auth_index from provider config
-writes; require exactly200 for priority PATCH/PUT; preserve priority-write-refused
-for refused/redirected writes and priority-unconfirmed for a mismatching read-back.
-Console forwards those safe refusal codes. No raw errors/keys introduced.
-
-Eight focused whole files then passed88/88 with0skip, serialized, absolute paths,
-one shell-created short TMPDIR per run. Every shell wrapper recorded nice19:
-page-client3; broker41; state17; accounts10; webui HTTP11; canary2; browser3;
-architecture1. Receipts green-*.txt. These are focused checks, not full suites
-or landing evidence. No old test file ran and no assertion/timeout changed.
-
-Offline acceptance.sh on the same own PIN8.0.42 fetched executable exited1.
-Raw receipt upgrade-8.0.42.txt is only:
-
-    P4 offline upgrade version=8.0.42 nice=16
-    P4 upgrade FAILED code=acceptance-failed
-
-This was the FIRST unexpected red. It occurred before the initial empty-accounts
-checkpoint. The catch intentionally strips exception detail, so the failed
-assertion/location is not known. Node reported16 despite the absolute19 shell
-wrapper; no claim that the binary acceptance ran at19. The private namespace
-child was stopped and the shell trap deleted its own fixture root as designed.
-No host proxy, real key or real data root was involved.
-
-Stopped immediately and reported poe-330-0014 to Sage; slot returned for
-Magica331r2. No rerun, post-failure source fix, test edit or timeout change.
-Four mutants were NOT RUN. Before this failure, their runner was prepared to
-restore each source and run its whole-file positive control at nice19.
-Next acceptance diagnosis needs Sage's ruling/CLEAR. Full suites, P2 rebase/key
-join, mutants and Gladstone/Filbert reviews remain outstanding.
-
-## Diagnostic-only preparation — sage-4432
-
-2026-10-25T05:45Z. Prepared a separate acceptance.mjs diagnostic, with no run:
-fixed stage labels binary-start, management-ready, store-open, broker-bound,
-initial-accounts; observed Node/own fixture-child priorities; whitelisted last
-management client failure code; child exit code/signal; sanitized catch class/code.
-No exception message, actual/expected, request/response body, URL or key is printed.
-A child-exit observation reads no priority once that child is known to have exited.
-
-No priority setter was added. The shell wrapper and every assertion, retry count,
-pause and timeout remain unchanged, as required to repeat the failed conditions.
-Static comparison confirms assertion lines and timeout expressions unchanged;
-git diff --check passes. No acceptance, test, proxy binary or mutant executed.
-This is a diagnostic commit only, not a product fix. Slot remains with Sage;
-next run waits for CLEAR after288 gate rerun and Magica331r2. The full focused /
-acceptance / mutant block after diagnosis still requires Sage's CLEAR.
-
-## Scheduling observation preparation — sage-4438 / mos-1675
-
-2026-10-25T06:09Z. Slot order changed: Magica331r2, Sage's short288 diagnostic,
-then this row's diagnostic; wait for Sage CLEAR. Added only numeric scheduling
-policy observations from /proc/<own Node pid>/sched and the still-live fixture
-child's sched file. No raw proc content, other process, scheduling setter or
-host configuration access/change. Diagnostic module not executed.
-
-Context supplied by Sage (not independently measured here): ananicy-cpp's node
-rule assigns BG_CPUIO (nice16, sched idle, ioclass idle), and bash's Doc-View rule
-sets nice-4. Sage reports local ASR/ffmpeg load05:41–05:50Z overlapping the failed
-acceptance. These facts explain why a launch wrapper's19 is insufficient proof
-of the Node process's later policy. Causation of the acceptance failure remains
-unestablished until the authorized stage diagnostic. No assertion, timeout,
-product code, fixture condition or priority/policy setter changed.
-
-## One diagnostic reproduction — sage-4440 CLEAR
-
-2026-10-25T06:14:19Z–06:14:23Z. Ran acceptance.sh exactly once on unchanged
-candidatea5251007b, with no source/assertion/timeout/priority edits in the slot.
-Start uptime/load:11 days16:34,2.90/5.40/9.26. End:11 days16:34,3.15/5.41/9.24.
-Receipts diagnostic-start-uptime.txt, diagnostic-8.0.42.txt and
-diagnostic-end-uptime.txt preserve exact output.
-
-Reproduced rc1. Reached binary-start, management-ready, store-open, then:
-{stage:store-open,errorClass:Error,code:acceptance-failed}. Did not reach
-broker-bound or initial-accounts. Store-open is observed AFTER Store construction;
-remaining interval includes ProxyPage/Broker construction and human binding.
-No failed assertion location or root cause is claimed from the sanitized code.
-Readiness succeeded. lastClientErrorCode proxy-client-down records an earlier
-transient startup refusal, not a readiness failure.
-
-Node and the live fixture child both observed nice16 and numeric scheduling
-policy5 at all checkpoints. This establishes scheduling conditions, not cause.
-Cleanup observed fixture child exit0 with no signal; its private temp root was
-removed by the existing trap. No live proxy/key/data access occurred.
-
-Stopped after that one run and reported poe-330-0019; SLOT BACK to Sage for288
-whole-gate rerun, then Magica331r3. No focused suites, mutants or second diagnostic.
-No product or diagnostic source change after this result. Receipt-only commit
-follows outside the returned slot; next investigative step awaits Sage's ruling.
-
-## Source-established fixture correction — sage-4442 option1
-
-2026-10-25T06:16Z, source reading only, no run. Root cause: acceptance.mjs:74
-(at9e94575c5) passes path.join(root,'bus') to new Store. Fixture preparation at
-:24–:27 creates root/proxy/auth, root/home and config.yaml, but no root/bus.
-packages/bus/src/store.mjs:163 immediately lstatSync(dataRoot), requiring an
-existing directory; :166 then creates its OWN bus child. Thus this acceptance
-passes a nonexistent data root and gets filesystem ENOENT before Store can open.
-ENOENT was not in the diagnostic allowlist and was sanitized to acceptance-failed.
-The smallest fix is new Store(root), the existing fresh fixture data root,
-matching the focused fixtures. No production behavior or authority changes.
-
-Correction to poe-330-0019 and the prior diagnostic interpretation: the
-store-open observation does NOT prove successful Store construction. observe()
-in the catch emits the same stage, so the observed line can be the catch's line.
-The successful management-ready checkpoint remains valid; there was no later
-broker-bound. Our earlier post-Store inference was wrong. Source resolves this
-without another diagnostic: the missing fixture directory explains the precise
-failure and its sanitized Error/code independently of scheduling/load.
-
-Also read ProxyPage constructor validation (:27–:30), Broker business validation
-(:373–:389, :558), and bindHuman (:1482–:1487). The page settings, business id/
-human/authority/arbiters and the CLI/outsideAgent:true record meet those checks.
-No human-boundary workaround is needed or made.
-
-Prepared a separate single-line acceptance fixture fix, plus this append-only
-explanation. No assertion, timeout, diagnostic extension, product change or
-priority/policy setter. No diagnostic, acceptance, test or mutant execution;
-next run waits for Sage CLEAR after the288 gate.
-
-## Full focused block retry — sage-4446 CLEAR, stopped at initial accounts
-
-2026-10-25T06:41Z–06:42Z on unchanged69811540c. All eight focused files ran
-whole, serialized with fresh short TMPDIR and absolute nice19 wrappers;88/88
-passed,0skip. Each step has UTC timestamp and uptime start/end in
-block2-<test-path>.txt.start/.end, with complete test receipt block2-*.txt.
-No old test file, assertion edit or timeout change.
-
-Offline acceptance started06:42:18Z and ended06:42:22Z, uptime11days17:02,
-load5.98/15.98/16.44 both endpoints. Reached management-ready, store-open,
-broker-bound, then initial-accounts. Failed rc1 with code proxy-down,
-errorClass Error, before the initial-empty assertion checkpoint. Thus the
-previous missing Store root failure is traversed, but the native account-list
-boundary now refuses. No root-cause inference or source fix yet.
-
-Node observed nice19/policy0 through the initial-accounts entry, and nice16/
-policy5 at the failure. Fixture child observed nice19/policy0 until cleanup,
-then cleanexit0 with no signal. Idle scheduling is accepted under mos-1678;
-these observations do not establish a scheduling cause. The remembered
-proxy-client-down remains the earlier transient readiness failure.
-
-Stopped at this FIRST unexpected red and reported poe-330-0022, SLOT BACK for
-Magica331r3. No acceptance rerun, focused-file retry, product/fixture edit or
-mutant execution. New receipt block2-acceptance.txt preserves sanitized output;
-private fixture root removed by the existing trap. Receipt-only commit follows;
-next step requires Sage's ruling/CLEAR. Full gate/P2 join/reviews still pending.
-
-## Empty-provider source reading and diagnostic — sage-4448/4451/4452
-
-2026-10-25T06:47Z, no run. Available committed upstream reference is8.0.27,
-not a pinned8.0.42 implementation source. management-api-v8.0.27.md:25–27 says
-GET does not add omitted runtime defaults; it does not specify the HTTP status
-or body shape for a missing provider group. P1 and our previous probes measured
-provider GET only after adding a group. Baseline-empty shape remains unproven.
-
-page-client.test.mjs:7–14 defaults to200/{status:ok}, but no case calls
-getUpstreamGroups. The actual accounts fake proxy-page-fixture.mjs:7,:18–19
-returns200/[] for no groups. If the real binary returns another valid shape,
-client.mjs/proxy-page.mjs has a product contract finding, not a fixture bug.
-Reported to Sage before making this diagnostic; no product fix is assumed.
-
-Prepared a separate diagnostic-only change: immediately before initial account
-assertion, call client.getUpstreamGroups once directly and print only HTTP
-status, type, array flag and count (array length or object top-level key count).
-Per narrower sage-4452/mos-1683 it prints NO key names and NO values. Null is
-reported as type null/count0; no response body is printed. On client error only
-a fixed allowlisted client code is printed, never a raw error/message/body.
