plans: Q195 pane and pin, editor-independent host contract for O1, O2 and O3 (Q196), context validation per gyro-0009 (#448)

BUILD-LOG.md

@@ -5177,45 +5177,3 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-21T01:28:05Z | Darkwing | row 232 #1734 installer I1 build, round 1 in review | Before: stack-release.sh managed only user units (systemctl --user), and stack-copy.sh had no bundle copy. After: --units external (adopt, activate, rollback --to, status, confirm, revert, gate --since, AWAITING-UNITS, stale-start, external-pm, --plan --expect-from) and stack-copy check --units external, copy --bundle FILE SHA, wrapper ID --create; user mode byte-identical to the base by test. First build 0af0c73c6 on 00d4cc1f6; rebased onto row 200 (cb5fdb064) as a0ffabc3f on darkwing/row232-r1; --sso refused under external (D9), row 200 config_checks run under external (D10). Gate on Sage's slot (sage-1618): cli 561/0, every scripts/test-*.sh green; 17/17 mutants killed. Results commit 84f1a91e6 (pushed, seat branch only). Manifest 7a3b4ea1 (9 paths), queue revs 2595-2596, request comment 29825, reviewer Filbert. Packet agents/darkwing/work/queue-232/BUILD.md.
 2026-10-21T04:50:44Z | Darkwing | row 233 #1735 installer I3 build, round 1 in review | Before: root had no upgrade driver for root-owned units and no host run sheet; stack-release.sh had no rehearse --backup last and no external plan refusals. After: scripts/stack-upgrade.sh upgrade and rollback (r6 A1-A5, A2f, R1-R4) with 20 tests, docs/guides/host-run-sheet.md, TOOLS.md lines, and on Sage's rulings stack-release.sh --backup last, BACKUP_STORE and the --plan refusals open-activation and migrate-required (3 tests). Base e65a3ab4d (row 232's landing). Gate on Sage's slot (sage-1704) on d99166ade: cli 616/0, every scripts/test-*.sh green, 1201/0 summed by awk; m1-m8 8/8 killed. Correction: the process sweep after the gate found an orphaned sleep 60 from the lock test's flock holder (N1); 08db6ac3f fixes it test only, Sage ruled the gate stands (sage-1707), rerun c0 20/0 and m1 killed with 0 left (sage-1708). Tip 1a1dc80ca (pushed, seat branch only). Manifest 464ce9eb (7 paths), queue revs 2644 and 2647, request comment 29901, reviewer Filbert. Packet agents/darkwing/work/queue-233/BUILD.md.
 2026-10-21T06:37:41Z | Darkwing | row 240 #1746 installer I4 build, round 1 in review | Before: root had no host check for the bwrap AppArmor profile, its pins or a boot unit, and stack-upgrade.sh exited 1 args-failed when the args move after A5 failed, while exit 1 means the old copy runs. After: scripts/case1-hostcheck.sh (seven items, --check, --enforce, --upstream), scripts/case1-pins.sh, mosaic-hostcheck.service and 16 tests; the args move failure exits 5 args-failed, documented in TOOLS.md and run sheet section 6 and tested; run sheet section 3 puts the pinned npm on PATH and names the bin/claude.exe --claude path; sections 8 and 10 have precheck lines. Verification: slot run r1 on 47ec9fe2f failed at the singles (the new N1 test's after hook threw ENOENT after the fixture cleanup removed the root); b45852daa drops the hook; r2 on b45852daa green: singles 16/0 and 21/0, c0 plus M1-M8 8/8 killed, cli 639/0, scripts 585/0. Candidate darkwing/row240-r3 ad1b23ab2 on c771a36f4, manifest 573ece95 (9 paths), revs 2694 and 2695, comment 29943.
-2026-10-21T09:00Z | Herb | row 215 C2-04 implementation started | Before: business files reject library entries and root consumers assume code projects; the organization writer can change all project mappings. Plan: approved manifest 2522025af on C2-01 a2c72ac95, Filbert reply to herb-0056, scope sage-1848/1852/1860. Focused slot sage-1869 observed expected red mapping and M9 cases, then 14/0 green for new T1/T2 cases, no skips; clear herb-0062 with empty test/fixture process scan. After that clear, T3/T4 tests and host-only mirror/bus implementation continue under sage-1874, unrun while Sage holds the slot. Full singles, suites and implementation review remain pending. No source commit, push or live change.
-2026-10-21T13:29Z | Herb | row 215 C2-04 source verified for candidate review | Before: business code assumed every project had a root and organization writes could replace project mappings. After: library mappings load without agent checkouts or publish grants, project mappings are protected before and after serialization, host-only bare mirrors share a bounded publication lock with sync, and library.file/library.status are human-only async bus reads. Base f8276c5eb preserves all nine landed overlaps. Granted sage-2008 whole singles: 16 files, 451/0, no skips or cancellations, ended 13:27:27.279728Z; all source hashes unchanged, process scan empty, no own-path drift through 8a04f4aa4. Full landing gate and implementation review remain pending; no HTTP, sync writer or live change.
-
-2026-10-20 19:09:44 UTC | Gander row 196 #1694 design phase | Before: tester TCP reaches every local uid and human proofs do not bind the socket peer. After: design draft at agents/gander/work/queue-196/DESIGN.md inventories listeners, proposes private tester HTTP and SO_PEERCRED binding, aligns the per-request principal contract with Morgana and Gizmoduck, and lists migration, tests, mutants and same-uid limits. Python versus other credential options and Console provenance require Duckworth ruling. Documentation only. No product code, suite, live probe, secret access or deployment.
-
-2026-10-20 19:16:20 UTC | Gander row 196 #1694 design r2 | Before: Duckworth r1 requested concurrent helper-fd evidence (B1) and selected O1 with interpreter, proof-only and image conditions. After: design adds eight concurrent genuine proof processes plus a racing copier, M20 swapped socket and post-helper socket survival, root-owned system ELF pinning and activation evidence, safe gid validation, cap traffic without helpers, and unchanged P19 R2 text. Mos accepted socket-only tester access (mos-1015 via sage-1363); any authenticated browser relay is a separate row. Documentation coverage checks passed. No product code, suites or live action.
-
-2026-10-20 19:21:19 UTC | Gander row 196 #1694 design approval and N5 | Before: Duckworth approved r2 (duckworth-0009, cb6d840df) with a nonblocking interpreter-upgrade note. After: r3 chooses startup safety revalidation, appends actual interpreter identity to bus/peercred-starts.jsonl and retains old activation evidence. Operator re-pin uses the next reviewed copy, respecting already-active refusal. Added task-by-task PLAN.md for inline implementation and independent manifest review. Documentation checks passed. No product code, suites or live action.
-
-2026-10-20 19:34:28 UTC | Gander row 196 build paused at design mismatch | Before: approved design promised Unix tester cleanup only for the owned inode. After: scratch test shows Node/libuv close unlinks a replacement inode before JS close handlers. Evidence agents/gander/work/queue-196/evidence/tester-cleanup-blocker.txt. Sent Sage/Duckworth gander-0016/0017, recommending explicit same-uid residual with private 0700 parent retained. Interpreter, concurrent peer, principal, human, peer-transport, transport, tester and process single files passed. Partial code uncommitted, tester transport not wired. No suites, mutant batches or live actions.
-
-2026-10-21 18:45 UTC | Gander row 196 preservation before rebase | Sage-2051, Mos order mos-1193, explicitly authorizes commit and fast-forward push of the current build before deferred full verification. Product and evidence preserved together; prior focused checks and stopped gates are recorded in the row196 packet, with no claim of full acceptance. Next: rebase onto a36523713 on new gander/row196-r2, report range-diff/patch-id/conflicts, then await Sage's clear for M1-M29 and all requested suites. No live action, force push, branch deletion or tests during hold.
-
-2026-10-21T16:34:44Z | Huey | Q198/Q199 system-manager design, mos-1183, Vikunja 452 | Before: pinned foundation 6c75887b0 has separate bus, development queue, run evidence, turn/cohort controls and launch/usage paths; the assignment requests a mechanical manager design. After: docs/plans/2026-10-21_q198-system-manager.md proposes admission/cooldown, priority and safe interruption, durable requests, bounded retry/DLQ/replay/rerouting, Console monitoring, optional decision adapters with USD reservations, six ordered slices and three recommended owner decisions. Verification: 26 pinned file:line references resolve, ten-line summary, manual source/contract review, git diff --check and installed queue guard pass. No builds/suites, runtime writes, credential reads, service changes or paid calls. Huey queue next refused the linked worktree, then returned nothing from canonical checkout; direct brief controls this assignment. Gitea issue and queue-row capture are handed to Sage under the no-credential-read/no-queue-write boundary.
-
-2026-10-21T18:45:47Z | Huey | Q198 system-manager design r2, mos-1194, Vikunja 452 | Before: Scrooge requested changes on add7cb506 for decision-key worker exposure, cap scope and absent sampler ownership. After: distinct MOSAIC_DECISION_OPENROUTER_KEY with S6 sessionEnv canary requirement; exclusive per-instance key with per-key caps and provider limit on every enablement; S2 owns supervisor sampler and waits until after MVP/re-pin. Also records P1 interpretation, missing-confidence fallback and stand-in timeout selection, explains verified Noul spelling, excludes notifier/gateway retry loops with citations, and cites lifecycle revocation requirement. Verification: 30 pinned citation spans resolve, ten-line summary, manual diff/source review and whitespace/queue-guard checks. No builds, suites, live changes, credential reads or paid calls.
-
-2026-10-21T19:56:11Z | Huey | Q198 design r3, mos-1201/1201a, Vikunja 452 | Before: Scrooge approved r2 7e785a08f with three notes. After: N1 names proposed system.health bus read verb and includes broker handler/authorization in S2 scope and review; N2 labels exclusive ownership as a setup attestation that cannot be mechanically proved and identifies provider key limit as real ceiling; N3 adds recommended Q4 for P1 narrowing and removes the Mos-flag instruction. Other design content retained. Verification: manual r2-to-r3 delta review, ten-line summary, whitespace and installed queue-guard checks. No builds, suites, live changes or paid calls.
-
-2026-10-21T20:19:53Z | Huey | Q198 design r4, mos-1203, DECISIONS Q204, Vikunja 452 | Before: r3 a36952564 presented Q1–Q4 for owner approval. After: section 9 records Q20a–Q20c verbatim as approved; D11 labels Huey’s reading of configurable daily/monthly caps with $0.10/$1 defaults in the one instance config via reviewed schema; provider key ceiling and explicit enable/key requirements retained; Q4 pending, Jason restated 2026-10-21, P1 unchanged. Verification: quotes match DECISIONS ledger, unrelated sections and P1 equal r3, ten-line summary, whitespace and installed queue guard checked. No builds, suites, live changes or paid calls.
-
-2026-10-21T20:48:49Z | Huey | Q198 design r5, mos-1206, DECISIONS Q205/Q206, Vikunja 452 | Before: r4 1e8bccff1 left Q4 pending and long outages could exhaust request retry budgets. After: protected mode separate from unchanged D1 human kill authority; mechanical detection, safe-point pause/proof, JEV-first endpoint-before-headless probes at 60-second increments to 600 seconds without attempt limit, upstream reset waits, shared D11 probe accounting, one test session then batches, proposed three-failed-exit escalation, frozen outage clocks/counters without DLQ, advisory online-service routing, Q4 superseded and Q22 pending. Thresholds/deadlines/batches/escalation explicitly labelled Huey readings. Acceptance proposals updated, no implementation. Verification: complete Q205/Q206 read, quotes match ledger, D1/inventory/Q1–Q3 unchanged, 30 pinned citation references resolve, 11-line summary, manual consistency/diff review, whitespace and installed queue guard checked. No builds, suites, real probes, live changes or paid calls.
-
-2026-10-21T21:04:37Z | Huey | Q198 design r6, mos-1208/mos-1210, DECISIONS Q207, scrooge-0003, Vikunja 452 | Before: r5 fd44f7c60 gated probes on JEV and lacked request-local resume failure separation. After: parallel independent probes; central JEV/smaller-model/rules endpoint chain, per-model timeout/calibration, 4 KiB metadata limit and isolated fallback credentials; subscription quota vs metered USD accounting and separately enabled paid-probe budget (proposed $0 defaults). S-F1–S-F7: bounded outage classification, request-local D6/two-resume DLQ rule and batch definition; escalation latch with authorized revision-bound system.recovery.release separate from kill clear; cooperative F5 pause/F6 proof only; proposed configurable 24-hour cumulative pause expiry; full Q205 kill sentence with labelled protected-mode interpretation; r3–r6 history. S5/S6 acceptance proposals updated. Verification: Q205/Q207 quotes match ledger, D1/inventory/Q1–Q3 unchanged, 30 pinned references resolve, summary within 15 lines, manual consistency/delta review, whitespace and installed queue guard checked. No builds, suites, real probes, live changes, credential reads or paid calls.
-
-2026-10-21T21:39:25Z | Huey | Q198 r6.1 touch-up, mos-1222, scrooge-0004 N1–N3, Vikunja 452 | Before: approved r6 2ee68cd69 had unprovable session-call denial wording, implicit queue/late-call behavior and a partial Q207 paragraph. After: rule/S6 tests require session decision calls/output have no routing authority; non-waiting dispatchers use internal rules immediately; timed-out JEV does not occupy fallback decision slot but retains spend reservation; full Q207 paragraph copied exactly from DECISIONS; matching Q22 reading corrected. ENV_ALLOW and all runtime code unchanged. Verification: exact full-quote equality, obsolete wording absent, D1 unchanged, summary within 15 lines, manual N1–N3 delta review, whitespace and installed queue guard checked. No builds, suites, probes, live changes or paid calls. Review/handoff via T3 as Mos authorized.
-
-2026-10-21T21:11:44Z | Della mos-1213 / Vikunja 460 planning phase | Before: PRD 1.10 has no email feature; MP 95b0298 and EP 7a64921 are read-only prior inputs. Scope: independent post-v1 email plan on della/email-plan, no implementation/live access/MVP or queue changes. Gitea issue enrollment belongs to Mos/Sage because this seat has no API credential.
-
-2026-10-21T21:12:18Z | Della mos-1213 / Vikunja 460 planning verification | After: docs/plans/2026-10-21_email-plan-della.md is 341 lines, with 13 post-v1 rows and six Jason questions. Verified 42 pinned citation anchors, ten requested coverage areas, identical prior src trees, append-only records, clean whitespace and repository queue guard. No configured CI pipeline or CI-queue wrapper found in the current foundation; documentation-only validation applies, no product suites or live tests run. Phase B/C and Gitea issue/queue enrollment remain with Mos/Sage. Only della/email-plan is authorized for push.
-
-2026-10-21T21:37:07Z | Della mos-1220 / Vikunja 460 phase B cross-review | Before: independent plans Della 191dff32f and Ludwig 4a27b73ac delivered. After: docs/plans/2026-10-21_email-review-by-della.md reviews all 218 Ludwig plan lines, records ten findings, five grafts, six retained strengths, nine disagreements and eleven merged Jason questions. Ludwig review 143415779 read in full after ludwig-0002 arrived; reconciliation records new mail-access action, no agent reroute and correction of Della dataRoot credential example. Original plan unchanged. Planning only, no product/MVP/queue/live change.
-
-2026-10-21T21:43:02Z | Della mos-1223 / Vikunja 460 phase C synthesis | Before: independent plans/reviews complete, Mos selected Della base. After: docs/plans/2026-10-21_email-plan.md merges Ludwig grafts and accepted corrections, with 16 post-v1 rows (eight READY, eight WAIT/optional), eleven deduplicated Jason questions, per-row test paths and explicit Q210 non-v1 scheduling. Original Della plan/review preserved; Ludwig originals remain on their branch. Static checks cover graft/row/question/citation anchors and original blobs. No source code, suite, mailbox, secret file, service, MVP or queue change. Candidate goes to Ludwig before Sage landing/queue handoff, copying Mos.
-
-2026-10-21T21:45:20Z | Della mos-1223 / ludwig-0004 focused corrections | Before: b096a16cc left content-key location implicit and E05 core registration marked ready. After: merged plan 399 lines fixes external configDir secret key/lifecycle namespace outside dataRoot backup/restore, E01 schema and E03 missing/expired-key restore tests, and E05/E06 test-local registry readiness with core kinds.mjs registration gated on approved E01/Q4. Sixteen rows and eleven questions retained; originals unchanged. Focused static checks and queue guard apply, no product/live changes. Reviewer will check changed lines only.
-
-2026-10-21T22:24:12Z | Huey | T1 item 7 sessions design r1, mos-1232, Vikunja 463 | Before: origin/refactor cca206cdc keys assistant claims/stores/messages by thread and renders Pi compaction markers; row 194 r4 excludes thread context clear. After: docs/plans/2026-10-21_t1-sessions.md proposes independent per-agent sessions within threads on Pi/Claude, scoped claims/stores/messages/workspaces, completed compaction counts, owner-write/RBAC matrix, idempotent proven-stop/fresh-successor clear, common admission/kill checks, migration and seven acceptance groups, replacement REQ-ROLE-2/REQ-THREAD-2 text and three owner questions. PRD 1.12 USER-3/4 candidate 1509c7cc5 cited separately from base. Verification: 22 pinned references resolve, eight-line summary and three exact owner quotes; manual source/consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds, suites, credential reads, live changes or paid calls. MVP priority ahead of Q198 S1. Review via Scrooge, then Sage/Ludwig as Mos authorized.
-
-2026-10-21T22:28:56Z | Huey | T1 sessions design r2, scrooge-0006, mos-1235/1236, Vikunja 463 | Before: r1 347278044 lacked the exact per-session checkout/single-writer invariant and safe runner drain ordering, and admitted other role instances. After: F1 exact workspace path, fenced checkout setup, legacy shared-workspace quiescence, clear retains old dirty/untracked/unpushed checkout and creates fresh approved checkout, T2 mutant; F2 dequeue fence and generation-bound turn-boundary idle proof before runner signal, busy drain stays clearing, T4 cases; F3 THREAD_DEFINITION only per Mos scope ruling, no role eligibility change; N1 private titles/history vs owner-visible count/activity projection; N2 Claude offline adapter/managed-store-reader dependency flagged as MVP risk. Section 8 records Mos’s Q1–Q3 readings, no questions to Jason. Verification: 27 pinned references resolve, summary within 15 lines, source/delta consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds/suites/live changes/provider calls/credential reads.
-
-2026-10-21T22:30:20Z | Huey | T1 sessions design r3, scrooge-0007 R1, Vikunja 463 | Before: r2 e19e30df2 nested new session checkouts under the retained legacy instance workspace, allowing project-name collision or historical parent inspection to reach live siblings. After: exact path is dataRoot/session-workspaces/business/instance/session, outside the legacy root; canonicalized ancestor/descendant overlap refuses; T2 nesting mutant covers historical mount/inspection and a legacy project named sessions. All other r2 content retained as approved, revision label updated. Verification: old nested path absent, manual R1-only delta, whitespace and installed queue guard checked; no code/builds/suites/live changes/provider calls/credential reads.