-Status comes from the existing safe management receipt, not another request.
-
-No assertions, timeouts, retries, scheduling settings, product source or test
-fixtures changed. No module/test/binary/diagnostic executed. Wait for Sage's
-review and CLEAR after the288 processing diagnostic before one acceptance run.
-
-2026-10-25T06:49Z sage-4454 review addition: diagnostic error output now includes
-httpStatus from the same existing receipt written by ManagementClient finally,
-using the identical receipt-count guard as success. No new request or raw
-exception data; this distinguishes404 from5xx without names or values. Separate
-one-line diagnostic commit, no module/test/binary execution. Hold for CLEAR after
-Sage's288 processing pair; no independent load-based run decision.
-
-## Empty-provider diagnostic result — sage-4458 CLEAR
-
-2026-10-25T07:32:25Z–07:32:30Z, exactly one acceptance diagnostic on unchanged
-f2986b9ea. Start load52.34/45.27/29.51; end51.91/45.30/29.60. Reached the target
-under this unusually high load; Node and fixture child nice16/policy5. Allowed
-empty-provider output: {httpStatus:404,code:proxy-client-refused}. No response
-body or key names/values were parsed/printed on that error path. Management
-readiness succeeded; broker binding succeeded; subsequent proxy.accounts refused
-proxy-down at initial-accounts. Fixture child cleanup exit0, no signal.
-
-This proves the product's fresh-provider contract mismatch: same pinned8.0.42
-route returns404 before any Claude provider group is configured, while earlier
-probe/probe2 receipts prove200/array after a group is added. Our accounts fake
-returns200/[] before configuration. This is not another acceptance fixture bug.
-
-Stopped, reported poe-330-0027 and returned SLOT BACK for Magica331r4. No retry,
-focused file, mutant, scheduling change, product/test/assertion/timeout edit.
-Receipts empty-provider-diagnostic.txt and .start/.end preserve the single run.
-
-## Proposed product diff — NOT APPLIED, review before edits
-
-proposed-empty-provider.patch gives the exact proposed source change: in the
-management client's fixed page operation, normalize404 to[] ONLY for
-GET /v8/management/config/api-keys/claude. Keep the actual404 receipt. Every other
-endpoint, method and status keeps existing errors; no broad error-to-empty fall
-back. The page then renders no accounts and can add the first z.ai group.
-This introduces no new refusal code or public schema/policy change.
-
-Proposed verification, awaiting Sage: write a new client RED test for this exact
-404 normalization before applying the patch; prove credentials/key-list404 and
-provider401/403/500 remain proxy-client-refused without retry; prove200/array
-passes through. Add account-level cases for fresh404 -> empty accounts -> first
-key add, with no key in responses/receipts; malformed200 null/object still
-refuses proxy-down. Existing assertion strength stays intact. Update the
-stand-in's empty-route option only to model the observed contract; no fake can
-silently turn unknown failures into empty data. Run lists/CLEAR precede tests.
-
-No product or test changed in this receipt/proposal commit. Proposed patch is
-review material, not a fix claim or a substitute for RED/GREEN/upgrade evidence.
-
-## Regression preparation — sage-4460, no Node execution
-
-2026-10-25T07:38Z. Authored11 cases in two new whole test files:
-packages/model-proxy/tests/empty-provider.test.mjs (8): exact fixed GET404 ->[],
-actual404 receipt/discarded canary body/one request; credentials404 and key-list404
-remain proxy-client-refused; provider401/403/500 remain proxy-client-refused;
-providerPUT404 remains proxy-client-refused (exercises GET-only guard);200 array
-passes through. Every case pins exactly one call and status receipt, no retry,
-no response-body/management-key leakage into receipts or error output.
-packages/bus/tests/proxy-page-empty-provider.test.mjs (3): fresh404 empty account
-list followed by one first-key PUT and a public safe account; malformed200 null
-and object each refuse existing proxy-down with no write/retry.
-
-Stand-in addition only: optional emptyProviderResponse controls the empty-route
-status/body for these new cases. Existing fake baseline and every old assertion
-and timeout remain unchanged. Imports are declared directly to ManagementClient
-and the existing management fixture (which imports ProxyPage/client). Static
-single-line import declarations are recorded in empty-provider-prepared-imports
-and rooted in the prior esbuild graph; no fixture-text search selects tests.
-Exact initial RED list: empty-provider-red-run-list.txt. Prepared source/test/patch
-hashes: empty-provider-prepared-MANIFEST.sha256. Product files remain unmodified;
-proposed-empty-provider.patch is still NOT APPLIED.
-
-Expected first RED: new exact404 client case rejects proxy-client-refused instead
-of returning[]; new fresh account case rejects proxy-down before add. No new
-refusal code; all negative cases preserve existing named refusals. Observe this
-RED under the next CLEAR before applying the approved scoped source patch.
-Required later GREEN should include both new whole files and the8 focused whole
-files because the helper is shared; full gate and P2 key-join still wait their
-separate authorized stage. No Node syntax check, test, acceptance, mutant or
-proxy process ran during preparation. Slot remains with Magica331r4.
-
-## Test-first404 block — sage-4469 CLEAR
-
-2026-10-25T07:46Z–07:47Z. On prepared e7438743f, unchanged product RED was
-exactly the two intended failures: model-proxy empty-provider8cases7pass/1fail
-(proxy-client-refused rather than[]), bus empty-provider3cases2pass/1fail
-(proxy-down on fresh accounts). Negative controls all passed; no skipped,
-cancelled or timed-out case. Receipts404-red-*.txt plus per-file uptime.start/.end.
-
-Applied ONLY the approved proposed-empty-provider.patch: three lines in the
-client's #page catch normalize404 only for the fixed GET provider-config path.
-Actual404 receipt remains; error body was discarded by #request. No assertion,
-timeout, scheduling, public schema, other product file or refusal code changed.
-
-GREEN: both new files and the existing8focused files whole, serialized,99/99
-passes,0skip/cancel. Fresh short TMPDIR per file; shell wrappers requested and
-recorded nice19. No automatic retry. Receipts404-green-*.txt and each file's
-UTC/uptime start/end. Idle scheduling is accepted under mos-1678/sage-4446.
-
-Pinned8.0.42 acceptance rc0,07:46:54Z–07:47:01Z. Load13.49/14.18/20.53 ->
-13.77/14.23/20.51. Node and its fixture child observed nice16/policy5. Exact
-safe output is copied below from404-acceptance.txt; private namespace/temp-root
-cleanup completed with childexit0. No real provider credential or external
-upstream request; the made-up OAuth codes never complete sign-in.
-
-P4 offline upgrade version=8.0.42 nice=16
-P4 diagnostic {"stage":"binary-start","nodePriority":16,"childPriority":16,"lastClientErrorCode":null,"nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"management-ready","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"store-open","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"broker-bound","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 empty-provider diagnostic {"httpStatus":404,"type":"object","isArray":true,"count":0}
-proxy.accounts initial empty; GET /credentials + GET /config/api-keys/claude
-proxy.login.start claude GET /oauth/auth-url; fields=url,state only
-proxy.login.submit POST /oauth/callback; fake code never ok; GET /oauth/status=wait
-proxy.login.cancel DELETE /oauth/session confirmed
-proxy.login.start codex GET /oauth/auth-url; fields=url,state only
-proxy.login.submit POST /oauth/callback; fake code never ok; GET /oauth/status=wait
-proxy.login.cancel DELETE /oauth/session confirmed
-proxy.apikey.add PUT /config/api-keys/claude; account fields=accountId,provider,displayName,status,priority; id from auth_index
-proxy.priority.set API-key PUT /config/api-keys/claude; priority read-back=7
-proxy.keys GET /config/access/api-keys; fields=keyId,management,agent,issuedAt,state; sentinel labelled; values absent
-proxy.priority.set OAuth PATCH /credentials/fields body={name,priority}; priority read-back=8
-PASS offline native-page bus contract and secret-free receipts
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":null,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":null,"childExitCode":0,"childSignal":null}
-
-Named mutants rc0 overall,07:47:50Z–07:47:52Z, load9.43/13.06/19.79 at both
-endpoints. Each mutated whole file ran once, was restored byte-for-byte, then
-its restored positive control ran once before the next mutant:
- accounts-unfiltered-field:2fail, restored control10pass;
- callback-skips-state:2fail, restored control17pass;
- proxy-route-accepts-granted-user:1fail, restored control11pass;
- apikey-logged:1fail, restored control2pass.
-Runner records nice19 launch observations and original source SHA256s. All4
-killed, all4 restored, all4 controls green. No raw mutant output/key values
-were written; canary captures process output. Receipt404-mutants.txt/.start/.end.
-
-SLOT BACK reported to Sage as poe-330-0030. No unexpected result in this block,
-no retry, no old assertion or timeout edits, no protected action. This is scoped
-99-test/upgrade/mutant evidence, NOT the full package/global landing gate. P2
-landing/rebase/key-record join and Q246 independent review remain outstanding.
-Final product/test diff and manifest prepared for independent review; no landing
-or refactor push authorized. No further test/process run after returning slot.
-
-2026-10-25T07:56Z sage-4473 verified Gladstone exact thread
-433058fc-9cea-46e3-8554-6ddefb312762 (roster433058fc). Direct planned-seat
-read-only first Codex review handoff delivered as poe-330-0032 for frozen
-candidateb47ee2c0ef6580175e8fdd617878c4644861350e. Full24path diff, exact3line404
-regression,74hashmanifest, scoped99/acceptance/mutant receipts, and P2/globalgate
-limitations included. Explicitly no duplicate test/proxy run, private/live
-worktree/transcript access or landing claim. Sage copied as poe-330-0033.
-This is not a delegated child review round. Filbert landing review and required
-fresh Claude guard/security review remain separate/pending. No new run or
-product/test change. Frozen review source/manifest unchanged by this log append.