adapters/README.md

@@ -75,8 +75,7 @@ session's workspace and its own process group. Same contract, plus:
 | `MOSAIC_POLICY_FILE`, `MOSAIC_TOOLS_FILE` | The bundle's gate policy and typed tools. |
 | `MOSAIC_TOOL_SOCKET` | The runner's tool socket, which the typed tools call. |
 | `MOSAIC_TURN_MARKER` | `pi`: the extension writes it at `agent_end`; a pi turn that exits 0 without it failed. |
-| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. The pi module names two: the gate and typed tools extension, then the unslop check's `tools/unslop-hook/extension.ts` (row 66). |
-| `MOSAIC_UNSLOP_LOG` | The unslop check's JSONL log, `<run>/unslop.jsonl`, which the runner sets for both adapters and reads after each turn (row 66). |
+| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. |
 | `MOSAIC_CLAUDE_SETTINGS`, `MOSAIC_CLAUDE_MCP_CONFIG` | `claude` only: the bundle's gate hook and MCP server; required. |
 | `MOSAIC_THINKING` | The route's thinking level (row 65), which the harness module's `levels()` already checked. `pi` passes `--thinking` (`off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`) and omits it when unset, as for `run-task.sh` workers. `claude` passes `--effort` (`low`, `medium`, `high`, `xhigh`, `max`) and requires it; unset exits 2. |
 | `MOSAIC_CLAUDE_BIN` | `claude` only: absolute path of the CLI to run, from the host's environment (the bus unit pins it). Unset or empty runs `claude` from `PATH`; a relative path or a non-executable file exits 2. |
@@ -111,18 +110,3 @@ argument, which Linux caps at 128 KiB; row 213 passes the file instead, so no
 local user reads the prompt in `/proc/<pid>/cmdline`. Pi 0.85.1 uses the path
 string itself as the prompt when the file is missing or can't be read, so the
 pi adapter exits 2 unless the path is a readable regular file.
-
-### The unslop check (row 66)
-
-Both adapters run the mechanical writing check from `tools/unslop-hook`,
-driven by one `lists.json`. `pi` loads it as its second `-e` extension.
-`claude` runs `claude-hook.js` from the bundle's `settings.json`: the Stop
-hook checks the turn's replies, and the UserPromptSubmit hook adds the
-correction notice as context on the next turn when the last reply had
-tells. Each hook command ends `; exit 0`, so neither blocks. Both log to
-`MOSAIC_UNSLOP_LOG`, and the runner adds a note for the operator to the
-next RESULT it sends (`packages/harness/README.md`, the runner). The
-harness modules mount the three files read-only at their own paths, and
-the manifest records their digests. `MOSAIC_UNSLOP_HOOK` and `UNSLOP_LISTS`
-aren't in the session environment's allowlist, so a managed session can't
-switch the check off or swap its lists.

agents/darkwing/work/queue-251/BUILD.md

@@ -1,191 +0,0 @@
-# Row 251 build: T27 lists no identities right after `ssh-add -t 1` (Vikunja #453)
-
-Brief `docs/plans/2026-10-21_t27-ssh-add-lifetime.md` (rev 2931), Mos ruling mos-1185 item 2, assigned in
-sage-2075. Owner Darkwing, reviewer Dewey, gate owner Sage. Branch `darkwing/row251` from 3b0aef995,
-claimed in-progress at rev 2938.
-
-## Step 1: the failure names its cause (e5e4b2e5a)
-
-T27's two lists now carry a message that prints only when they fail. It gives the time from addKey's
-start to its resolve and to each `ssh-add -l` call, the hrtime at each with how far into its second it
-fell, `/proc/uptime` at each, and whether the agent process and its socket were still there. The checks
-themselves did not change. The commit holds nothing else.
-
-## Step 2: the cause
-
-ssh-agent counts a key's lifetime in whole seconds of CLOCK_BOOTTIME, at the add and at the reap. I read
-OpenSSH 10.5p1, the version on dragon-lin (`ssh -V`: OpenSSH_10.5p1), at tag V_10_5_P1 (ssh-agent.c
-sha256 873691c4, misc.c sha256 ee467f43):
-
-- `misc.c:1790-1798` and `:1828`: `monotime()` returns `ts.tv_sec` of `clock_gettime(CLOCK_BOOTTIME)`,
-  falling back to MONOTONIC. The fraction of the second is dropped.
-- `ssh-agent.c:1315`: the `-t` constraint sets `*deathp = monotime() + seconds`. Lines 1410 and 1598
-  do the same for the agent's default lifetime.
-- `ssh-agent.c:1064`: the reaper drops a key when `now >= id->death`, `now` being `monotime()` again.
-- `ssh-agent.c:2650`: the main loop runs `reaper()` after every poll, before it reads requests. A list
-  that arrives after the boundary sees the key gone.
-
-So a key added at second s plus a fraction f dies at s + N, and `-t N` keeps it N - f seconds, between
-N - 1 and N. With `-t 1`, an add late in a second leaves the key milliseconds to live. That matches
-Sage's probe in the brief: 8 of 80 `-t 1` adds missed, each one made at 0.9947-0.9973 of a monotonic
-second and finished at 0.998-0.0008, and none earlier in the second missed. It also matches proof 5's
-failure, where the first list ran 31.9 ms into the test and found no identities.
-
-Node's hrtime is CLOCK_MONOTONIC. BOOTTIME differs from it by the time the host spent suspended. On
-dragon-lin the difference read 0.000001 s at 19:09Z, so a monotonic second boundary is a BOOTTIME one
-here.
-
-`addKey` and the agent start are not the cause. `addKey` passes the lifetime through as `-t`
-(`host-run.mjs:90`), and the agent starts with no default lifetime (`:175`). Production adds the key
-with `timeout + 30` (`:180`), where losing up to a second makes no difference. The only caller that
-can't afford the lost fraction is T27, which asks for 1 s. The fix belongs in the test's lifetime choice,
-and `host-run.mjs` doesn't change.
-
-The slot confirms this against T27 itself (below), not just from the source.
-
-## Step 3: the fix (this commit)
-
-T27 adds the key with `-t 2`. The agent then keeps it more than 1 s and at most 2 s. The first list
-runs milliseconds after the add, so it has over a second of margin even under load. The sleep before
-the second list grows from 2.5 s to 3.5 s, which keeps the old 1.5 s margin past the new 2 s ceiling.
-Both checks stay: listed after the add, gone after the lifetime. A comment above the add says why the
-lifetime is 2.
-
-I considered `-t 3` with a 4.5 s sleep for a 2 s floor. One second of floor is far above anything the
-first list has needed (31.9 ms in proof 5), and the concurrent-suite run below tests it under load, so I
-took the smaller change.
-
-## Base
-
-The branch stays on 3b0aef995. By 19:15Z origin/refactor was at 6096b051b, after rows 66 and 243
-landed. `git diff 3b0aef995 6096b051b` touches neither `packages/bus/src/host-run.mjs` nor
-`packages/bus/tests/host-run.test.mjs`, so there's no rebase (sage-2084). Row 243 did change
-`packages/bus/tests/process.test.mjs`. My slot's bus suites run that file as it was at 3b0aef995, and the
-gate rerun on Sage's slot runs it as landed.
-
-## Prediction for part A on e5e4b2e5a (written before the slot)
-
-The hook starts `ssh-add -t 1` at the given fraction of a monotonic second. From the brief's probe, the
-agent stores the key about 3 ms later. The first list reaches the agent a few ms after addKey resolves:
-Node's exit event, the mark, and `ssh-add -l`'s own start. A red needs the add to land before the second
-boundary and the list to land after it.
-
-- 0.990: green. The add and the list both land before the boundary.
-- 0.993, 0.995, 0.996, 0.997: red expected. The add lands before the boundary, the list after. At 0.993
-  and 0.997 I'm less sure, because the list (at 0.993) or the add (at 0.997) can land right at the
-  boundary. A green at either is in line with the cause, and so is a red.
-- 0.998: green. The add lands after the boundary, so the key gets almost a full second.
-
-Every red should show "first list got" an answer with no SHA256 line. It should also show addKey
-resolving before a second boundary and the first list starting after it or within a few ms of it, with
-the agent alive and its socket present.
-
-Under sage-2084's rule, on e5e4b2e5a only a red at 0.990 or 0.998 counts toward the stop, and two such
-reds stop the run. On the fix commit any red counts, and two stop it. In parts B to D, the first red stops
-the run.
-
-## Slot plan
-
-All scripts are in `/mnt/storage/scratch/darkwing-251-out/`, launched from `/`, each behind the busy
-checks and chained with `&&`, TMPDIR under `/mnt/storage/scratch/tmp`.
-
-1. Confirmation. `align-hooks.mjs` is a load hook, outside the repo, that serves `host-run.mjs` with
-   `addKey` wrapped to start `ssh-add` at a chosen fraction of a monotonic second. T27 runs unchanged
-   under it, alone (`--test-name-pattern`). It runs at fractions 0.990, 0.993, 0.995, 0.996, 0.997 and
-   0.998, three times each:
-   - on e5e4b2e5a (step 1, `-t 1`). Expected: some first lists fail, and the step 1 message shows the
-     add's resolve and the list on either side of a second boundary, with the agent alive and the
-     socket present. These reds are the point of the run.
-   - on the fix commit (`-t 2`). Expected: all 18 pass.
-2. `host-run.test.mjs` whole, once, on the fix commit.
-3. The bus suite whole, three times in a row.
-4. The bus suite whole in two clean worktrees at the same commit, started together.
-
-## Slot results
-
-Sage's CLEAR came in sage-2154 at 20:58:55Z. `slot-251.sh` ran parts A and B from 20:59:22Z to 21:01:33Z,
-on node v26.8.1 and OpenSSH_10.5p1, with TMPDIR `/mnt/storage/scratch/tmp/r251`. At the start, BOOTTIME
-minus MONOTONIC read 0.000001 s, then 0.000000 s twice (dewey-0769 N1). So the hrtime fractions below
-put the agent's second boundary in the right place.
-
-### Part A: T27 alone under `align-hooks.mjs`, 3 runs per fraction
-
-The fraction is when the hook started `ssh-add`. The hook logged each start within 0.0001 of its target.
-
-| fraction | e5e4b2e5a (`-t 1`) | 68f2dfd4b (`-t 2`) |
-|---|---|---|
-| 0.990 | 3 pass | 3 pass |
-| 0.993 | 3 pass | 3 pass |
-| 0.995 | 3 red | 3 pass |
-| 0.996 | 3 red | 3 pass |
-| 0.997 | 3 pass | 3 pass |
-| 0.998 | 3 pass | 3 pass |
-
-e5e4b2e5a went red 6 times out of 18, every time at a fraction the prediction named, so none of them
-counted toward the stop. 68f2dfd4b passed all 18. The fix runs used 68f2dfd4b, whose test blob is the same
-as c19b4167e's (280132c7).
-
-Every red failed on the first list and got `"The agent has no identities.\n"`, with the agent alive and
-its socket present. The step 1 message gave these hrtime fractions. "addKey start" is the mark before the
-hook's wait, so its fraction is earlier than the ssh-add start.
-
-| run | addKey resolved | first list mark |
-|---|---|---|
-| 0.995 rep 1 | 0.9992 (+317.6 ms) | 0.9993 |
-| 0.995 rep 2 | 0.9991 (+846.5 ms) | 0.9991 |
-| 0.995 rep 3 | 0.9988 (+845.0 ms) | 0.9988 |
-| 0.996 rep 1 | 0.9999 (+839.8 ms) | 1.0000 |
-| 0.996 rep 2 | 0.0004 (+845.0 ms) | 0.0004 |
-| 0.996 rep 3 | 0.0002 (+835.9 ms) | 0.0002 |
-
-At 0.995 the add finished about 4 ms in, before the boundary, and the list mark came just before it. The
-`ssh-add -l` process then reached the agent after the boundary. At 0.996 the agent stored the key before
-the boundary, and addKey resolved just after it. In both cases the key's whole second ended between the
-add and the list, which is the cause step 2 gives. The two edge fractions came out green on the first
-build. At 0.993 the list still reached the agent before the boundary, and at 0.997 the add landed after
-it, so the key got almost a full second. The prediction allowed either result at those two.
-
-### Part B: `host-run.test.mjs` whole on 68f2dfd4b
-
-24 tests, 24 passed (21:01:18Z, 14.0 s).
-
-### The stop before C1, and the resume
-
-At 21:01:33Z the script stopped before C1, with exit 4 and no red. My own `busy.sh` matched two `sleep 60`
-processes, mine, in `darkwing-r251/packages/bus`. Part B left them. They come from T27 "the start sweep
-keeps a live bus dir and kills only a matching live process" (`host-run.test.mjs:528` and `:536`). Its
-`t.after` SIGKILLs the `/bin/sh -c 'sleep 60; :'` parent, but the `sleep` child lives on for up to 60 s.
-That code is outside this row's diff, so the row leaves it alone, and it's recorded below as a follow-up.
-Sage confirmed (sage-2159) that the right move is to resume only the scope that hadn't run.
-
-`slot-251-cd.sh` runs C and D as `slot-251.sh` has them, with the same two busy checks. Before each check,
-it waits up to 75 s for those orphans to exit: my uid, my trees, a command line of exactly `sleep 60`.
-It logs them as it waits. Any other process still trips the checks.
-
-### Parts C and D: the bus suite whole on 68f2dfd4b
-
-| run | start | tests | pass | fail | time |
-|---|---|---|---|---|---|
-| C1 | 21:02:48Z | 598 | 598 | 0 | 21.6 s |
-| C2 | 21:04:06Z | 598 | 598 | 0 | 21.4 s |
-| C3 | 21:05:26Z | 598 | 598 | 0 | 22.1 s |
-| D1, darkwing-r251 | 21:06:44Z | 598 | 598 | 0 | 24.2 s |
-| D2, darkwing-r251b, TMPDIR `r251-b` | 21:06:44Z | 598 | 598 | 0 | 24.2 s |
-
-The script waited 33 s before C2, 34 s before C3, 33 s before D and 32 s before the sweep. Each time it
-was waiting for that run's `sleep 60` orphans (two per suite, four after D), and nothing else. After the
-wait, the sweep of my trees, the out dir and TMPDIR found 0 processes left (21:08:04Z). Sage confirmed
-(sage-2159, sage-2160) that the short gitea-api and `node --check` runs they made during the slot weren't
-stops. None of my busy checks refused on any of them.
-
-These runs used the bus files as they were at 3b0aef995. Since then, origin/refactor (666173292, then
-7247d80c7 and c3d88840c with row 196) has changed `broker.mjs`, `runtime.mjs` and `server.mjs`, which T27's
-file imports, along with other bus files. None of those commits touch this row's two paths or
-`host-run.mjs`, and `git merge-tree` of c3d88840c with 68f2dfd4b is clean. The gate rerun in
-a clean worktree on Sage's slot runs T27 against them.
-
-### Follow-up, not in this row
-
-T27's start-sweep test leaves the `sleep 60` child of each planted shell running for up to 60 s after
-the test. Killing the process group (`process.kill(-pid)`; both shells are spawned `detached`) or
-`exec sleep 60` in the shell would end the child along with its parent.

agents/gizmoduck/work/queue-250/BUILD.md

@@ -1,100 +0,0 @@
-# Row 250 build notes (Gizmoduck)
-
-Vikunja #450, Mos ruling mos-1182 item 3. Brief: docs/plans/2026-10-21_k12-cohort-events.md. Reviewer
-Filbert, gate owner Sage. Branch gizmoduck/row250 from origin/refactor 3b0aef995. Line numbers below are on
-this branch unless a commit is named.
-
-## Step 1
-
-cbba6ff07 changes only the K12 assertion (packages/conversation/tests/cohort.test.mjs:292 on 3b0aef995).
-On failure it prints the shim's answer, with `ok` and `unavailable`, and `h.ctrl.evidence.releases`.
-
-## Step 2: the cause
-
-K12 reads the shim after the controller has started to release it.
-
-- The force stop sets the binding `stopped` (packages/conversation/src/controller.mjs:1615). Then it pauses at
-  `scope-release` (:1623) and calls `#releaseScope` (:1624).
-- `#releaseScope` calls `releaseCohort` (:1639). That sends `hello`, then `release`
-  (packages/conversation/src/cohort.mjs:261-265).
-- The shim answers `release` and exits 10 ms later. It unlinks its socket first (shim.mjs:165-176). systemd
-  then collects the empty scope, `engine` included.
-- K12's `forceStop` helper returns once it sees `stopped` (cohort.test.mjs:148, polling every 10 ms). The
-  test then reads `engine/cgroup.freeze` (:281 on 3b0aef995) and asks the shim for `events` (:291).
-
-Nothing in K12 orders those reads before the release. Unloaded, the test usually sends its `events` request
-within the 10 ms before the shim exits, so it passes. Under load the release wins. `shimRequest` then
-returns `{ ok: false, unavailable: "the shim socket is gone" }` (cohort.mjs:46), or "unreachable" or
-"closed the connection" (:62-63), and `ev.populated` is undefined. Both recorded failures fit this
-pattern:
-
-- Row 197 proof 4, pair1-b: K12 failed in 339 ms on `undefined !== 0` at :292. 339 ms is far below the
-  3 s `shimRequest` timeout (cohort.mjs:56), so the request didn't time out. The `cgroup.freeze` read at
-  :281 passed, so the scope still existed then.
-- BUILD-LOG.md:4092, row 56's gate: "`populated` undefined with load around 12".
-
-Row 50 (a9cc522a0, #1536) added the release after a proven stop. K12 is older. Its comment still says
-"the shim holds the scope", and that stopped being true in row 50. E1 (cohort.test.mjs:923-925) already
-holds `scope-release` so it can read the shim while the shim still answers. K12 never got the hold. No
-other test reads the shim after a proven stop and expects an answer. R1 expects the shim gone, R3 is an
-uncertain stop, and K15 reads before its stop.
-
-The cgroup read itself has no race. The kill's `waitFor` (shim.mjs:117-126) had already read `populated 0`
-for the stop to be proven. The read is the shim's call to `events()` (shim.mjs:83-96), and it reads one
-kernel file. So the brief's allowance for a bounded retry doesn't apply, and there is none.
-
-The fix goes in the test's setup, which the brief allows ("Use the shim, the cohort controller or the
-test's setup and teardown, whichever the evidence points to"). The controller's release is correct and
-specified (README "Scope release", R1). Delaying it for a reader would change row 50's behavior.
-
-## Step 2: the change
-
-packages/conversation/tests/cohort.test.mjs, K12:
-
-- It runs with `gate()`, holds `scope-release` before the stop, and waits until the hold is reached. Then it
-  does every read that needs the scope: `cgroup.freeze`, `events` and `members`.
-- After the reads it lets the release go and asserts one entry, `["force-stop", "released"]`. This is new
-  coverage: K12 now also shows the forking cohort's scope released.
-- The assertions are unchanged. `populated` must be 0 and the member list must be empty. The step 1 message
-  stays.
-
-packages/conversation/src/shim.mjs:167-168, `release` (:167 on 3b0aef995). It answered a failed `events()` with "the engine
-cgroup is not empty", so it reported unavailable as not empty. The refusal was already safe, but the reason
-was false. Now an `events()` answer that isn't `ok` is returned as it is, with the read's own reason. Only
-`populated` 1 gives "not empty". Nothing else matched that string (grep of packages/).
-
-## Tests
-
-- K12 as above.
-- R13, the brief's new case, placed after R3. After a proven stop, with `scope-release` held, the test makes
-  `engine/cgroup.events` mode 000. Then:
-  - `events` returns `ok: false`, has no `populated`, and the reason is "engine/cgroup.events unreadable
-    (EACCES)".
-  - On release, the controller records one entry `["force-stop", "unavailable", <that reason>]`.
-  - The unit stays active, and the shim still answers `hello`.
-
-  Then `close()` reuses the stop's release, so there is still one entry. The `finally` closes the
-  controller again (a second close is a no-op), restores mode 444, the kernel's mode for cgroup.events,
-  and releases the scope. On
-  3b0aef995's shim.mjs, R13 fails on the reason, because it reads "the engine cgroup is not empty".
-- K15 already covers a stop, as opposed to a release, with `events` unavailable: the shim gone, the file
-  mode 000, or `engine` missing, each ending `uncertain` with its reason.
-
-## File added beyond the brief
-
-packages/conversation/README.md:599 listed "R1–R3, R5–R12" for cohort.test.mjs. With R13 it now reads
-"R1–R3, R5–R13". The brief's files don't include the README. Sage added it to this row in sage-2082.
-
-## Runs
-
-None yet. They need Sage's slot. Sage's sage-2082 says the run is on the pushed candidate in a clean
-worktree, and that it adds the control-board suite whole, so it counts as the gate run.
-
-## Round 2
-
-Filbert's C1 (#1755 comment 30125): R13 never closed its in-process controller, so the controller's
-socket server (controller.mjs:548) stayed open, and `reap` only kills units and engines. Only `close()`
-closes it (:1789). R13 now calls `h.ctrl.close()` after its checks and asserts one release entry, as R2
-does. Its `finally` also closes the controller, for a failure partway through. The second close is safe:
-`server` is null by then (:1791), and `#releaseScope` returns the cached release (:1634-1648). Branch
-gizmoduck/row250-r2, on e9cfd92f8.