-
-## First independent Codex review — Gladstone gladstone-0028
-
-2026-10-25T07:57:51Z verdict received for frozen
-b47ee2c0ef6580175e8fdd617878c4644861350e versus78b69e1e6: scoped PASS, no blocking
-findings in the full24path product/test/docs diff. Reviewer independently
-verified74/74 hashes from committed blobs and packet diff equality to actual
-git diff; reviewed brief/design/gates and supplied99/upgrade/mutant receipts.
-No reviewer test, acceptance, mutant, proxy/provider execution, live credential
-access or repository writes. Queue next refused the linked worktree; reviewer
-did not work around it or claim queue/global readiness. Sage already received
-the detailed verdict under gladstone-0028.
-
-Owner static check: package diff b47ee2c0e..current HEAD is empty; only tracking
-notes have advanced. No finding requires a product change, and no new run is
-launched. This first read-only Codex PASS does NOT waive P2 rebase/key-record
-join (runtime projection still provisional), required whole package/editor/
-collateral/global gate checks, Filbert landing review, or required fresh Claude
-guard/security review. Those remain distinct and pending. No landing authority.
@@ -1,49 +0,0 @@
-# Row330 / P4 review packet — #1828
-
-Owner Poe; first independent Codex review Gladstone; landing review Filbert.
-Brief docs/plans/2026-10-24_proxy-page-brief.md (heading17, blob4c005dc4936c).
-Original base78b69e1e6. Candidate branch poe/row330. No landing authority.
-
-## Review scope and evidence
-
-review-product-test.diff is the complete changed packages/ source/test/docs diff
-from78b69e1e6. review-404-normalization.diff is the exact latest three-line product
-fix against prepared e7438743f; its tests/helper were committed first there.
-review-MANIFEST.sha256 pins every changed package file and the current offline
-acceptance/mutant scripts, diff artifacts, run list and successful scoped receipts.
-BUILD.md preserves all earlier failures and corrections append-only.
-
-Current scoped verification: exact intended RED2fail/9pass, then99/99 focused
-GREEN, pinned8.0.42 offline bus acceptance, four named mutants killed with four
-restored positive controls (10/17/11/2passes). Whole-file receipts and uptime
-are404-*.txt/.start/.end. Actual idle scheduling is reported, not overwritten.
-No test reruns after an unexpected outcome. Earlier fixture-root and missing
-provider404 findings are separate commits; product normalization is exactly
-GET /v8/management/config/api-keys/claude HTTP404 ->[], with original404 receipt.
-Every other endpoint/method/status still refuses, malformed200 null/object still
-refuses proxy-down; no new refusal code, assertion weakening or timeout change.
-
-## Security focus
-
- Owner human-only broker gate before generic user/tester handling; all8verbs.
- Native /proxy and /api/proxy routes through fixed Console caller allowlist;
-  writes require signed-in owner, named host, --send, own Origin and Fetch
-  Metadata. Granted/tester/loopback callers refuse. No webui management client.
- API-key input is write-only, promptly cleared, no browser storage; management
-  header only numeric loopback. OAuth pending-state ownership/expiry/finish
-  guards, no wait-to-success shortcut. Unknown errors are sanitized.
- Accounts project exactly5public fields. Stable generated display names avoid
-  arbitrary upstream credential strings; ids derive from proxy identifiers,
-  never token/key values. Client keys return ids and management labels only.
- Canary checks HTTP responses, structured logs/receipts, captured process output
-  and bus files; fake receives first key once. No real host proxy/credential access.
-
-## Explicit outstanding work / review limits
-
-P2 has not yet been rebased/joined into this branch. Runtime key-status projection
-is provisional until the actual P2 metadata contract lands. Broad package suites
-(model-proxy/bus/webui, webui requiring editor build), collateral import-derived
-files and Sage's global landing gate still need authorized execution after that
-integration. The prior broader inventory is not a current post-P2 manifest.
-Independent Q246 first/landing verdicts are not claimed. Do not treat this packet
-or the scoped checks as approval to land, push refactor, deploy or cut over.
@@ -1,157 +0,0 @@
-// Offline upgrade contract: real bus verbs, pinned proxy, no real credentials.
-import fs from 'node:fs';
-import path from 'node:path';
-import net from 'node:net';
-import assert from 'node:assert/strict';
-import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { getPriority } from 'node:os';
-import { initialConfig } from '../../../../packages/model-proxy/src/settings.mjs';
-import { PIN } from '../../../../packages/model-proxy/src/common.mjs';
-import { ManagementClient } from '../../../../packages/model-proxy/src/client.mjs';
-import { ProxyPage } from '../../../../packages/bus/src/proxy-page.mjs';
-import { Broker } from '../../../../packages/bus/src/broker.mjs';
-import { Store } from '../../../../packages/bus/src/store.mjs';
-const [root, binary] = process.argv.slice(2);
-if (process.env.P4_UPGRADE_ISOLATED !== 'yes' || !root?.startsWith('/mnt/storage/scratch/tmp/')) throw Error('wrapper required');
-if (createHash('sha256').update(fs.readFileSync(binary)).digest('hex') !== PIN.binary.sha256) throw Error('binary does not match PIN');
-const reserve = net.createServer(); await new Promise(r => reserve.listen(0, '127.0.0.1', r));
-const port = reserve.address().port; await new Promise(r => reserve.close(r));
-if (port === 8317) throw Error('forbidden port');
-const management = 'p4-management', canary = 'p4-upstream';
-const config = initialConfig({ dataRoot: root, port, key: management, sentinel: 'msk-fixture-sentinel-x' });
-config.management['disable-control-panel'] = true; config.observability.logs['logging-to-file'] = false;
-fs.mkdirSync(path.join(root, 'proxy/auth'), { recursive: true, mode: 0o700 });
-fs.mkdirSync(path.join(root, 'home'));
-fs.writeFileSync(path.join(root, 'config.yaml'), JSON.stringify(config), { mode: 0o600 });
-const child = spawn(binary, ['-config', path.join(root, 'config.yaml'), '-local-model'], {
-  cwd: root, env: { HOME: path.join(root, 'home'), PATH: '/usr/bin:/bin' }, stdio: 'ignore',
-});
-// Diagnostic-only (sage-4432): observe the same run conditions, never change
-// priority or print exception values, fixture credentials or upstream content.
-let stage = 'binary-start', lastClientErrorCode = null;
-const clientErrorCodes = ['proxy-client-down', 'proxy-client-response', 'proxy-client-refused',
-  'proxy-client-redirect', 'proxy-client-invalid'];
-const errorCodes = [...clientErrorCodes, 'ERR_ASSERTION', 'ERR_SQLITE_ERROR', 'SQLITE_ERROR',
-  'proxy-down', 'not-configured', 'human-required', 'invalid-request', 'invalid-business',
-  'priority-invalid', 'priority-unconfirmed', 'priority-write-refused', 'login-state-unknown'];
-function schedulingPolicy(pid) {
-  try {
-    // Only our Node process or the still-live child we spawned. Never print
-    // raw /proc content; retain just Linux's numeric scheduling-policy field.
-    const policy = fs.readFileSync(`/proc/${pid}/sched`, 'utf8').match(/^policy\s*:\s*(\d+)\s*$/m)?.[1];
-    return policy === undefined ? null : Number(policy);
-  } catch { return null; }
-}
-function observe() {
-  let nodePriority = null, childPriority = null, childSchedulingPolicy = null;
-  try { nodePriority = getPriority(); } catch {}
-  if (Number.isInteger(child.pid) && child.exitCode === null && child.signalCode === null) {
-    try { childPriority = getPriority(child.pid); } catch {}
-    childSchedulingPolicy = schedulingPolicy(child.pid);
-  }
-  console.log('P4 diagnostic ' + JSON.stringify({ stage, nodePriority, childPriority, lastClientErrorCode,
-    nodeSchedulingPolicy: schedulingPolicy(process.pid), childSchedulingPolicy,
-    childExitCode: Number.isInteger(child.exitCode) ? child.exitCode : null,
-    childSignal: /^SIG[A-Z0-9]{1,16}$/.test(child.signalCode ?? '') ? child.signalCode : null }));
-}
-child.once('exit', observe);
-let store;
-const pause = ms => new Promise(r => setTimeout(r, ms));
-const receipts = [], answers = [];
-const client = new ManagementClient({ baseUrl: `http://127.0.0.1:${port}`, key: management, receipt: r => receipts.push(r) });
-try {
-  console.log('P4 offline upgrade version=' + PIN.version + ' nice=' + getPriority());
-  observe();
-  let ready = false;
-  for (let n = 0; n < 100; n++) {
-    try { await client.getCredentials(); ready = true; break; }
-    catch (error) { lastClientErrorCode = clientErrorCodes.includes(error.code) ? error.code : 'unclassified'; await pause(50); }
-  }
-  assert.equal(ready, true, 'fixture listener starts');
-  stage = 'management-ready'; observe();
-  stage = 'store-open';
-  store = new Store(root);
-  observe();
-  const page = new ProxyPage({ client, instanceTag: 'fixture' });
-  const broker = new Broker({ store, proxyPage: (...args) => page.request(...args), businesses: {
-    demo: { id: 'demo', human: 'owner', roles: { coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'coder', delivery: 'coder' } },
-  } });
-  const cap = broker.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true });
-  stage = 'broker-bound'; observe();
-  const call = async (verb, args = {}) => { const answer = await broker.request(cap, { verb, args }); answers.push(answer); return answer; };
-  stage = 'initial-accounts'; observe();
-  // Diagnostic-only (sage-4448/4452, mos-1683): one direct empty-provider
-  // read, types/counts only. Never print field names, values or error text.