agents/herb/work/queue-197/BUILD.md

@@ -1,432 +0,0 @@
-# Row 197 execution ledger
-
-Plan: MANIFEST.md r2, approved by Webby ca6b32d66.
-Build grant: sage-1390. Suites, image builds and paired proof are not granted.
-Rebased five documentation commits onto origin/refactor aa1bd209e before code.
-Existing worktree herb/row197 and plain node_modules symlink retained.
-
-- T1 preflight/steps: in progress.
-- T2 locks/status/recovery: pending.
-- T3 image/Docker: pending.
-- T4 fixtures/timing: pending.
-- T5 evidence/acceptance: historical timing done; implementation pending.
-
-Preflight interfaces: T1 RunPaths supplies T2 ownership and T3 image checks.
-T2 run receipt supplies T4 lane/port state and T5 attribution. T3 image identity
-is checked before Docker-bearing steps. T4 timings supply T5 pair summaries.
-No interface conflict found. No product API or assertion changes are authorized.
-
-Ruling: use this approved BUILD.md as the execution ledger, rather than adding
-skill workspace paths outside the manifest. This preserves the reviewed path
-boundary. Missing ledger detail would cost recovery time, not product behavior.
-
-## Implementation checkpoint 2026-10-20T20:11:58Z
-
-T1-T5 source is present within the approved manifest. Full acceptance is pending.
-Fresh single-file checks: preflight/supervisor 6/6; state/recovery 11/11; image and
-Docker guard 4/4; port leases/attribution/proof summary 3/3. No skips or failures.
-Existing files checked singly: board serve; WebUI serve, preview, proof-cli,
-tester-cli and service; harness pi and Claude. Stack-release R1 selected single
-passed 1/1. WebUI service also passed 31/31 with lane-a leases and a 30-byte root.
-All existing assert lines are unchanged. Shell syntax and diff checks pass.
-
-Observed defects fixed during the single-file cycles: cancellation incorrectly
-returned zero when a TERM handler exited zero; recovery did not supersede an
-unclean terminal; status omitted the lock-before-receipt window. Evidence logs
-retain the failing and passing observations. Source still has no commit because
-applicable suites have not run. No image build, proof, push or live operation.
-
-Ruling: use an instrumented single-lane author gate on a frozen dirty-source
-clone before committing source. The new wrapper requires a clean candidate and
-proven image receipt, while repository rules require green suites before source
-commits. The author gate retains every suite and assertion, caps concurrency at
-two, uses own port/state/temp/project roots, and guards Docker against builds.
-Cost if wrong: the author gate fails; clean-candidate wrapper baselines and the
-paired proof remain mandatory after source is verified and committed.
-
-Ruling: publish the initial run directory atomically after the start receipt is
-complete. This avoids a second lane observing a partially written start. A
-crash before publication has started no test or mutable Docker operation.
-Cost if wrong: a lane refuses or quarantines; no protected state is bypassed.
-
-## Implementation review corrections, 2026-10-20T20:33Z
-
-Webby-0029 reviewed the first implementation packet at f942bd7d4.
-B1 identified missing manifest tests. B2 identified a test that leased both real
-bands through a private lock namespace. The old author-gate clear was withdrawn
-in herb-0019. SOURCE.json, BUILD.patch and gate.sh still describe the old frozen
-clone. They are not a clear for the edited working tree. No author gate ran.
-
-B2 correction: the helper test uses only the active lane and MOSAIC_GATE_STATE.
-It compares the other band arithmetically and has no unasserted listener. The
-occupied-port probe first obtains its own real lease, binds that port, and
-asserts that its sentinel listener survives refusal. No test reserves another
-lane's band. Exhaustion narrows only the test process's band to one owned port.
-
-B1 coverage added within the existing approved paths. No case is dropped:
-
-| Manifest case | Added check |
-| --- | --- |
-| T1 canonical and builder checkout, existing output | gate-lane.test: direct validateRun refusals |
-| T1 92-byte socket and over-107-byte socket | exact design example with a distinct gt- test root; 108-byte refusal |
-| T1 both candidates carry tooling | validateTooling compares each launcher file, including missing and changed cases |
-| T1 duplicates and NODE_TEST_CONTEXT | repeated package/script fixture is retained; sanitized environment is exercised by both supervised children |
-| T2 one-winner race and inherited FDs | two actual shell wrappers race; a controlled supervisor verifies held FDs, and its child checks that no FD points to either lock file |
-| T2 same checkout and legacy claim refusal | activeConflicts uses synthetic process observations with a live lane and a sibling landing gate |
-| T2 surviving child and interrupted recovery | locked recovery kills a child proven by the private root, preserves a foreign child, is killed during fake Docker cleanup, leaves quarantine, and resumes under a new fixture grant |
-| T3 missing receipt and missing image | verifyImage refuses absent provenance and failing inspection |
-| T3 tag changed mid-gate and at gate end | runGate now uses the same executePinnedSteps boundary exercised by the tests; the next step never runs after a changed ID |
-| T3 mutable-tag rebuild | fake preparation returns a new image ID with identical input digest; the old receipt refuses it |
-| T3 cold and warm counters | preparation records one build and its time; warm execution records zero builds; repeated verification never builds |
-| T4 parallel test-file leases | two generated Node test files hold ports in the same lane/state; locks are checked during child execution and shutdown |
-| T4 exhausted band, occupied port and foreign listener | a one-port process-local band refuses both a held lease and an existing sentinel listener; the listener survives |
-| T4 owner death | a killed allocator releases only its own holder; a foreign lease remains held |
-| T4 lease through child shutdown | parent probes the lock while the fixture test runs and after its child has stopped |
-| T4 fixtureCacheEnv | replacement child environment writes only under separate tmp, jiti and cache directories |
-| T5 unrelated session append | a separate process waits for a running-step barrier, appends under a fixture HOME, and remains unrelated in the resulting metadata attribution |
-
-N1 removes the unused closed binding. All leases reserve an unbound endpoint;
-existing closed options need no call-site change. N2 makes child TMPDIR a tmp
-subdirectory. N3 normalizes ss interface scopes before checking port 9. N4 uses
-gt- for unit run roots. N5 documents the canonical node_modules dependency.
-N6 is recorded: row 200 also edits stack-release.test.mjs; the second landing
-must rebase and rerun that file singly. Sage was told in herb-0019.
-
-Before Sage's hold, expanded preflight tests passed 11/11, state tests 14/14,
-image tests 7/7, and the pi/Claude singles passed 8/8 each with separate tmp
-subdirectories. Later source/test edits still need verification. In particular,
-the new parallel test-file probe had a cleanup-order defect and is unverified.
-Its root cleanup ran before child shutdown. Cleanup now stops children before
-removing their root. Output is retained for a useful failure report. The initial
-FD probe also assumed Node did not reopen FD numbers; it now checks the actual
-lock targets. The early passing fixture file covered child allocators, before
-they were changed to actual generated test files. It is not acceptance of the
-latest file.
-
-Sage-1448 stopped all node --test runs at 20:30Z for Rocko's browser slot.
-The remaining owned process tree was stopped at 20:30:32Z. Inspection found no
-remaining owned test processes afterward. Edits and static inspection continue.
-20 module syntax checks, shell syntax and git diff checks pass. Existing-file
-assertion lines remain identical to HEAD. No test is run during the hold.
-
-Next: after Sage passes Rocko's clear, verify the corrected files singly,
-including a lane-env helper-file check. Then refresh the frozen clone and all
-three packet artifacts, send their hashes, and request a new author-gate clear.
-Suites, image builds and paired proofs still need their own grants. No source
-commit, push, suite, real Docker build or paired proof has run in this phase.
-
-## Refrozen review packet, 2026-10-20T20:41Z
-
-Sage-1454 lifted the single-file hold. Fresh runs passed without failures or
-skips: review-t1-resume.log 11/11, review-t2-resume.log 14/14,
-review-t3-resume.log 8/8, review-t4-resume.log 8/8. The helper file also passed
-8/8 with lane-a environment in review-t4-lane-a.log. Its retained state had only
-an a port-lock namespace, no b directory, and every lock was released. Generated
-fixture Node test entries explicitly use --test-concurrency=2. The child-test
-probe now finishes and cleans up before removing its root. All 41 new tests pass.
-
-B1 and B2 fixes are ready for Webby's review. No manifest case was dropped.
-All 25 source paths were copied to a new frozen clone and compared by mode and
-SHA-256. This supersedes the earlier withdrawn source packet:
-
-- SOURCE.json: 91ba149f2fc039a8bed0e6d1ad5da44b80fb8cbec84d0fa4e38616040138596b
-- gate.sh: 48e06e23e45d3484755f8cd79ad5b6dfde5ef4f960081e7c455a2540e707fed1
-- BUILD.patch: 0b3871bd9848ca223c7cda50266debc04643e5d986eb7f0fece096aaf25ff43e
-- Frozen checkout: /mnt/storage/scratch/mg197-a-d22dacd92735/wt
-- Output: /mnt/storage/scratch/mg197-a-d22dacd92735/out
-- Temporary root: /mnt/storage/scratch/ga-VPXhG7 (30 bytes)
-- Compose project: mg197-a-d22dacd92735
-
-After an explicit author-gate grant, run this command with Sage's actual ID:
-
-```sh
-env MOSAIC_GATE_GRANT=ACTUAL_SAGE_GRANT_ID bash /home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/agents/herb/work/queue-197/gate.sh > /mnt/storage/scratch/mg197-a-d22dacd92735/out/gate.log 2>&1
-```
-
-No gate or suite has started. Queue order from sage-1454 is 192, 201, 204,
-200, Gander, then 197. No branch deletion is authorized or attempted. Any later
-rebase uses a new branch name, and pr-merge.sh -d stays off under #426(a).
-Whichever of rows 197 and 200 lands second must rerun stack-release singly.
-Clean-candidate wrapper baselines, image preparation and paired proofs remain
-separately gated acceptance work. There is still no source commit or push.
-
-## Implementation approval and final notes, 2026-10-20T20:47Z
-
-Webby-0031 approved r2 in REVIEW-impl-r2.md at 1f404c973. Their static review
-verified every source hash/mode and patch result, and all B1/B2 cases. No queue
-review request comment exists yet; Sage owns creating it if needed.
-
-Folded all three optional notes into the same approved paths. The helper file's
-standalone fallback now shares /mnt/storage/scratch/mosaic-gate-lanes with real
-lane-a leases and leaves its stable lock files in place. Band assertions use the
-imported BANDS. Both T5 polling children fail after five seconds if their barrier
-is missed. README records the shared standalone namespace and deadlines.
-
-Fresh single-file logs review-r3-fixtures.log and review-r3-lane-a.log both pass
-8/8 with zero skips. The lane-a run has no b lock directory, and every lock was
-released. Syntax and diff checks pass. No existing test assertions or timeouts
-changed. Remaining source matches the 11/14/8-file checks from r2.
-
-Refreshed all 25 source rows in the existing frozen checkout. New digests replace
-the preceding r2 packet. gate.sh and its command are unchanged:
-
-- SOURCE.json: 3584763642506e81a532c839bdd07b111d25daa87e35dbe441d8e8c01a2c2aab
-- gate.sh: 48e06e23e45d3484755f8cd79ad5b6dfde5ef4f960081e7c455a2540e707fed1
-- BUILD.patch: 55fe390da17ab926a0593d39e79561abe52756a1b1a2c756ec57f45d90f10fde
-
-Author gate remains unstarted and queued for Sage's explicit grant. No source
-commit, suite, image build, paired proof, push or branch deletion ran.
-
-## R3 approval receipt
-
-Webby-0033 approved r3 in REVIEW-impl-r3.md at a5643f9bd. Static review verified
-the three packet hashes, all 25 source rows, and the patch result. Their review
-accepts N1-N3; no additional hang-guard test is requested. No queue review request
-comment exists yet, so Webby has not recorded a queue review.
-
-Read-only verification after receipt confirms that the approved packet hashes
-and all 25 worktree/frozen source hashes and modes still match. Source and gate
-script stay frozen. The author gate has not started and still needs Sage's grant.
-
-## Queue review round 1
-
-Sage-1476 authorized moving row 197 to in-review before the author gate.
-Created CANDIDATE.sha256 from the same 25 reviewed SOURCE.json rows. Its digest
-is 6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3.
-Ran the queue move from the canonical checkout with op herb-197-review-r3.
-The move succeeded at revision 2395, opening round 1 on #1695. The request post
-failed before send because MOSAIC_GITEA_CREDENTIAL_FILE is not set; revision 2396
-records the failed outcome. Exit code 1 describes the failed post, not a failed
-row transition. Read-back confirms state in-review and the correct candidate.
-Sage will post as jarvis and give Webby the request comment number. No credential
-lookup, alternate post or retry was attempted here.
-
-SOURCE.json, BUILD.patch, gate.sh and all 25 frozen source rows remain unchanged.
-Latest slot order is row 190 r2, 201, 204, 200, Gander, then Herb. No gate starts
-before Sage sends an explicit grant ID.
-
-## Follow-on assignment
-
-Sage-1503 assigns row 215, Case 2 C2-04, to Herb after row 197 (queue rev 2455,
-Gosalyn design r11). Read docs/plans/2026-10-20_case2-rows.md, C2-04 section,