-  const receiptCount = receipts.length;
-  try {
-    const groups = await client.getUpstreamGroups();
-    const isArray = Array.isArray(groups);
-    console.log('P4 empty-provider diagnostic ' + JSON.stringify({
-      httpStatus: receipts.length === receiptCount + 1 ? receipts.at(-1).status : null,
-      type: groups === null ? 'null' : typeof groups, isArray,
-      count: isArray ? groups.length : groups !== null && typeof groups === 'object' ? Object.keys(groups).length : 0,
-    }));
-  } catch (error) {
-    console.log('P4 empty-provider diagnostic ' + JSON.stringify({
-      httpStatus: receipts.length === receiptCount + 1 ? receipts.at(-1).status : null,
-      code: clientErrorCodes.includes(error.code) ? error.code : 'proxy-client-error',
-    }));
-  }
-  assert.deepEqual((await call('proxy.accounts')).accounts, []);
-  console.log('proxy.accounts initial empty; GET /credentials + GET /config/api-keys/claude');
-  for (const provider of ['claude', 'codex']) {
-    const login = await call('proxy.login.start', { provider });
-    assert.equal(typeof login.url, 'string'); assert.equal(typeof login.state, 'string');
-    console.log('proxy.login.start ' + provider + ' GET /oauth/auth-url; fields=url,state only');
-    const redirect = provider === 'claude' ? 'http://localhost:54545/callback' : 'http://localhost:1455/auth/callback';
-    const submitted = await call('proxy.login.submit', { redirect_url: redirect + '?state=' + encodeURIComponent(login.state) + '&code=p4-fake-code' });
-    assert.notEqual(submitted.status, 'ok');
-    const status = await call('proxy.login.status', { state: login.state });
-    assert.notEqual(status.status, 'ok');
-    console.log('proxy.login.submit POST /oauth/callback; fake code never ok; GET /oauth/status=' + status.status);
-    if (status.status === 'wait') {
-      assert.equal((await call('proxy.login.cancel', { state: login.state })).status, 'cancelled');
-      console.log('proxy.login.cancel DELETE /oauth/session confirmed');
-    }
-  }
-  await call('proxy.apikey.add', { provider: 'z.ai', key: canary }); await pause(200);
-  const accounts = (await call('proxy.accounts')).accounts;
-  assert.equal(accounts.length, 1); assert.equal(accounts[0].provider, 'z.ai');
-  assert.deepEqual(Object.keys(accounts[0]).sort(), ['accountId', 'displayName', 'priority', 'provider', 'status']);
-  console.log('proxy.apikey.add PUT /config/api-keys/claude; account fields=accountId,provider,displayName,status,priority; id from auth_index');
-  await call('proxy.priority.set', { accountId: accounts[0].accountId, priority: 7 });
-  assert.equal((await call('proxy.accounts')).accounts[0].priority, 7);
-  console.log('proxy.priority.set API-key PUT /config/api-keys/claude; priority read-back=7');
-  const keys = await call('proxy.keys');
-  assert.equal(keys.keys.length, 1); assert.equal(keys.keys[0].management, 'sentinel'); assert.match(keys.keys[0].keyId, /^[a-f0-9]{12}$/);
-  console.log('proxy.keys GET /config/access/api-keys; fields=keyId,management,agent,issuedAt,state; sentinel labelled; values absent');
-  // Fixture-only upload exercises the OAuth priority API relied on by the page.
-  const uploaded = await fetch(`http://127.0.0.1:${port}/v8/management/credentials?name=p4-fixture.json`, {
-    method: 'POST', headers: { Authorization: `Bearer ${management}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ type: 'claude', access_token: 'p4-access', refresh_token: 'p4-refresh', expired: '2099-01-01T00:00:00Z' }),
-    signal: AbortSignal.timeout(5000), redirect: 'error',
-  });
-  assert.equal(uploaded.status, 200); await uploaded.body?.cancel(); await pause(200);
-  const oauth = (await call('proxy.accounts')).accounts.find(a => a.provider === 'claude');
-  assert.ok(oauth);
-  await call('proxy.priority.set', { accountId: oauth.accountId, priority: 8 });
-  assert.equal((await call('proxy.accounts')).accounts.find(a => a.accountId === oauth.accountId).priority, 8);
-  console.log('proxy.priority.set OAuth PATCH /credentials/fields body={name,priority}; priority read-back=8');
-  for (const value of [canary, management, 'p4-access', 'p4-refresh', 'p4-fake-code']) {
-    assert.equal(JSON.stringify(receipts).includes(value), false, 'secret absent from receipts');
-    assert.equal(JSON.stringify(store.all('SELECT body FROM events')).includes(value), false, 'secret absent from bus events');
-    assert.equal(JSON.stringify(answers).includes(value), false, 'credential/code absent from bus replies');
-  }
-  console.log('PASS offline native-page bus contract and secret-free receipts');
-} catch (error) {
-  // Never print assertion actual/expected values or a raw upstream exception.
-  observe();
-  const errorClass = ['Error', 'AssertionError', 'ProxyError', 'BusError', 'TypeError', 'RangeError'].includes(error.name) ? error.name : 'Error';
-  console.error('P4 upgrade FAILED ' + JSON.stringify({ stage, errorClass,
-    code: errorCodes.includes(error.code) ? error.code : 'acceptance-failed' }));
-  process.exitCode = 1;
-} finally {
-  store?.close(); child.kill('SIGTERM');
-  await Promise.race([new Promise(r => child.once('exit', r)), pause(3000).then(() => child.kill('SIGKILL'))]);
-}
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-# P4 PIN upgrade acceptance; outside scripts/test-*.sh, requires Sage's slot.
-set -euo pipefail
-HERE=$(cd "$(dirname "$0")" && pwd)
-BINARY=${1:?P1 verified fetched executable required}
-export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX)
-trap 'rm -rf -- "$TMPDIR"' EXIT
-timeout -k 10 120 nice -n $((19 - $(nice))) unshare -rn bash -c '
-  set -e
-  ip link set lo up
-  export P4_UPGRADE_ISOLATED=yes
-  exec node "$1/acceptance.mjs" "$TMPDIR" "$2"
-' bash "$HERE" "$BINARY"
@@ -1,2 +0,0 @@
-2026-10-25T06:42:22Z
- 01:42:22 up 11 days, 17:02,  2 users,  load average: 5.98, 15.98, 16.44
@@ -1,2 +0,0 @@
-2026-10-25T06:42:18Z
- 01:42:18 up 11 days, 17:02,  2 users,  load average: 5.98, 15.98, 16.44
@@ -1,9 +0,0 @@
-P4 offline upgrade version=8.0.42 nice=19
-P4 diagnostic {"stage":"binary-start","nodePriority":19,"childPriority":19,"lastClientErrorCode":null,"nodeSchedulingPolicy":0,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"management-ready","nodePriority":19,"childPriority":19,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":0,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"store-open","nodePriority":19,"childPriority":19,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":0,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"broker-bound","nodePriority":19,"childPriority":19,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":0,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":19,"childPriority":19,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":0,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":19,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":0,"childExitCode":null,"childSignal":null}
-P4 upgrade FAILED {"stage":"initial-accounts","errorClass":"Error","code":"proxy-down"}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":null,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":null,"childExitCode":0,"childSignal":null}
@@ -1,19 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/L2p5A3
-✔ accounts have exactly the allowlisted public fields, id from credential identifier (22.174496ms)
-✔ token-like data in every upstream field never reaches public accounts (4.314601ms)
-✔ API key account is derived from proxy auth_index, never api-key, and can set priority (9.723941ms)
-✔ OAuth priority uses top-level name/priority and confirms it through list (3.608642ms)
-✔ priority-unconfirmed: accepted API-key write with unchanged read-back refuses (3.746827ms)
-✔ priority-write-refused: OAuth PATCH status 201 (2.247959ms)
-✔ priority-write-refused: OAuth PATCH status 400 (2.965091ms)
-✔ priority-invalid: unknown account refuses before any write (1.743249ms)
-✔ proxy-down: a closed management listener refuses once (1.421441ms)
-✔ client keys return ids, sentinel/foreign labels and only scoped record metadata (2.327823ms)
-ℹ tests 10
-ℹ suites 0
-ℹ pass 10
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 143.18039
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,26 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/TEAh1u
-✔ proxy.login.start: provider-not-allowed (27.220361ms)
-✔ proxy.apikey.add: provider-not-allowed (0.344999ms)
-✔ apikey-invalid empty (0.294884ms)
-✔ apikey-invalid too long (0.274ms)