-at 5b8def2f1 when starting that row. Its required base is origin/refactor
-305857c8f. This assignment does not replace row 197 or authorize its gate.
-Keep row 197's approved source frozen while awaiting Sage's grant. Start row
-215 only after row 197, using a new branch name under the existing fleet rule.
-
-## Round 2 merge preparation on row 233
-
-Sage-1757 replaces history replay with one candidate commit on 57f59e0c3.
-The attempted history replay on herb/row197-r2-233 had already finished when
-that instruction arrived. Its only conflict was the append-only BUILD-LOG tail.
-That branch remains for history; none of its replayed commits is in this round.
-The current branch is herb/row197-r3-233, directly from
-57f59e0c399ce29b1bb85ca6af686fdc10eb195d.
-
-Stash correction: shared refs/stash was used incorrectly. The exact entry
-2767b88549dfd8c7e810908b5416876fa50cb571 is now kept on
-herb/row197-r3-wip. After verifying stash@{0} still named it, only that entry was
-dropped. The two other entries remain. No further stash creation, force push,
-branch deletion or refs/stash mutation is planned. A separate working-copy
-backup is /mnt/storage/scratch/herb197-merge-W4oiLg.
-
-Sage-1760 requires preserving every landed hunk on every changed manifest path.
-Checked each of the 25 r1 paths with git diff aa1bd209e 57f59e0c3 -- PATH.
-Exactly three changed upstream. Their r2 diff against 57f59e0c3 is captured in
-r2-merge-only.patch:
-
-| Merged path | Only row 197 changes against landed base | Landed content retained |
-| --- | --- | --- |
-| packages/cli/tests/stack-release.test.mjs | leasePort and laneAfter imports; freePort now calls the lease helper | All landed tests, including row 233's tests after R15 and BACKUP_STORE checks |
-| packages/webui/tests/service.test.mjs | leasePort and laneAfter imports; closedPort now calls the lease helper | SEND_REFUSAL permits --sso; default unit rendering removes the @CONFIG_ENV@ line |
-| scripts/test-discord.sh | fixture PI_CODING_AGENT_DIR setup; optional two-worker nested Node cap | Row 190's absent scratch MOSAIC_CONFIG selection and caller-config restoration |
-
-The other 22 paths equal the r1 reviewed source bytes and modes. r2-MERGE.json
-lists every path, its r1/r2 digest, mode, upstream-change flag and equality result.
-Source copies came from the hash-verified r1 frozen checkout. Original r1 digest:
-6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3.
-No existing assertion or timeout line differs from the landed base. Static
-checks only: 20 module syntax checks, four shell syntax checks and git diff check
-pass. BUILD-LOG.md equals 57f59e0c3 byte for byte and is outside this commit.
-
-Sage explicitly requested the local candidate SHA before granting tests. This
-commit is an untested preparation checkpoint, not gate evidence. No tests or
-push are authorized yet. r2-TEST-FILES.txt lists the requested grant scope:
-16 Node test files singly and scripts/test-discord.sh, test-foundation.sh and
-test-queue.sh. The four stack-release consumers are stack-release.test.mjs,
-stack-release-external.test.mjs, stack-upgrade.test.mjs and stack-instances.test.mjs.
-The shared stack-release-fixture.mjs is exercised by its importing test files,
-not run as a standalone test. This covers all 13 touched Node test files plus
-three additional stack-release consumers and all three touched shell suites.
-
-Current slot order from sage-1760: Gizmoduck, Launchpad, Darkwing, then Herb,
-around 06:30Z. Wait for an explicit grant. After granted checks and authorized
-push, build the new candidate manifest from that pushed tip and open the
-merge-scoped round 2. Old SOURCE.json, CANDIDATE.sha256 and gate.sh remain r1
-historical artifacts and are not a clear to run the merged candidate.
-
-## Round 2 rebuilt on row 234
-
-Sage-1776 names landing c771a36f4bd0b6c359282425c668996a90072f93.
-Built a new branch, herb/row197-r4-234, directly from that landing. No history
-replay, stash, force push, branch deletion, test run or push is involved.
-The prior candidate a3b7cbde8 remains untested and is not the queued candidate.
-
-Checked git diff --name-only 57f59e0c3 c771a36f4 against all 25 source paths.
-Only packages/cli/tests/stack-release.test.mjs overlaps; the other 24 do not.
-The full comparison is in r2-on234-OVERLAP.txt. The stack-release file starts
-from the landing and keeps both T46 untimed entries, host_grants and hosts.
-Its only changes against the landing are the leasePort and laneAfter imports
-and freePort's call to the lease helper. r2-on234-merge-only.patch records those
-hunks. Existing assertions and timeouts match the landing exactly.
-
-Every other source path equals a3b7cbde8 byte for byte and retains its mode.
-This includes the previously merged service and test-discord files, preserving
-all landed --sso, CONFIG_ENV and scratch-config handling. The earlier evidence
-r2-MERGE.json still records those three pre-234 merge cases. The new
-r2-on234-MERGE.json records each current digest, prior digest, mode and equality
-result. BUILD-LOG.md equals the new landing byte for byte and is excluded.
-
-Static check of the changed Node file and the candidate diff pass. No tests
-were run. The scope stays r2-TEST-FILES.txt: 16 Node files singly plus the three
-shell suites. No manifest or queue round is rebuilt until granted checks and
-authorized push. Old SOURCE.json, CANDIDATE.sha256 and gate.sh remain historical
-r1 evidence. The test slot follows Darkwing 240 and needs Sage's explicit grant.
-
-
-## Round 6 preparation (sage-1883, mos-1162)
-
-New branch herb/row197-r6 starts at fefd54e13, after the standalone row
-212 landing ee7b2f137. No r5 manifest path changed between e7078e6a8 and
-this base; all 32 r5 blobs and modes were copied intact before the two
-umask changes. No history replay, stash, force push or branch deletion.
-
-executeSteps now launches each argv through /bin/bash with umask 022
-and exec, preserving the process group and argv boundaries. The supervisor
-and gate-lane.sh retain 077, including state, locks, private logs and roots.
-New gate-lane tests assert the actual child umask and created file mode,
-the unchanged parent mask, private log mode, and actual wrapper-created
-state/lock modes. No shell, image preparation, credentials test or other
-existing assertions changed. process.test.mjs equals the landed base;
-lane-image.mjs equals r5. N7 remains DEFERRED at fefd54e13; rows 243 and
-244 own the explicit chmod and PI_AUTH_FILE fixtures respectively.
-
-Read Sage's permitted failed pkg-bus log: process.test startup token refusal
-saw ready.ok true, consistent with inherited 077 narrowing its fixture mode.
-No further diagnostic read of the retained ga-8I3iZc root is needed.
-No r6 tests or probes have run. Source commit, push and new manifest await
-the explicit granted checks. r6-OVERLAP.json records the empty overlap.
-
-
-Sage-1892 focused grant: gate-lane.test whole 13/0, process.test whole
-through executeSteps 8/0, zero skips/cancellations. Syntax checks passed.
-All new umask/mode assertions passed. No Docker, image, lane or proof run.
-Empty /proc cwd/argv scan and removal recorded in r6-granted/cleanup.json;
-clear herb-0068 at 09:21Z. The source matches r5 on 29 of its 32 paths,
-including modes. Only BUILD.md, gate-lane.test.mjs and gate-lane.mjs differ.
-The new r6-OVERLAP.json records the base comparison. No process test edit.
-Sage-1895 authorizes one source commit and seat-only push after range check.
-
-
-## Round 7 preparation (sage-1951, sage-1955)
-
-The r6 proof passed all package suites with the original process.test,
-then failed script-release. The guard injected --no-build into compose run;
-Compose 5.5.1 rejects it before container creation. The old unit test only
-asserted the same invalid argv, so it could not detect this compatibility
-error. This supersedes no-build-flag claims in the historical packet.
-
-herb/row197-r7 starts at b1fece6f0. No r6 manifest path changed between
-fefd54e13 and this base; all 33 r6 blobs/modes were copied intact before
-r7 tests were authored. No history replay, stash, force push or deletion.
-Sage-1955 accepts the private tempRoot/compose-no-build.yaml override,
-mode0600, with build: !reset null and image pinned to the receipt's imageId.
-The guard owns the -f arguments and forces run --pull never --no-deps.
-Caller-supplied Compose config/build/pull options remain refused.
-The existing proof removes successful temp roots and retains failed roots;
-the override stays within that same cleanup ownership.
-
-Tests first: installed-binary run --help before SERVICE checks parser
-acceptance without starting a container. A separate compose config --format
-json check uses the actual candidate compose.yaml, made-up env/auth paths,
-and an empty Docker config directory, asserting no build key and the exact
-pinned image. The no-build-restoration mutant must fail that parser test.
-No test, probe or Docker command has run on r7; waiting for Sage's grant.
-
-Primary references: Docker's merge reference documents !reset null:
-https://docs.docker.com/reference/compose-file/merge/#reset-value
-Docker's run reference documents --pull and --no-deps, with no --no-build:
-https://docs.docker.com/reference/cli/docker/compose/run/
-Installed 5.5.1 acceptance and merged configuration are still unverified.
-
-
-Sage-1956 focused grant, 2026-10-21 11:19-11:21Z: busy check CLEAR.
-Whole gate-lane-image.test on the r6 guard: 9 pass, 2 fail. The installed
-Compose parser emitted unknown flag: --no-build; the other expected failure
-was the missing override helper. No cancellation or skip. After the fix,
-whole file 11/0. The committed r7-no-build.mutant.patch restores the invalid
-flag. Applied only for the installed parser regression: 0/1 with the same
-unknown-flag error, killed. Restored source and whole file passed 11/0 again.
-Both approved node --check commands passed. Empty /proc cwd/argv scan;
-clear herb-0073 at 11:21:04Z. No container start, image build, lane, proof or
-full suite ran. Logs/counts/scan are in r7-granted/ (local run evidence).
-
-The guard supplies both absolute -f paths, suppressing automatic override
-selection, pins receipt imageId, removes build via !reset null and adds
---pull never --no-deps. Its main entry publishes the override before Docker
-runs. A unique private staging file plus hard-link publication prevents
-partial writes or replacement under concurrent guard calls; existing bytes,
-mode0600, file type and ownership must match, with O_NOFOLLOW on reads.
-The file stays under the run's short private tempRoot for existing proof
-cleanup. Caller Compose options remain allowlisted and config/build/pull
-options refuse. The actual installed Compose config test reports no build
-key and the exact image ID; parser help is before SERVICE, so no container
-operation can run. Fixtures supply made-up env/auth paths and empty Docker
-configuration. Existing image provenance, cleanup and umask behavior remain.
-
-Range check: one source commit on b1fece6f0, same 33 r6 paths plus the
-mutant patch and r7 overlap receipt (35 paths). Thirty r6 paths retain the
-same blob/mode. Only lane-docker.mjs, gate-lane-image.test.mjs and BUILD.md
-differ from r6. process.test and BUILD-LOG equal the landing. No force push,
-branch deletion, history replay or other source edits. Sage-1956 authorizes
-the source commit and seat-only push; fresh proof remains Sage's action.
-
-
-## Round 8 preparation (sage-1979)
-
-The r7 D5 proof passed business and bus, then failed the two installed
-Compose probes in pkg-cli. Their subprocess fixture retained the lane's
-shim-leading PATH but omitted MOSAIC_GATE_DOCKER_RECORD, so the shim read
-an undefined path. This is a test context error; the production guard stays
-byte-identical to r7.
-
-New herb/row197-r8 starts at 5c6f73ed7. None of r7's 35 manifest paths
-changed from b1fece6f0 to this base. Tests choose the record's real absolute
-Docker path when a lane record is set; outside lanes they keep using docker.
-Only the two read-only help/config probes use this helper. The subprocess
-env still holds fixture-only configuration; the record need not propagate
-to it. No run or policy allowlist is widened.
-
-Sage-1979 grants 215's 16 singles first, then r8's normal and lane-shaped
-shim-leading PATH whole-file checks and the record-lookup-removal mutant.
-The shim fixture invokes the actual unchanged guard, with a private made-up
-record naming the real Docker binary. No image build, container start, lane
-or proof is part of r8 checks. No r8 checks have started yet.
-
-
-Sage-1979 r8 checks followed 215's early singles, then clear herb-0078 at
-2026-10-21 12:09:28Z. Whole gate-lane-image.test normal PATH11/0; whole
-actual guard-shim-leading PATH plus private record11/0. The committed
-r8-record-lookup.mutant.patch removes the lookup: installed-Compose argv
-regression0/1, killed with the original Received undefined path error.
-Restored code, repeated whole shim-PATH file11/0. All zero skips/cancellations.
-Logs/counts/fixture metadata/empty /proc cwd+argv scan are in r8-granted/.
-Both 215 and r8 private roots were removed after an empty process scan.
-No image build, container start, suite, lane or proof ran for r8.
-
-Range: one commit on5c6f73ed7. Of r7's35 paths,33 keep the same blob/mode;
-only gate-lane-image.test and this BUILD.md change. The r8 mutant and overlap
-receipt are added. The production guard and all other tooling match r7.
-BUILD-LOG and process.test equal the landing. No history replay, force push,
-branch deletion, live state change or policy widening. Fresh proof remains
-Sage's action after Webby's merge review.