-✔ apikey-invalid charset (0.30855ms)
-✔ callback-url-invalid not URL (1.222458ms)
-✔ callback-url-invalid oversize (0.413224ms)
-✔ callback-url-invalid repeated state (0.285131ms)
-✔ login-state-unknown callback never reaches proxy (0.345734ms)
-✔ login state is scoped to the human and business (0.467282ms)
-✔ accepted callback wait is pending; only a status ok completes and retires state (0.843249ms)
-✔ expiry reports login-timeout once with no management call and retires state (0.267807ms)
-✔ cancel calls DELETE and retires state (0.258213ms)
-✔ upstream OAuth error body never crosses bus response (0.231392ms)
-✔ priority-invalid {"accountId":"bad","priority":1} (0.201431ms)
-✔ priority-invalid {"accountId":"aaaaaaaaaaaa","priority":1.5} (0.174276ms)
-✔ priority-invalid {"accountId":"aaaaaaaaaaaa","priority":1001} (0.170986ms)
-ℹ tests 17
-ℹ suites 0
-ℹ pass 17
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 106.766018
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,50 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/coQR8v
-✔ proxy.accounts: owner calls page once with business/human scope (19.314895ms)
-✔ proxy.accounts: tester human-required (14.382028ms)
-✔ proxy.accounts: agent human-required (13.366875ms)
-✔ proxy.accounts: user human-required (12.734936ms)
-✔ proxy.accounts: not-configured (13.206913ms)
-✔ proxy.login.start: owner calls page once with business/human scope (12.601593ms)
-✔ proxy.login.start: tester human-required (12.793022ms)
-✔ proxy.login.start: agent human-required (12.576573ms)
-✔ proxy.login.start: user human-required (13.04681ms)
-✔ proxy.login.start: not-configured (13.419448ms)
-✔ proxy.login.submit: owner calls page once with business/human scope (12.695382ms)
-✔ proxy.login.submit: tester human-required (13.507149ms)
-✔ proxy.login.submit: agent human-required (13.188966ms)
-✔ proxy.login.submit: user human-required (13.722535ms)
-✔ proxy.login.submit: not-configured (12.60293ms)
-✔ proxy.login.status: owner calls page once with business/human scope (12.159557ms)
-✔ proxy.login.status: tester human-required (12.884978ms)
-✔ proxy.login.status: agent human-required (13.227723ms)
-✔ proxy.login.status: user human-required (13.638448ms)
-✔ proxy.login.status: not-configured (13.288314ms)
-✔ proxy.login.cancel: owner calls page once with business/human scope (13.68684ms)
-✔ proxy.login.cancel: tester human-required (14.477894ms)
-✔ proxy.login.cancel: agent human-required (18.618454ms)
-✔ proxy.login.cancel: user human-required (15.764118ms)
-✔ proxy.login.cancel: not-configured (14.155249ms)
-✔ proxy.apikey.add: owner calls page once with business/human scope (13.346653ms)
-✔ proxy.apikey.add: tester human-required (14.275591ms)
-✔ proxy.apikey.add: agent human-required (15.041527ms)
-✔ proxy.apikey.add: user human-required (13.715987ms)
-✔ proxy.apikey.add: not-configured (13.608844ms)
-✔ proxy.priority.set: owner calls page once with business/human scope (12.499478ms)
-✔ proxy.priority.set: tester human-required (14.103153ms)
-✔ proxy.priority.set: agent human-required (14.57306ms)
-✔ proxy.priority.set: user human-required (14.02396ms)
-✔ proxy.priority.set: not-configured (13.77083ms)
-✔ proxy.keys: owner calls page once with business/human scope (11.740894ms)
-✔ proxy.keys: tester human-required (12.726783ms)
-✔ proxy.keys: agent human-required (14.12361ms)
-✔ proxy.keys: user human-required (13.283755ms)
-✔ proxy.keys: not-configured (12.67668ms)
-✔ API-key canary never enters broker events or unknown error output (13.619581ms)
-ℹ tests 41
-ℹ suites 0
-ℹ pass 41
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 696.597349
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,2 +0,0 @@
-2026-10-25T06:42:06Z
- 01:42:06 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/RE2vwS
-✔ OAuth management calls keep URL and state out of receipts (19.749276ms)
-✔ upstream key goes only in request body and upstream refusal body is discarded (4.186524ms)
-✔ redirected management calls are not followed or retried (2.121196ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 98.033185
@@ -1,2 +0,0 @@
-2026-10-25T06:42:06Z
- 01:42:06 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,2 +0,0 @@
-2026-10-25T06:42:06Z
- 01:42:06 up 11 days, 17:01,  2 users,  load average: 6.66, 16.61, 16.65
@@ -1,10 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/UVjb2T
-✔ Console production module graph cannot import the model-proxy client (70.585338ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 137.462924
@@ -1,2 +0,0 @@
-2026-10-25T06:42:12Z
- 01:42:12 up 11 days, 17:02,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,2 +0,0 @@
-2026-10-25T06:42:11Z
- 01:42:11 up 11 days, 17:02,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/WLROJU
-✔ proxy browser clears write-only key immediately, sends once and renders data as text (603.091893ms)
-✔ proxy browser OAuth opens safely, callback wait stays pending, status ok completes (2601.033669ms)
-✔ proxy browser read-only disables account changes (550.580882ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 3846.295222
@@ -1,2 +0,0 @@
-2026-10-25T06:42:11Z
- 01:42:11 up 11 days, 17:02,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,2 +0,0 @@
-2026-10-25T06:42:08Z
- 01:42:08 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,11 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/kmRLQ1
-✔ API-key canary reaches fake once and zero responses/logs/receipts/store files (51.811486ms)
-✔ OAuth URLs, state and code stay out of broker records and management receipts (19.046885ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 240.643186
@@ -1,2 +0,0 @@
-2026-10-25T06:42:08Z
- 01:42:08 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,20 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/X0Vp78
-✔ owner proxy routes each make exactly one allowlisted call (27.305714ms)
-✔ proxy write refuses signed-out (2.96232ms)
-✔ proxy write refuses loopback (1.79702ms)
-✔ proxy write refuses cross-origin (1.340864ms)
-✔ proxy write refuses missing Fetch Metadata (1.47209ms)
-✔ all proxy writes are read-only without --send (3.481474ms)
-✔ granted user never reaches owner page or any proxy route (4.998721ms)
-✔ native page offers write-only key input and no panel script (2.07878ms)
-✔ Console caller rejects every non-proxy verb (0.837371ms)
-✔ tester socket refuses proxy page, reads and writes before any owner call (7.459873ms)
-✔ malformed API-key JSON never appears in errors or logs (1.621405ms)
-ℹ tests 11
-ℹ suites 0
-ℹ pass 11
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 221.712154
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,2 +0,0 @@
-2026-10-25T06:42:07Z
- 01:42:07 up 11 days, 17:01,  2 users,  load average: 6.53, 16.42, 16.59
@@ -1,6 +0,0 @@
-P4 offline upgrade version=8.0.42 nice=16
-P4 diagnostic {"stage":"binary-start","nodePriority":16,"childPriority":16,"lastClientErrorCode":null,"nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"management-ready","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"store-open","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 upgrade FAILED {"stage":"store-open","errorClass":"Error","code":"acceptance-failed"}
-P4 diagnostic {"stage":"store-open","nodePriority":16,"childPriority":null,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":null,"childExitCode":0,"childSignal":null}
@@ -1 +0,0 @@
- 01:14:23 up 11 days, 16:34,  2 users,  load average: 3.15, 5.41, 9.24
@@ -1 +0,0 @@
- 01:14:19 up 11 days, 16:34,  2 users,  load average: 2.90, 5.40, 9.26
@@ -1,2 +0,0 @@
-2026-10-25T07:32:30Z
- 02:32:30 up 11 days, 17:52,  2 users,  load average: 51.91, 45.30, 29.60
@@ -1,2 +0,0 @@
-2026-10-25T07:32:25Z
- 02:32:25 up 11 days, 17:52,  2 users,  load average: 52.34, 45.27, 29.51
@@ -1,10 +0,0 @@
-P4 offline upgrade version=8.0.42 nice=16
-P4 diagnostic {"stage":"binary-start","nodePriority":16,"childPriority":16,"lastClientErrorCode":null,"nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"management-ready","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"store-open","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"broker-bound","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 empty-provider diagnostic {"httpStatus":404,"code":"proxy-client-refused"}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":16,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":5,"childExitCode":null,"childSignal":null}
-P4 upgrade FAILED {"stage":"initial-accounts","errorClass":"Error","code":"proxy-down"}
-P4 diagnostic {"stage":"initial-accounts","nodePriority":16,"childPriority":null,"lastClientErrorCode":"proxy-client-down","nodeSchedulingPolicy":5,"childSchedulingPolicy":null,"childExitCode":0,"childSignal":null}
@@ -1,8 +0,0 @@
-ed5dfcda6db77921f90f1eb587fb0044d6472fb613ecaa98445ed42bc04d5d46  packages/model-proxy/tests/empty-provider.test.mjs
-c55cc0bb47cd7716a2c31c665cd2dd426e2c54ab7b629637bdc12089dfeb40ce  packages/bus/tests/proxy-page-empty-provider.test.mjs
-01c18d8d09dac72bed45ce302a88cea449ed22ffde374529cf784bad38adbd72  packages/bus/tests/proxy-page-fixture.mjs
-aa73c4cd454742f7745900e8481f7425341ed7d236b104589790ed254c8bd69f  packages/model-proxy/src/client.mjs
-14acdb4d3fdaabad508eec7378740b13c175d4bdd0c6e707a673138eff82365b  packages/bus/src/proxy-page.mjs
-b19292cad28bd19427fac932c6150429968e184f4a6f000d948919e76908eb05  agents/poe/work/queue-330/proposed-empty-provider.patch
-ea7584f8935251baa9c32bf675343e8c8cbe19a45c4e7dc48675e14b4409bb1c  agents/poe/work/queue-330/empty-provider-prepared-imports.json
-5d227ae19d600c2fb0e375673045705c4f5bcc00311493a577108caddb38704a  agents/poe/work/queue-330/empty-provider-red-run-list.txt
@@ -1,34 +0,0 @@
-{
-  "packages/model-proxy/tests/empty-provider.test.mjs": {
-    "staticImports": [
-      "node:test",
-      "node:assert/strict",
-      "node:http",
-      "packages/model-proxy/src/client.mjs"
-    ],
-    "existingParsedClosureRoots": [
-      "packages/model-proxy/src/client.mjs"
-    ]
-  },
-  "packages/bus/tests/proxy-page-empty-provider.test.mjs": {
-    "staticImports": [
-      "node:test",
-      "node:assert/strict",
-      "packages/bus/tests/proxy-page-fixture.mjs"
-    ],
-    "existingParsedClosureRoots": [
-      "packages/bus/tests/proxy-page-fixture.mjs"
-    ]
-  },
-  "packages/bus/tests/proxy-page-fixture.mjs": {
-    "staticImports": [
-      "node:http",
-      "packages/model-proxy/src/client.mjs",
-      "packages/bus/src/proxy-page.mjs"
-    ],
-    "existingParsedClosureRoots": [
-      "packages/model-proxy/src/client.mjs",
-      "packages/bus/src/proxy-page.mjs"
-    ]
-  }
-}
@@ -1,2 +0,0 @@
-packages/model-proxy/tests/empty-provider.test.mjs
-packages/bus/tests/proxy-page-empty-provider.test.mjs
@@ -1,2 +0,0 @@
-fetch nice 19
-{"dir":"/mnt/storage/scratch/tmp/76TDtz/download/opt/cliproxyapi/8.0.42","binary":"/mnt/storage/scratch/tmp/76TDtz/download/opt/cliproxyapi/8.0.42/cli-proxy-api","panel":"/mnt/storage/scratch/tmp/76TDtz/download/opt/cliproxyapi/8.0.42/static/management.html"}
@@ -1 +0,0 @@
-/mnt/storage/scratch/tmp/76TDtz
@@ -1,17 +0,0 @@
-import { build } from '../../../../packages/webui/node_modules/esbuild/lib/main.js';
-import { writeFileSync } from 'node:fs';
-const entries = [
-  'packages/model-proxy/tests/page-client.test.mjs',
-  'packages/bus/tests/proxy-page.test.mjs',
-  'packages/bus/tests/proxy-page-state.test.mjs',
-  'packages/bus/tests/proxy-page-accounts.test.mjs',
-  'packages/webui/tests/proxy-page.test.mjs',
-  'packages/webui/tests/proxy-canary.test.mjs',
-  'packages/webui/tests/proxy-browser.test.mjs',
-  'packages/webui/tests/proxy-architecture.test.mjs',
-];
-const result = await build({ entryPoints: entries, bundle: true, platform: 'node', format: 'esm', splitting: true,
-  packages: 'external', write: false, outdir: '/unused-p4-focused', metafile: true, logLevel: 'silent' });
-writeFileSync(new URL('./focused-import-graph.json', import.meta.url), JSON.stringify(result.metafile.inputs, null, 2) + '\n');
-writeFileSync(new URL('./focused-run-list.txt', import.meta.url), entries.join('\n') + '\n');
-console.log('Static parsed inputs=' + Object.keys(result.metafile.inputs).length + ' test entries=' + entries.length);
@@ -1,8 +0,0 @@
-packages/model-proxy/tests/page-client.test.mjs
-packages/bus/tests/proxy-page.test.mjs
-packages/bus/tests/proxy-page-state.test.mjs
-packages/bus/tests/proxy-page-accounts.test.mjs
-packages/webui/tests/proxy-page.test.mjs
-packages/webui/tests/proxy-canary.test.mjs
-packages/webui/tests/proxy-browser.test.mjs
-packages/webui/tests/proxy-architecture.test.mjs
@@ -1,92 +0,0 @@
-{
-  "fullGraphPath": "/mnt/storage/scratch/tmp/9YZd4m/p4-import-graph.json",
-  "fullGraphSha256": "f91e682e0301d88efedc2a9c61a57c8fd65ace432f50e76e37eb37d0a1c7a396",
-  "parsedInputs": 677,
-  "selected": 280,
-  "mandatory": 199,
-  "imported": 256,
-  "excludedEvenIfImported": "packages/cli/tests/case1-accept.test.mjs",
-  "additional": [
-    "packages/business/tests/case1-business-file.test.mjs",
-    "packages/cli/tests/access-boot.test.mjs",
-    "packages/cli/tests/access.test.mjs",
-    "packages/cli/tests/app.test.mjs",
-    "packages/cli/tests/boot-status.test.mjs",
-    "packages/cli/tests/case1-hostcheck.test.mjs",
-    "packages/cli/tests/case2-install.test.mjs",
-    "packages/cli/tests/case2-persona-import.test.mjs",
-    "packages/cli/tests/case2-unit.test.mjs",
-    "packages/cli/tests/channel-cli.test.mjs",
-    "packages/cli/tests/channel-recovery.test.mjs",
-    "packages/cli/tests/cli.test.mjs",
-    "packages/cli/tests/compactions-launch.test.mjs",
-    "packages/cli/tests/config.test.mjs",
-    "packages/cli/tests/credentials.test.mjs",
-    "packages/cli/tests/federation-acceptance.test.mjs",
-    "packages/cli/tests/follow.test.mjs",
-    "packages/cli/tests/git-socket.test.mjs",
-    "packages/cli/tests/grants-scope.test.mjs",
-    "packages/cli/tests/grants.test.mjs",
-    "packages/cli/tests/host.test.mjs",
-    "packages/cli/tests/hosts.test.mjs",
-    "packages/cli/tests/idle-stop-race.test.mjs",
-    "packages/cli/tests/instances.test.mjs",
-    "packages/cli/tests/launch-account.test.mjs",
-    "packages/cli/tests/launch-limit-checks.test.mjs",
-    "packages/cli/tests/launch-limits.test.mjs",
-    "packages/cli/tests/launch-routes.test.mjs",
-    "packages/cli/tests/launcher.test.mjs",
-    "packages/cli/tests/lifecycle.test.mjs",
-    "packages/cli/tests/limits-tokens.test.mjs",
-    "packages/cli/tests/limits.test.mjs",
-    "packages/cli/tests/mark-read.test.mjs",
-    "packages/cli/tests/model-proxy.test.mjs",
-    "packages/cli/tests/names.test.mjs",
-    "packages/cli/tests/notifier.test.mjs",
-    "packages/cli/tests/optional-tracker.test.mjs",
-    "packages/cli/tests/other-tree.test.mjs",
-    "packages/cli/tests/processing-cli.test.mjs",
-    "packages/cli/tests/project-name-repo.test.mjs",
-    "packages/cli/tests/project.test.mjs",
-    "packages/cli/tests/publish-socket.test.mjs",
-    "packages/cli/tests/reply-limits.test.mjs",
-    "packages/cli/tests/revoke-window.test.mjs",
-    "packages/cli/tests/session-clear.test.mjs",
-    "packages/cli/tests/session-cli.test.mjs",
-    "packages/cli/tests/session-launch.test.mjs",
-    "packages/cli/tests/stack-copy.test.mjs",
-    "packages/cli/tests/stack-instances.test.mjs",
-    "packages/cli/tests/tester-http.test.mjs",
-    "packages/cli/tests/tester-reads.test.mjs",
-    "packages/cli/tests/tester-threads.test.mjs",
-    "packages/cli/tests/tester.test.mjs",
-    "packages/cli/tests/thread-cli.test.mjs",
-    "packages/cli/tests/thread-launch.test.mjs",
-    "packages/cli/tests/thread-revoke.test.mjs",
-    "packages/cli/tests/trackers-boot.test.mjs",
-    "packages/cli/tests/transport.test.mjs",
-    "packages/cli/tests/usage.test.mjs",
-    "packages/cli/tests/verbs.test.mjs",
-    "packages/harness/tests/citation-runner.test.mjs",
-    "packages/harness/tests/claude-session.test.mjs",
-    "packages/harness/tests/creative.test.mjs",
-    "packages/harness/tests/pi-session.test.mjs",
-    "packages/harness/tests/raise-domain.test.mjs",
-    "packages/harness/tests/runner.test.mjs",
-    "packages/harness/tests/skills.test.mjs",
-    "packages/harness/tests/spec-tools.test.mjs",
-    "packages/harness/tests/tools.test.mjs",
-    "packages/processing-control/tests/task.test.mjs",
-    "packages/seat/tests/sandbox.test.mjs",
-    "packages/seat/tests/session.test.mjs",
-    "packages/tasks/tests/adapter.test.mjs",
-    "packages/tasks/tests/comment-restart.test.mjs",
-    "packages/tasks/tests/fields.test.mjs",
-    "packages/tasks/tests/processing.test.mjs",
-    "packages/tasks/tests/shapes.test.mjs",
-    "packages/tasks/tests/startup.test.mjs",
-    "packages/tasks/tests/sync.test.mjs",
-    "packages/tasks/tests/tree.test.mjs",
-    "packages/tasks/tests/verbs.test.mjs"
-  ]
-}
@@ -1,39 +0,0 @@
-// Parse real static/dynamic literal imports with esbuild, never fixture-text grep.