agents/herb/work/queue-197/r2-MERGE.json

@@ -1,207 +0,0 @@
-{
-  "r1Base": "aa1bd209e",
-  "r1Candidate": "6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3",
-  "r2Base": "57f59e0c399ce29b1bb85ca6af686fdc10eb195d",
-  "rows": [
-    {
-      "path": "packages/cli/tests/fixtures/gate-lane-child.mjs",
-      "r1Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
-      "r2Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-fixtures.test.mjs",
-      "r1Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
-      "r2Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-image.test.mjs",
-      "r1Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
-      "r2Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-state.test.mjs",
-      "r1Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
-      "r2Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/cli/tests/gate-lane.test.mjs",
-      "r1Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
-      "r2Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/cli/tests/stack-release.test.mjs",
-      "r1Sha256": "8ca733a600d5f5534d7e14d8533e1b16d710ebd43080ef8421238b5dd145fade",
-      "r2Sha256": "b95c0c125b6a283961e24adc07d43150bcbd05d2f11005180b836043015c52a6",
-      "mode": "0o644",
-      "landedPathChanged": true,
-      "r1BlobEqual": false
-    },
-    {
-      "path": "packages/control-board/tests/serve.test.mjs",
-      "r1Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
-      "r2Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/harness/tests/claude-session.test.mjs",
-      "r1Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
-      "r2Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/harness/tests/pi-session.test.mjs",
-      "r1Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
-      "r2Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/webui/tests/preview.test.mjs",
-      "r1Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
-      "r2Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/webui/tests/proof-cli.test.mjs",
-      "r1Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
-      "r2Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/webui/tests/serve.test.mjs",
-      "r1Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
-      "r2Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "packages/webui/tests/service.test.mjs",
-      "r1Sha256": "c915239f0c223209baf84c96ec9f5ae2845fce7dd98ad46b073a96033aa7d6df",
-      "r2Sha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
-      "mode": "0o644",
-      "landedPathChanged": true,
-      "r1BlobEqual": false
-    },
-    {
-      "path": "packages/webui/tests/tester-cli.test.mjs",
-      "r1Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
-      "r2Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/test-discord.sh",
-      "r1Sha256": "c10af53b0717344026cb22462964f253c7401c5082ac6ef3722a89d9dfa5c661",
-      "r2Sha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
-      "mode": "0o755",
-      "landedPathChanged": true,
-      "r1BlobEqual": false
-    },
-    {
-      "path": "scripts/test-foundation.sh",
-      "r1Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
-      "r2Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
-      "mode": "0o755",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/test-queue.sh",
-      "r1Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
-      "r2Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
-      "mode": "0o755",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/README.md",
-      "r1Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
-      "r2Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/gate-lane.mjs",
-      "r1Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
-      "r2Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/gate-lane.sh",
-      "r1Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
-      "r2Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
-      "mode": "0o755",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/lane-docker.mjs",
-      "r1Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
-      "r2Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/lane-evidence.mjs",
-      "r1Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
-      "r2Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/lane-fixtures.mjs",
-      "r1Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
-      "r2Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/lane-image.mjs",
-      "r1Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
-      "r2Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    },
-    {
-      "path": "scripts/testing/lane-state.mjs",
-      "r1Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
-      "r2Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
-      "mode": "0o644",
-      "landedPathChanged": false,
-      "r1BlobEqual": true
-    }
-  ]
-}

agents/herb/work/queue-197/r2-TEST-FILES.txt

@@ -1,19 +0,0 @@
-packages/cli/tests/gate-lane-fixtures.test.mjs
-packages/cli/tests/gate-lane-image.test.mjs
-packages/cli/tests/gate-lane-state.test.mjs
-packages/cli/tests/gate-lane.test.mjs
-packages/cli/tests/stack-instances.test.mjs
-packages/cli/tests/stack-release-external.test.mjs
-packages/cli/tests/stack-release.test.mjs
-packages/cli/tests/stack-upgrade.test.mjs
-packages/control-board/tests/serve.test.mjs
-packages/harness/tests/claude-session.test.mjs
-packages/harness/tests/pi-session.test.mjs
-packages/webui/tests/preview.test.mjs
-packages/webui/tests/proof-cli.test.mjs
-packages/webui/tests/serve.test.mjs
-packages/webui/tests/service.test.mjs
-packages/webui/tests/tester-cli.test.mjs
-scripts/test-discord.sh
-scripts/test-foundation.sh
-scripts/test-queue.sh

agents/herb/work/queue-197/r2-merge-only.patch

@@ -1,45 +0,0 @@
-diff --git a/packages/cli/tests/stack-release.test.mjs b/packages/cli/tests/stack-release.test.mjs
-index 8788158c3..a78f52062 100644
---- a/packages/cli/tests/stack-release.test.mjs
-+++ b/packages/cli/tests/stack-release.test.mjs
-@@ -0,0 +1,2 @@
-+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
-+import { after as laneAfter } from 'node:test';
-@@ -1777 +1779 @@ const TESTER='7499';
--const freePort=async()=>{const s=createServer();s.listen(0,'127.0.0.1');await once(s,'listening');const p=String(s.address().port);await new Promise((r)=>s.close(r));return p};
-+const freePort=async()=>String(await leasePort({after:laneAfter},{closed:true}));
-diff --git a/packages/webui/tests/service.test.mjs b/packages/webui/tests/service.test.mjs
-index a6e66608a..adb460d07 100644
---- a/packages/webui/tests/service.test.mjs
-+++ b/packages/webui/tests/service.test.mjs
-@@ -0,0 +1,2 @@
-+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
-+import { after as laneAfter } from 'node:test';
-@@ -48,9 +50 @@ function filled(flags, root = REPO) {
--async function closedPort() {
--  const server = createServer();
--  server.listen(0, '127.0.0.1');
--  await once(server, 'listening');
--  const { port } = server.address();
--  server.close();
--  await once(server, 'close');
--  return port;
--}
-+async function closedPort() { return leasePort({after:laneAfter}, {closed:true}); }
-diff --git a/scripts/test-discord.sh b/scripts/test-discord.sh
-index 114994936..4daf0d143 100755
---- a/scripts/test-discord.sh
-+++ b/scripts/test-discord.sh
-@@ -73,0 +74,2 @@ TOOLS_JSON="{\"roots\":[{\"name\":\"docs\",\"path\":\"$SANDBOX/toolroot\"}],\"ma
-+export PI_CODING_AGENT_DIR="$SANDBOX/pi-agent"
-+mkdir -p "$PI_CODING_AGENT_DIR"
-@@ -145 +147,8 @@ fi
--node_tests() { env -u NODE_TEST_CONTEXT node --test "$@"; }
-+node_tests() {
-+    local lane_concurrency=()
-+    if [ -n "${MOSAIC_TEST_CONCURRENCY:-}" ]; then
-+        [ "$MOSAIC_TEST_CONCURRENCY" = 2 ] || return 2
-+        lane_concurrency=(--test-concurrency=2)
-+    fi
-+    env -u NODE_TEST_CONTEXT node --test "${lane_concurrency[@]}" "$@"
-+}

agents/herb/work/queue-197/r2-on234-MERGE.json

@@ -1,235 +0,0 @@
-{
-  "base": "c771a36f4bd0b6c359282425c668996a90072f93",
-  "priorCandidate": "a3b7cbde8ef51c206a83769a7c272e4f9a1de5bc",
-  "originalCandidate": "6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3",
-  "overlap": [
-    "packages/cli/tests/stack-release.test.mjs"
-  ],
-  "rows": [
-    {
-      "path": "packages/cli/tests/fixtures/gate-lane-child.mjs",
-      "r1Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
-      "priorCandidateSha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
-      "newSha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-fixtures.test.mjs",
-      "r1Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
-      "priorCandidateSha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
-      "newSha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-image.test.mjs",
-      "r1Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
-      "priorCandidateSha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
-      "newSha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/cli/tests/gate-lane-state.test.mjs",
-      "r1Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
-      "priorCandidateSha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
-      "newSha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/cli/tests/gate-lane.test.mjs",
-      "r1Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
-      "priorCandidateSha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
-      "newSha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/cli/tests/stack-release.test.mjs",
-      "r1Sha256": "8ca733a600d5f5534d7e14d8533e1b16d710ebd43080ef8421238b5dd145fade",
-      "priorCandidateSha256": "b95c0c125b6a283961e24adc07d43150bcbd05d2f11005180b836043015c52a6",
-      "newSha256": "071ea2803b8c7e0450bb4c86ac9b49ae7c180af1599dca52bfce6d0274ca205b",
-      "unchangedFromPrior": false,
-      "overlaps234": true,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/control-board/tests/serve.test.mjs",
-      "r1Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
-      "priorCandidateSha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
-      "newSha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/harness/tests/claude-session.test.mjs",
-      "r1Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
-      "priorCandidateSha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
-      "newSha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/harness/tests/pi-session.test.mjs",
-      "r1Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
-      "priorCandidateSha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
-      "newSha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/webui/tests/preview.test.mjs",
-      "r1Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
-      "priorCandidateSha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
-      "newSha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/webui/tests/proof-cli.test.mjs",
-      "r1Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
-      "priorCandidateSha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
-      "newSha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/webui/tests/serve.test.mjs",
-      "r1Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
-      "priorCandidateSha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
-      "newSha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/webui/tests/service.test.mjs",
-      "r1Sha256": "c915239f0c223209baf84c96ec9f5ae2845fce7dd98ad46b073a96033aa7d6df",
-      "priorCandidateSha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
-      "newSha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "packages/webui/tests/tester-cli.test.mjs",
-      "r1Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
-      "priorCandidateSha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
-      "newSha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/test-discord.sh",
-      "r1Sha256": "c10af53b0717344026cb22462964f253c7401c5082ac6ef3722a89d9dfa5c661",
-      "priorCandidateSha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
-      "newSha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o755"
-    },
-    {
-      "path": "scripts/test-foundation.sh",
-      "r1Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
-      "priorCandidateSha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
-      "newSha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o755"
-    },
-    {
-      "path": "scripts/test-queue.sh",
-      "r1Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
-      "priorCandidateSha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
-      "newSha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o755"
-    },
-    {
-      "path": "scripts/testing/README.md",
-      "r1Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
-      "priorCandidateSha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
-      "newSha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/gate-lane.mjs",
-      "r1Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
-      "priorCandidateSha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
-      "newSha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/gate-lane.sh",
-      "r1Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
-      "priorCandidateSha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
-      "newSha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o755"
-    },
-    {
-      "path": "scripts/testing/lane-docker.mjs",
-      "r1Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
-      "priorCandidateSha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
-      "newSha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/lane-evidence.mjs",
-      "r1Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
-      "priorCandidateSha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
-      "newSha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/lane-fixtures.mjs",
-      "r1Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
-      "priorCandidateSha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
-      "newSha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/lane-image.mjs",
-      "r1Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
-      "priorCandidateSha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
-      "newSha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    },
-    {
-      "path": "scripts/testing/lane-state.mjs",
-      "r1Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
-      "priorCandidateSha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
-      "newSha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
-      "unchangedFromPrior": true,
-      "overlaps234": false,
-      "mode": "0o644"
-    }
-  ]
-}