-import { build } from '../../../../packages/webui/node_modules/esbuild/lib/main.js';
-import { readdirSync, writeFileSync } from 'node:fs';
-import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-function walk(dir) { return readdirSync(dir, { withFileTypes: true }).flatMap(e => e.name === 'node_modules' ? [] : e.isDirectory() ? walk(path.join(dir, e.name)) : e.name.endsWith('.test.mjs') ? [path.join(dir, e.name)] : []); }
-const tests = walk('packages');
-const result = await build({ entryPoints: tests, bundle: true, platform: 'node', format: 'esm', splitting: true, packages: 'external',
-  write: false, outdir: '/unused-p4-graph', metafile: true, logLevel: 'silent' });
-const graph = result.metafile.inputs;
-const changed = new Set(['packages/model-proxy/src/client.mjs', 'packages/bus/src/broker.mjs', 'packages/bus/src/runtime.mjs',
-  'packages/bus/src/proxy-page.mjs', 'packages/webui/src/cli.mjs', 'packages/webui/src/serve.mjs', 'packages/webui/src/console-bus.mjs', 'packages/webui/src/proxy-http.mjs']);
-function reaches(file, seen = new Set()) {
-  if (changed.has(file)) return true;
-  if (seen.has(file)) return false; seen.add(file);
-  return (graph[file]?.imports ?? []).some(i => !i.external && reaches(i.path, seen));
-}
-const forbidden = 'packages/cli/tests/case1-accept.test.mjs';
-const mandatory = tests.filter(p => /^packages\/(model-proxy|bus|webui)\/tests\//.test(p));
-const imported = tests.filter(p => reaches(p));
-const selected = [...new Set([...mandatory, ...imported])].filter(p => p !== forbidden).sort();
-const scratch = execFileSync('mktemp', ['-d', '/mnt/storage/scratch/tmp/XXXXXX'], { encoding: 'utf8' }).trim();
-const fullGraphPath = path.join(scratch, 'p4-import-graph.json'), fullGraph = JSON.stringify(graph, null, 2) + '\n';
-writeFileSync(fullGraphPath, fullGraph);
-function witness(file, seen = new Set()) {
-  if (changed.has(file)) return [file];
-  if (seen.has(file)) return null; seen.add(file);
-  for (const i of graph[file]?.imports ?? []) {
-    if (i.external) continue;
-    const rest = witness(i.path, seen); if (rest) return [file, ...rest];
-  }
-  return null;
-}
-writeFileSync(new URL('./gate-import-witness.json', import.meta.url), JSON.stringify(Object.fromEntries(selected.map(p => [p, witness(p) ?? ['mandatory suite']])), null, 2) + '\n');
-writeFileSync(new URL('./gate-run-list.txt', import.meta.url), selected.join('\n') + '\n');
-console.log(JSON.stringify({ fullGraphPath, fullGraphSha256: createHash('sha256').update(fullGraph).digest('hex'), parsedInputs: Object.keys(graph).length, selected: selected.length, mandatory: mandatory.length,
-  imported: imported.length, excludedEvenIfImported: forbidden,
-  additional: selected.filter(p => !mandatory.includes(p)) }, null, 2));
@@ -1,280 +0,0 @@
-packages/bus/tests/access-revoke.test.mjs
-packages/bus/tests/account-migration.test.mjs
-packages/bus/tests/address.test.mjs
-packages/bus/tests/agents.test.mjs
-packages/bus/tests/approval-binding.test.mjs
-packages/bus/tests/broker.test.mjs
-packages/bus/tests/business.test.mjs
-packages/bus/tests/channel-proof.test.mjs
-packages/bus/tests/chief-of-staff.test.mjs
-packages/bus/tests/citation-availability.test.mjs
-packages/bus/tests/citation-guard.test.mjs
-packages/bus/tests/citation-runtime.test.mjs
-packages/bus/tests/comment-cursors.test.mjs
-packages/bus/tests/comment-migration.test.mjs
-packages/bus/tests/console-decide.test.mjs
-packages/bus/tests/creative.test.mjs
-packages/bus/tests/credential-claim.test.mjs
-packages/bus/tests/credential-status.test.mjs
-packages/bus/tests/credential-store.test.mjs
-packages/bus/tests/credential-verbs.test.mjs
-packages/bus/tests/credentials.test.mjs
-packages/bus/tests/csuite-messaging.test.mjs
-packages/bus/tests/daily-quota-runtime.test.mjs
-packages/bus/tests/decision-close.test.mjs
-packages/bus/tests/decision-route.test.mjs
-packages/bus/tests/decisions.test.mjs
-packages/bus/tests/end-launch.test.mjs
-packages/bus/tests/fire-revokes-grants.test.mjs
-packages/bus/tests/gitea-grant-docker.test.mjs
-packages/bus/tests/gitea-grant.test.mjs
-packages/bus/tests/gitea-migration.test.mjs
-packages/bus/tests/grant-enroll.test.mjs
-packages/bus/tests/grant-executor.test.mjs
-packages/bus/tests/grant-host.test.mjs
-packages/bus/tests/grant-migration.test.mjs
-packages/bus/tests/grant-scope-runtime.test.mjs
-packages/bus/tests/grant-scope.test.mjs
-packages/bus/tests/hard-waits.test.mjs
-packages/bus/tests/host-run.test.mjs
-packages/bus/tests/host-tools.test.mjs
-packages/bus/tests/human.test.mjs
-packages/bus/tests/instances-verb.test.mjs
-packages/bus/tests/interpreter.test.mjs
-packages/bus/tests/land.test.mjs
-packages/bus/tests/launch-notice.test.mjs
-packages/bus/tests/launcher-released.test.mjs
-packages/bus/tests/library-credential.test.mjs
-packages/bus/tests/library-lookups.test.mjs
-packages/bus/tests/library-sync.test.mjs
-packages/bus/tests/library.test.mjs
-packages/bus/tests/lifecycle-revoke.test.mjs
-packages/bus/tests/lifecycle-verbs.test.mjs
-packages/bus/tests/limit-checks.test.mjs
-packages/bus/tests/limit-stop.test.mjs
-packages/bus/tests/limits-runtime.test.mjs
-packages/bus/tests/limits.test.mjs
-packages/bus/tests/message-citation.test.mjs
-packages/bus/tests/message-filter.test.mjs
-packages/bus/tests/messages.test.mjs
-packages/bus/tests/messaging.test.mjs
-packages/bus/tests/model-proxy.test.mjs
-packages/bus/tests/name-migration.test.mjs
-packages/bus/tests/names.test.mjs
-packages/bus/tests/peer-transport.test.mjs
-packages/bus/tests/peercred.test.mjs
-packages/bus/tests/plugins-verb.test.mjs
-packages/bus/tests/principal.test.mjs
-packages/bus/tests/process.test.mjs
-packages/bus/tests/processing-runtime.test.mjs
-packages/bus/tests/processing-timeout.test.mjs
-packages/bus/tests/processing-web.test.mjs
-packages/bus/tests/processing.test.mjs
-packages/bus/tests/project-await.test.mjs
-packages/bus/tests/project-files.test.mjs
-packages/bus/tests/project-runtime.test.mjs
-packages/bus/tests/proxy-page-accounts.test.mjs
-packages/bus/tests/proxy-page-state.test.mjs
-packages/bus/tests/proxy-page.test.mjs
-packages/bus/tests/publish.test.mjs
-packages/bus/tests/reload.test.mjs
-packages/bus/tests/replies.test.mjs
-packages/bus/tests/requirements.test.mjs
-packages/bus/tests/review.test.mjs
-packages/bus/tests/revoke-window.test.mjs
-packages/bus/tests/room-check.test.mjs
-packages/bus/tests/rooms.test.mjs
-packages/bus/tests/routes-verb.test.mjs
-packages/bus/tests/schema.test.mjs
-packages/bus/tests/session-clear.test.mjs
-packages/bus/tests/session-compactions.test.mjs
-packages/bus/tests/sessions.test.mjs
-packages/bus/tests/single-use.test.mjs
-packages/bus/tests/spec-migration.test.mjs
-packages/bus/tests/spec-review.test.mjs
-packages/bus/tests/spec-socket.test.mjs
-packages/bus/tests/spec.test.mjs
-packages/bus/tests/staff-request.test.mjs
-packages/bus/tests/state.test.mjs
-packages/bus/tests/store.test.mjs
-packages/bus/tests/task-page.test.mjs
-packages/bus/tests/task-read.test.mjs
-packages/bus/tests/tasks.test.mjs
-packages/bus/tests/tester-threads.test.mjs
-packages/bus/tests/tester-writes.test.mjs
-packages/bus/tests/tester.test.mjs
-packages/bus/tests/thread-claims.test.mjs
-packages/bus/tests/thread-migration.test.mjs
-packages/bus/tests/thread-shares.test.mjs
-packages/bus/tests/threads.test.mjs
-packages/bus/tests/transport.test.mjs
-packages/bus/tests/usage-broker.test.mjs
-packages/bus/tests/usage-migration.test.mjs
-packages/bus/tests/usage-runtime.test.mjs
-packages/bus/tests/usage.test.mjs
-packages/bus/tests/user-principal.test.mjs
-packages/bus/tests/viewer.test.mjs
-packages/bus/tests/web.test.mjs
-packages/bus/tests/workflow-roles.test.mjs
-packages/business/tests/case1-business-file.test.mjs
-packages/cli/tests/access-boot.test.mjs
-packages/cli/tests/access.test.mjs
-packages/cli/tests/app.test.mjs
-packages/cli/tests/boot-status.test.mjs
-packages/cli/tests/case1-hostcheck.test.mjs
-packages/cli/tests/case2-install.test.mjs
-packages/cli/tests/case2-persona-import.test.mjs
-packages/cli/tests/case2-unit.test.mjs
-packages/cli/tests/channel-cli.test.mjs
-packages/cli/tests/channel-recovery.test.mjs
-packages/cli/tests/cli.test.mjs
-packages/cli/tests/compactions-launch.test.mjs
-packages/cli/tests/config.test.mjs
-packages/cli/tests/credentials.test.mjs
-packages/cli/tests/federation-acceptance.test.mjs
-packages/cli/tests/follow.test.mjs
-packages/cli/tests/git-socket.test.mjs
-packages/cli/tests/grants-scope.test.mjs
-packages/cli/tests/grants.test.mjs
-packages/cli/tests/host.test.mjs
-packages/cli/tests/hosts.test.mjs
-packages/cli/tests/idle-stop-race.test.mjs
-packages/cli/tests/instances.test.mjs
-packages/cli/tests/launch-account.test.mjs
-packages/cli/tests/launch-limit-checks.test.mjs
-packages/cli/tests/launch-limits.test.mjs
-packages/cli/tests/launch-routes.test.mjs
-packages/cli/tests/launcher.test.mjs
-packages/cli/tests/lifecycle.test.mjs
-packages/cli/tests/limits-tokens.test.mjs
-packages/cli/tests/limits.test.mjs
-packages/cli/tests/mark-read.test.mjs
-packages/cli/tests/model-proxy.test.mjs
-packages/cli/tests/names.test.mjs
-packages/cli/tests/notifier.test.mjs
-packages/cli/tests/optional-tracker.test.mjs
-packages/cli/tests/other-tree.test.mjs
-packages/cli/tests/processing-cli.test.mjs
-packages/cli/tests/project-name-repo.test.mjs
-packages/cli/tests/project.test.mjs
-packages/cli/tests/publish-socket.test.mjs
-packages/cli/tests/reply-limits.test.mjs
-packages/cli/tests/revoke-window.test.mjs
-packages/cli/tests/session-clear.test.mjs
-packages/cli/tests/session-cli.test.mjs
-packages/cli/tests/session-launch.test.mjs
-packages/cli/tests/stack-copy.test.mjs
-packages/cli/tests/stack-instances.test.mjs
-packages/cli/tests/tester-http.test.mjs
-packages/cli/tests/tester-reads.test.mjs
-packages/cli/tests/tester-threads.test.mjs