agents/herb/work/queue-197/r2-on234-OVERLAP.txt

@@ -1,47 +0,0 @@
-Compared 57f59e0c3 to c771a36f4bd0b6c359282425c668996a90072f93
-agents/gizmoduck/work/queue-234/BUILD.md
-docs/SESSIONS.md
-packages/bus/README.md
-packages/bus/schema.sql
-packages/bus/src/broker.mjs
-packages/bus/src/credentials.mjs
-packages/bus/src/host-grant.mjs
-packages/bus/src/host-run.mjs
-packages/bus/src/migrations/3i-3j.sql
-packages/bus/src/runtime.mjs
-packages/bus/src/server.mjs
-packages/bus/src/store.mjs
-packages/bus/tests/account-migration.test.mjs
-packages/bus/tests/chief-of-staff.test.mjs
-packages/bus/tests/comment-migration.test.mjs
-packages/bus/tests/fixtures/schema-3i.sql
-packages/bus/tests/grant-enroll.test.mjs
-packages/bus/tests/grant-migration.test.mjs
-packages/bus/tests/hard-waits.test.mjs
-packages/bus/tests/host-fixtures.mjs
-packages/bus/tests/host-run.test.mjs
-packages/bus/tests/host-tools.test.mjs
-packages/bus/tests/name-migration.test.mjs
-packages/bus/tests/project-runtime.test.mjs
-packages/bus/tests/schema.test.mjs
-packages/bus/tests/spec-fixtures.mjs
-packages/bus/tests/spec-migration.test.mjs
-packages/bus/tests/thread-migration.test.mjs
-packages/bus/tests/usage-migration.test.mjs
-packages/business/src/business.mjs
-packages/business/src/hosts.mjs
-packages/business/tests/hosts.test.mjs
-packages/cli/README.md
-packages/cli/src/cli.mjs
-packages/cli/src/hosts.mjs
-packages/cli/tests/hosts.test.mjs
-packages/cli/tests/stack-release.test.mjs
-scripts/mosaic
-tools/host/mosaic-keys
-tools/host/mosaic-keys-write
-tools/host/mosaic-keys.sshd.conf
-tools/host/mosaic-keys.sudoers
-
-Overlap with row 197 source manifest:
-packages/cli/tests/stack-release.test.mjs
-Other 24 source paths: no overlap.

agents/herb/work/queue-197/r2-on234-merge-only.patch

@@ -1,10 +0,0 @@
-diff --git a/packages/cli/tests/stack-release.test.mjs b/packages/cli/tests/stack-release.test.mjs
-index daae6efb7..910785bc4 100644
---- a/packages/cli/tests/stack-release.test.mjs
-+++ b/packages/cli/tests/stack-release.test.mjs
-@@ -0,0 +1,2 @@
-+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
-+import { after as laneAfter } from 'node:test';
-@@ -1779 +1781 @@ const TESTER='7499';
--const freePort=async()=>{const s=createServer();s.listen(0,'127.0.0.1');await once(s,'listening');const p=String(s.address().port);await new Promise((r)=>s.close(r));return p};
-+const freePort=async()=>String(await leasePort({after:laneAfter},{closed:true}));

agents/herb/work/queue-197/r6-OVERLAP.json

@@ -1,5 +0,0 @@
-{
-  "base": "fefd54e13",
-  "prior": "9aa6d52d9",
-  "overlaps": []
-}

agents/herb/work/queue-197/r7-OVERLAP.json

@@ -1,6 +0,0 @@
-{
-  "base": "b1fece6f0",
-  "r6": "df0c59608",
-  "r6Base": "fefd54e13",
-  "overlaps": []
-}

agents/herb/work/queue-197/r7-no-build.mutant.patch

@@ -1,11 +0,0 @@
---- a/scripts/testing/lane-docker.mjs
-+++ b/scripts/testing/lane-docker.mjs
-@@ -34,7 +34,7 @@
-     const service=argv.indexOf('mosaic-agent',2);
-     if(service<0||argv.slice(2,service).some(a=>!['--rm','-T','--no-deps','--interactive','-i'].includes(a)))refuse('Docker Compose run options not allowed');
-     const [base,override]=composeFiles(run);
--    return ['compose','-f',base,'-f',override,'run','--pull','never','--no-deps',...argv.slice(2)];
-+    return ['compose','-f',base,'-f',override,'run','--no-build','--pull','never','--no-deps',...argv.slice(2)];
-   }
-   refuse('Docker mutation or unowned command');
- }

agents/herb/work/queue-197/r8-OVERLAP.json

@@ -1,6 +0,0 @@
-{
-  "base": "5c6f73ed7",
-  "r7": "9c3166915",
-  "r7Base": "b1fece6f0",
-  "overlaps": []
-}

agents/herb/work/queue-197/r8-record-lookup.mutant.patch

@@ -1,11 +0,0 @@
---- a/packages/cli/tests/gate-lane-image.test.mjs
-+++ b/packages/cli/tests/gate-lane-image.test.mjs
-@@ -85,7 +85,7 @@
- // including when the lane's guard is first on PATH. Child fixture env stays
- // isolated; passing the real absolute path avoids re-entering that guard.
- function installedDocker(){
-- const file=process.env.MOSAIC_GATE_DOCKER_RECORD;
-+ const file=undefined; // mutant: lose the lane's real-binary lookup
-  if(!file)return 'docker';
-  const binary=JSON.parse(readFileSync(file,'utf8')).docker;
-  assert.ok(typeof binary==='string'&&isAbsolute(binary),'lane record must name the real absolute Docker binary');