-packages/cli/tests/tester.test.mjs
-packages/cli/tests/thread-cli.test.mjs
-packages/cli/tests/thread-launch.test.mjs
-packages/cli/tests/thread-revoke.test.mjs
-packages/cli/tests/trackers-boot.test.mjs
-packages/cli/tests/transport.test.mjs
-packages/cli/tests/usage.test.mjs
-packages/cli/tests/verbs.test.mjs
-packages/harness/tests/citation-runner.test.mjs
-packages/harness/tests/claude-session.test.mjs
-packages/harness/tests/creative.test.mjs
-packages/harness/tests/pi-session.test.mjs
-packages/harness/tests/raise-domain.test.mjs
-packages/harness/tests/runner.test.mjs
-packages/harness/tests/skills.test.mjs
-packages/harness/tests/spec-tools.test.mjs
-packages/harness/tests/tools.test.mjs
-packages/model-proxy/tests/client.test.mjs
-packages/model-proxy/tests/config-unit.test.mjs
-packages/model-proxy/tests/fetch.test.mjs
-packages/model-proxy/tests/management-key-encoding.test.mjs
-packages/model-proxy/tests/page-client.test.mjs
-packages/model-proxy/tests/runner.test.mjs
-packages/model-proxy/tests/settings.test.mjs
-packages/processing-control/tests/task.test.mjs
-packages/seat/tests/sandbox.test.mjs
-packages/seat/tests/session.test.mjs
-packages/tasks/tests/adapter.test.mjs
-packages/tasks/tests/comment-restart.test.mjs
-packages/tasks/tests/fields.test.mjs
-packages/tasks/tests/processing.test.mjs
-packages/tasks/tests/shapes.test.mjs
-packages/tasks/tests/startup.test.mjs
-packages/tasks/tests/sync.test.mjs
-packages/tasks/tests/tree.test.mjs
-packages/tasks/tests/verbs.test.mjs
-packages/webui/tests/agents-browser.test.mjs
-packages/webui/tests/agents.test.mjs
-packages/webui/tests/assistant.test.mjs
-packages/webui/tests/board-held.test.mjs
-packages/webui/tests/browser-edge.test.mjs
-packages/webui/tests/browser.test.mjs
-packages/webui/tests/bus-browser.test.mjs
-packages/webui/tests/bus.test.mjs
-packages/webui/tests/channel-chat.test.mjs
-packages/webui/tests/chat-browser.test.mjs
-packages/webui/tests/chat-instances.test.mjs
-packages/webui/tests/chat-replies-browser.test.mjs
-packages/webui/tests/chat-sessions-access.test.mjs
-packages/webui/tests/chat.test.mjs
-packages/webui/tests/conversation.test.mjs
-packages/webui/tests/decide-browser.test.mjs
-packages/webui/tests/decide-sso.test.mjs
-packages/webui/tests/decision-http.test.mjs
-packages/webui/tests/discord.test.mjs
-packages/webui/tests/docs-browser.test.mjs
-packages/webui/tests/editor-browser.test.mjs
-packages/webui/tests/editor-provenance.test.mjs
-packages/webui/tests/editor.test.mjs
-packages/webui/tests/granted-user.test.mjs
-packages/webui/tests/history-return-flow.test.mjs
-packages/webui/tests/instances-browser.test.mjs
-packages/webui/tests/instances.test.mjs
-packages/webui/tests/library-cli.test.mjs
-packages/webui/tests/library-routes.test.mjs
-packages/webui/tests/library-status.test.mjs
-packages/webui/tests/limits-browser.test.mjs
-packages/webui/tests/limits-route.test.mjs
-packages/webui/tests/markdown-preview.test.mjs
-packages/webui/tests/messages.test.mjs
-packages/webui/tests/pinned-copy.test.mjs
-packages/webui/tests/preview.test.mjs
-packages/webui/tests/processing-browser.test.mjs
-packages/webui/tests/processing-ui.test.mjs
-packages/webui/tests/processing.test.mjs
-packages/webui/tests/project-file.test.mjs
-packages/webui/tests/project-name-repo.test.mjs
-packages/webui/tests/proof-cli.test.mjs
-packages/webui/tests/proof.test.mjs
-packages/webui/tests/proxy-architecture.test.mjs
-packages/webui/tests/proxy-browser.test.mjs
-packages/webui/tests/proxy-canary.test.mjs
-packages/webui/tests/proxy-page.test.mjs
-packages/webui/tests/reads.test.mjs
-packages/webui/tests/relaunch.test.mjs
-packages/webui/tests/return-flow.test.mjs
-packages/webui/tests/room-browser.test.mjs
-packages/webui/tests/room-http.test.mjs
-packages/webui/tests/routes-browser.test.mjs
-packages/webui/tests/routes.test.mjs
-packages/webui/tests/send-browser.test.mjs
-packages/webui/tests/send.test.mjs
-packages/webui/tests/serve.test.mjs
-packages/webui/tests/service.test.mjs
-packages/webui/tests/settings-form.test.mjs
-packages/webui/tests/settings-write.test.mjs
-packages/webui/tests/shell.test.mjs
-packages/webui/tests/sso-browser.test.mjs
-packages/webui/tests/sso.test.mjs
-packages/webui/tests/tester-browser.test.mjs
-packages/webui/tests/tester-cli.test.mjs
-packages/webui/tests/tester-listener.test.mjs
-packages/webui/tests/tester-socket.test.mjs
-packages/webui/tests/thread-claims-browser.test.mjs
-packages/webui/tests/thread-claims.test.mjs
-packages/webui/tests/thread-sharing.test.mjs
-packages/webui/tests/usage-browser.test.mjs
-packages/webui/tests/usage.test.mjs
-packages/webui/tests/user-option-swap.test.mjs
-packages/webui/tests/views.test.mjs
@@ -1,19 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/nmbhic
-✔ accounts have exactly the allowlisted public fields, id from credential identifier (16.726005ms)
-✔ token-like data in every upstream field never reaches public accounts (3.146433ms)
-✔ API key account is derived from proxy auth_index, never api-key, and can set priority (7.145341ms)
-✔ OAuth priority uses top-level name/priority and confirms it through list (2.559503ms)
-✔ priority-unconfirmed: accepted API-key write with unchanged read-back refuses (2.751129ms)
-✔ priority-write-refused: OAuth PATCH status 201 (1.645703ms)
-✔ priority-write-refused: OAuth PATCH status 400 (2.192791ms)
-✔ priority-invalid: unknown account refuses before any write (1.245093ms)
-✔ proxy-down: a closed management listener refuses once (1.049636ms)
-✔ client keys return ids, sentinel/foreign labels and only scoped record metadata (1.589625ms)
-ℹ tests 10
-ℹ suites 0
-ℹ pass 10
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 106.068199
@@ -1,10 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/zzWg8y
-✔ Console production module graph cannot import the model-proxy client (260.158583ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 332.064995
@@ -1,50 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/W3UTF4
-✔ proxy.accounts: owner calls page once with business/human scope (42.216353ms)
-✔ proxy.accounts: tester human-required (27.14418ms)
-✔ proxy.accounts: agent human-required (15.631107ms)
-✔ proxy.accounts: user human-required (16.036791ms)
-✔ proxy.accounts: not-configured (15.881775ms)
-✔ proxy.login.start: owner calls page once with business/human scope (15.676932ms)
-✔ proxy.login.start: tester human-required (15.957058ms)
-✔ proxy.login.start: agent human-required (16.769099ms)
-✔ proxy.login.start: user human-required (15.27276ms)
-✔ proxy.login.start: not-configured (18.544344ms)
-✔ proxy.login.submit: owner calls page once with business/human scope (14.653081ms)
-✔ proxy.login.submit: tester human-required (17.613806ms)
-✔ proxy.login.submit: agent human-required (19.653375ms)
-✔ proxy.login.submit: user human-required (21.882116ms)
-✔ proxy.login.submit: not-configured (18.504561ms)
-✔ proxy.login.status: owner calls page once with business/human scope (15.65383ms)
-✔ proxy.login.status: tester human-required (16.405308ms)
-✔ proxy.login.status: agent human-required (15.696776ms)
-✔ proxy.login.status: user human-required (18.693813ms)
-✔ proxy.login.status: not-configured (16.320036ms)
-✔ proxy.login.cancel: owner calls page once with business/human scope (13.937442ms)
-✔ proxy.login.cancel: tester human-required (17.41389ms)
-✔ proxy.login.cancel: agent human-required (17.722047ms)
-✔ proxy.login.cancel: user human-required (19.611299ms)
-✔ proxy.login.cancel: not-configured (15.608602ms)
-✔ proxy.apikey.add: owner calls page once with business/human scope (15.651765ms)
-✔ proxy.apikey.add: tester human-required (17.09525ms)
-✔ proxy.apikey.add: agent human-required (15.021593ms)
-✔ proxy.apikey.add: user human-required (15.257844ms)
-✔ proxy.apikey.add: not-configured (17.124537ms)
-✔ proxy.priority.set: owner calls page once with business/human scope (14.876553ms)
-✔ proxy.priority.set: tester human-required (21.351968ms)
-✔ proxy.priority.set: agent human-required (16.665676ms)
-✔ proxy.priority.set: user human-required (19.67346ms)
-✔ proxy.priority.set: not-configured (15.524648ms)
-✔ proxy.keys: owner calls page once with business/human scope (16.043305ms)
-✔ proxy.keys: tester human-required (16.990648ms)
-✔ proxy.keys: agent human-required (15.927183ms)
-✔ proxy.keys: user human-required (15.10558ms)
-✔ proxy.keys: not-configured (19.013178ms)
-✔ API-key canary never enters broker events or unknown error output (18.503151ms)
-ℹ tests 41
-ℹ suites 0
-ℹ pass 41
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 940.684074
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/AwJzc2
-✔ proxy browser clears write-only key immediately, sends once and renders data as text (752.942588ms)
-✔ proxy browser OAuth opens safely, callback wait stays pending, status ok completes (2519.227325ms)
-✔ proxy browser read-only disables account changes (456.893472ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 3803.115926
@@ -1,11 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/weXu2n
-✔ API-key canary reaches fake once and zero responses/logs/receipts/store files (38.031356ms)
-✔ OAuth URLs, state and code stay out of broker records and management receipts (17.551154ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 193.476026
@@ -1,12 +0,0 @@
-nice=19 TMPDIR=/mnt/storage/scratch/tmp/67qzFx
-✔ OAuth management calls keep URL and state out of receipts (16.663673ms)
-✔ upstream key goes only in request body and upstream refusal body is discarded (3.261477ms)
-✔ redirected management calls are not followed or retried (1.670589ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 84.19507
				`@@ -1 +0,0 @@`
				`01:14:23 up 11 days, 16:34, 2 users, load average: 3.15, 5.41, 9.24`
				`@@ -1 +0,0 @@`
				`01:14:19 up 11 days, 16:34, 2 users, load average: 2.90, 5.40, 9.26`