agents/herb/work/queue-215/BUILD.md

@@ -1,399 +0,0 @@
-# Row 215 build record
-
-Owner: Herb. Reviewer: Filbert. Claim: herb-215-start, rev 2753.
-Brief: docs/plans/2026-10-20_case2-rows.md, C2-04, pin
-16847e94ae1768881711318fe81cbb5e6c66b971. Design: Gosalyn r11,
-sections 1.1, 1.3, 2.1, M4, M9 and 7.2.
-
-Base: a2c72ac952df94ecab7e391d5042f49b7f88b816, row 212's reviewed
-candidate, under Q177. Branch: herb/row215. Rebuild on the combined 212+197
-landing when Sage names it. Do not replay or revert landed changes.
-
-## Scope rulings (sage-1848)
-
-1. Add packages/bus/src/runtime.mjs for library adapter injection and the
-   library skip in protectedRoots. The skip has its own consumer test. Change
-   nothing else there.
-2. Add packages/library/src/mirror.mjs, named mirror rather than store. It
-   creates a bare mirror without a remote, reads at the served commit and
-   reads sync state. Export one state filename constant, and export this
-   module through packages/library/src/index.mjs. Row 222 imports the constant.
-3. Add packages/bus/src/server.mjs only to await library.file and
-   library.status, with socket tests proving their replies are results, not {}.
-4. HTTP exposure is deferred. Row 225 owns the library.status route;
-   C2-11b owns library pages. Leave serve.mjs alone. webui/src/cli.mjs gets
-   only callback wiring next to the project-file callbacks on both listeners.
-5. Reuse existing refusal codes where possible.
-6. Build on a2c72ac95 until Sage supplies the 212 landing SHA.
-
-Additional ruling, sage-1852: library-state-invalid is approved for malformed,
-unsafe or mismatched state, including a missing file while the served ref
-exists. The version-1 shared contract below is approved. Row 222 also owns
-runtime.mjs for its sync and timer wiring, recorded in that row's manifest.
-
-Additional rulings, sage-1860, after Filbert's CHANGES on 6a508804f:
-
-- B1 adds packages/cli/src/config.mjs and cli/tests/trackers-boot.test.mjs.
-  trackerFor skips library entries. A real bus boot with tracker.baseUrl and
-  a library entry succeeds and gets no tracker from that entry.
-- B2 refuses a role publish grant naming a library project in the loader.
-- B3 readers use the sync lock. mirror.mjs exports withLibraryLock, with a
-  5000 ms wait bound and library-sync-busy on timeout. Sync locks only the
-  served-ref move and state publication, never the fetch.
-- N3, git-socket doPush/recordPush accepting a library ID, is a later row.
-  Sage records it in DEFERRED.md when 215 lands. No fix here.
-
-## Shared contract with row 222
-
-Agreed in herb-0048, megavolt-0081/0082 and sage-1852. This section is the
-contract Filbert reviews and Megavolt cites for Dewey. It is not a sync writer.
-
-Module: packages/library/src/mirror.mjs. Export
-`SYNC_STATE_FILE = 'mosaic-library-sync.json'`. The full path is
-`join(mirror, SYNC_STATE_FILE)`, inside the bare repository. Only sync.mjs
-writes it, using a sibling temp file, fsync, rename, and directory fsync.
-
-Version 1 has exactly these keys:
-
-```json
-{
-  "version": 1,
-  "branch": "main",
-  "served": null,
-  "lastFetch": null,
-  "lastError": null,
-  "diverged": null,
-  "problems": []
-}
-```
-
-- branch is the configured mapping branch and must match the reader's branch.
-- served is null or a full lowercase 40-hex commit ID. refs/heads/served is
-  authority. The state value must equal that ref, which must name a commit.
-- lastFetch is null or a canonical ISO UTC timestamp.
-- lastError is null or exactly {code, at}. code matches [a-z-]{1,64}; at is
-  canonical ISO UTC. It never holds stderr, prose or a credential value.
-- diverged is null or exactly {commit, at}, with the same commit/time rules.
-- problems uses C2-01's exact {code, path, message, line?}. code is R1-R7,
-  message is that code's fixed RULES text, line is a positive safe integer
-  when present. No file body or arbitrary message is accepted.
-- An absent file and absent served ref return the empty object above with
-  the configured branch. An absent file with an existing served ref refuses.
-- Unknown keys, bad types, unsafe filesystem metadata, invalid JSON and a
-  mismatch refuse library-state-invalid. Reads use a bounded regular owned
-  private file without following links. The read never repairs state.
-- refs/remotes/library/<branch> is not duplicated in this file. Row 222 may
-  read it when it needs the fetched tip.
-
-Exports consumed by row 222:
-
-| Export | Contract |
-| --- | --- |
-| mirrorPath({business, project, dataRoot}) | Require a library entry; return projectRepo's checked path |
-| ensureMirror(context) | Promise of the mirror path; race-safe idempotent bare init; no remote or fetch |
-| servedCommit(mirror) | Promise of full commit ID or null; refs/heads/served only |
-| readSyncState(mirror, {branch}) | Promise of checked version-1 state; compare with served ref |
-| withLibraryLock(mirror, operation) | Await the same exclusive lock as readers, then await operation({readSyncState}); always release |
-
-The lock is a stable private regular file, mosaic-library-sync.lock inside
-the mirror. It is never unlinked. A kernel flock is held by the caller's
-file descriptor. Acquisition waits at most 5000 ms and refuses
-library-sync-busy on timeout. Unsafe lock metadata refuses library-state-invalid.
-
-There is no fs.flock API. The exact protocol is: open the stable file with
-O_NOFOLLOW, check regular/private/owned/single-link metadata, pass its fd as
-child FD 3 to `flock --exclusive --wait 5 --conflict-exit-code 75 3` using
-asynchronous spawn, await
-that child's exit 0, then run the callback while the parent still holds its
-original descriptor. Both descriptors share the open file description, so
-the lock survives acquisition-child exit. Finally close the parent's fd.
-Process death also closes it. No holder child stays alive in the callback,
-no stale file is deleted, and unrelated operation children inherit only 0-2.
-Acquisition never uses spawnSync: the bus must serve other calls while a
-library reader waits (megavolt-0087).
-
-A scratch-only probe on node v26.8.1 at 2026-10-21T08:34:00Z confirmed this:
-acquisition child exited 0; a second flock -n returned 1 while the parent fd
-stayed open; after closeSync it returned 0. The probe removed its own root.
-This was a design probe, not a package test, suite, Docker command or proof.
-
-readSyncState takes that lock around reading the served ref and state file.
-The callback-scoped readSyncState({branch}) supplied by withLibraryLock reads
-under the already-held lock and does not reacquire it. The helper awaits
-asynchronous callbacks and releases in finally. A callback-scoped reader
-used after its callback ends refuses; it cannot escape its lock lifetime.
-
-Row 222 fetches without this lock, then calls withLibraryLock across the
-served-ref move and atomic state write. Its tests hold publication between
-those steps and prove a concurrent reader waits, then sees the new consistent
-pair, including first sync. Row 215 tests that publication shape and timeout.
-A file read releases the lock after snapshotting a consistent served SHA,
-then reads that immutable commit. Row 222's separate outer sync lock spans
-fetch to prevent two sync operations interleaving (megavolt-0086).
-
-Host adapter exports for this row:
-
-- libraryStatus(context): return {project, ...state}, with no repository path
-  or content. Do not fetch or rebuild on this read.
-- readLibraryFile({...context, path}): read a mapped, readable file at the
-  served commit, returning {project, path, commit, content}. No caller-picked
-  commit, working-tree fallback, fetch or write. C2-01's R1/R2/R7 exclusions
-  apply. A never-synced mirror refuses library-commit for a file read.
-
-Row 222 owns syncCommand, sync, writeSyncState, its outer sync lock, the timer
-and state publication. Row 215 owns the shared publication/read lock per
-sage-1860. Sync rebuilds problems with existing readLibrary({repo, commit,
-mapping}). It does not need a second rebuild function from this row.
-
-## Root consumer audit and reviewer notes
-
-On a2c72ac95, ran exactly the sage-1860 audit:
-`git grep -n 'entry\.root\|\.root)' -- 'packages/*/src/*.mjs'`.
-It has 14 hits. runtime.mjs:95, business/cli.mjs:61,72,78,118,
-instance-settings.mjs:142-143, resolve.mjs:44, cli/config.mjs:62-63 and
-project/paths.mjs:42 all get the library guard in this row. business.mjs:233
-and :242 are code-project validation after the library dispatch, not an
-unguarded consumer. queue.mjs:1144 compares queue genesis roots and never
-iterates business.projects; it is safe and unchanged. A second search for
-projectFilePath/business.projects/b.projects found no additional root reader.
-ensureCheckouts destructures root rather than spelling .root; its guard and
-the launcher's filter remain in T1. Bare projectFilePath/loadProject remain
-strict and unchanged.
-
-Filbert N1 is handled at the existing owned paths.mjs boundary: projectRepo
-defaults to record-project use and refuses a library entry with project-invalid.
-Only mirrorPath's internal call opts into allowLibrary. Thus ordinary human
-and tester project init cannot occupy an uninitialized library mirror path.
-No record API or bus argument exposes that internal option.
-
-Filbert N2: ensureMirror failure refuses bus boot. No socket becomes ready.
-The runtime closes resources it opened, following its existing failure path.
-A T4 test uses an unsafe/pre-existing mirror and proves the refusal, rather
-than serving a half-configured library adapter.
-
-## Verification record
-
-Planning stage. No product code, package test, suite, image build, live operation
-or push for row 215 has happened. Product implementation awaits Filbert's
-manifest approval. Sage owns suite and full-gate grants. Row 197's proof
-commit is separate and is not part of this row's changes.
-
-## Implementation ledger
-
-Plan: agents/herb/work/queue-215/MANIFEST.md at 2522025af, approved by
-Filbert in the reply to herb-0056. Execution is inline by Herb under the
-executing-plans and test-driven-development skills. No agent delegation.
-
-Pre-flight: T1's validated mapping feeds T2's protected document and T3's
-mirror context; T3's lock/state helpers feed T4's injected host adapter.
-The shared contract is pinned above, with no interface conflict found.
-
-Sage-1867 overrides COMMON's singles allowance: every test and executable
-probe needs an explicit slot grant. No further probe/test has run since
-that reminder. Read-only inspection and test authoring continue while the
-slot is held. The first red execution is pending; product code is unchanged.
-
-Filbert's approved-manifest build notes: ensureMirror creates the lock in
-its staged directory before publication; a missing lock in an existing
-mirror refuses library-state-invalid. The top-level metadata allowlist
-permits only normal bare Git entries plus the state and stable lock files.
-Tests cover an unknown entry. The host needs /usr/bin/flock; ENOENT yields
-a handled library-state-invalid refusal, never an unhandled child error.
-Lock acquisition uses /usr/bin/flock directly and asynchronous spawn.
-
-T1: consumer and loader regression tests authored, not run. T2: direct M9
-write and serialization regression tests authored, not run. No completion
-or passing claim is made for either task.
-
-Update, sage-1869 focused slot, 2026-10-21T08:47:48Z to 08:51:07Z:
-the busy check was CLEAR before the first test. T1's mapping regression
-failed 0/1 on unsupported kind as expected, then passed 2/0 with the publish
-refusal included. Other focused greens: business CLI 1/0, resolver 1/0,
-instance settings 1/0, seat checkout 1/0, project paths 1/0, sandboxed launcher
-1/0, and trackers-boot whole 2/0. T2's direct writer case failed 0/1 on the
-missing refusal, then its whole new file passed 4/0. Green total 14/0 with
-no skips or cancellations. Logs and counts: granted-t1/. The final /proc
-scan found no test process or fixture cwd/argv reference; its private root
-was removed. Clear sent as herb-0062. Existing files' other cases have not
-been run yet, so T1/T2's full-file acceptance is still pending.
-
-Sage-1874 directs continued authoring and implementation while the landing
-gate/proof holds the slot. T3/T4 tests were written first. Their initial
-red runs cannot execute during that hold; implementation proceeds under
-that owner direction, with no claim of a witnessed red or green for T3/T4.
-Their baseline red and candidate checks need a later explicit grant.
-
-Implementation ruling: initialization uses GNU /usr/bin/mv --no-clobber
---no-target-directory for its bounded staging rename, rather than Node's
-renameSync, which could replace an empty directory made by a competing
-actor. This preserves pre-existing directories and needs no new package on
-the Linux/coreutils bus host. The host also needs /usr/bin/flock. Neither
-command has been executed for T3/T4 yet. Publication errors fail closed.
-Sync-state reads are capped at 8 MiB, including a checked extra byte; an
-oversized or concurrently changed file refuses library-state-invalid.
-
-T5 static dependency audit found two partial pinned-copy fixtures that copy
-business/src but not its newly imported library mapping validator:
-cli/tests/stack-release.test.mjs:1772 and stack-release-fixture.mjs:309 on
-the base. Each now includes packages/library/src in the existing copy list.
-This changes fixture closure only, no assertion or timeout. The complete
-stack-release file and each test file importing that shared fixture require
-a later granted single-file run. They are outside the four-file T3/T4 slot.
-
-Sage-1879 places the four-file T3/T4 focused run after their 212+197 proof,
-before Gizmoduck, and requires their explicit clear before starting. No run
-has occurred after herb-0062. Row 197's N7 base-image-tag finding is left to
-Sage's DEFERRED entry; no row 197 source change is made here.
-
-
-Focused T3/T4 grant sage-1882, 2026-10-21 09:13-09:18Z: busy check
-CLEAR. Final whole-file results: mirror 16/0, bus library 6/0, WebUI
-library-cli 1/0, project-runtime 3/0, all with zero skips/cancellations.
-Syntax checks passed for the four files and five changed host modules.
-Logs, all intermediate failures, counts and empty /proc cleanup scan are
-in granted-t34/. Baseline a2c72ac95: three focused bus cases 0/3
-(unknown-verb), CLI 0/1 (missing callbacks). Mirror baseline 0/1 is an
-import refusal for the new module, not a witnessed behavioral red.
-An initial whole baseline bus attempt left a runtime after its expected
-failure; its exact runner was stopped, no process remained, and the
-baseline was narrowed to the three bounded broker/socket cases.
-Candidate fixture setup errors and a mock-child timeout were corrected
-before the final whole-file passes. No suite or Docker/image/proof ran.
-
-Filbert's 09:09 publication note: no dependence on mv -n's skipped-rename
-exit status across coreutils versions. Save staging dev/ino before mv;
-only its disappearance plus the same dev/ino at the mirror proves a win.
-A remaining original staging inode means a loss, requiring a valid winner.
-Only that owned original staging inode is removed. Numeric no-clobber
-statuses 0 and 1, including a diagnostic, are tested with a competing
-winner. Spawn errors, signals/timeouts and inconsistent outcomes refuse.
-Coreutils must provide atomic --no-clobber --no-target-directory semantics;
-it need not use any particular skipped-rename status convention.
-
-
-Landing update: prepared herb/row215-on212 on fefd54e13 (includes row 212
-landing ee7b2f137), without history replay or stash. Only BUILD-LOG.md and
-cli/tests/stack-release.test.mjs overlap the a2c72ac95-to-landing change
-set. BUILD-LOG preserves all landed entries and appends the existing Herb
-entry. stack-release preserves the landing plus only the library/src copy
-list addition. No test has run on this landing yet. All further execution
-requires a Sage grant (supersedes the original COMMON singles rule).
-
-
-Sage-1979 early singles on fefd54e13, stopped after file10 per sage-1983:
-- packages/bus/tests/library.test.mjs: 6/0
-- packages/bus/tests/project-runtime.test.mjs: 3/0
-- packages/business/tests/business.test.mjs: 18/0
-- packages/business/tests/cli.test.mjs: 10/0
-- packages/business/tests/instance-settings.test.mjs: 12/0
-- packages/business/tests/library-projects-protected.test.mjs: 4/0
-- packages/business/tests/resolve.test.mjs: 11/0
-- packages/cli/tests/launcher.test.mjs: 30/0
-- packages/cli/tests/stack-release-external.test.mjs: 25/0
-- packages/cli/tests/stack-release.test.mjs: 196/0
-
-Total315/0, zero skips/cancellations. This is an early read only, not gate
-evidence for a merged candidate. The sequential driver was paused during
-file10 so it could not start file11, then terminated after file10 exited0.
-No file11 log exists. Results/logs are in granted-singles/. Later landed
-overlaps require a new branch and all16 singles again after their merge.
-
-
-Current merge preparation per sage-1983/1987: new branch
-herb/row215-on-f827 on f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87.
-Nine landed overlaps are recorded in current-MERGE.json and the exact
-candidate deltas against the landing are in current-merge-only.patch.
-Two textual conflicts were resolved manually: Broker keeps hostKeys and
-adds library; business.mjs keeps CREATIVE_DEFINITIONS and adds checkMapping.
-The other seven merges preserve the landing plus the original C2-04 edits.
-All other product/test paths match the early215 tree byte for byte. The
-landing's BUILD-LOG is preserved and the existing Herb entry is appended.
-No history replay, stash, force push, branch deletion or source commit.
-No test/probe/syntax check ran on the merged tree after the slot was cleared.
-All16 whole singles need a new Sage grant before candidate commit/review.
-The10 old-base315/0 results are early reads only, never merged gate evidence.
-
-
-## Source candidate and sage-2008 receipts
-
-Source commit: e333af4dc7af3a9d3789c8c0db26a0df8bdddfee, on
-f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87. SOURCE.json records all30
-changed source/phase-log paths with blob SHA256 and Git mode. The next
-commit contains only this packet. No product change follows the tests.
-
-Sage-2008: start13:15:15.548943Z; end13:27:27.279728Z, 2026-10-21.
-Each of the16 TEST-FILES.txt files ran whole, sequentially. All451 passed,
-with0 failed/skipped/cancelled. Per-file outputs are in granted-2008/;
-EVIDENCE.json records their counts, Node durations and log hashes.
-
-| File | Pass/fail |
-| --- | ---: |
-| packages/bus/tests/library.test.mjs | 6/0 |
-| packages/bus/tests/project-runtime.test.mjs | 3/0 |
-| packages/business/tests/business.test.mjs | 19/0 |
-| packages/business/tests/cli.test.mjs | 10/0 |
-| packages/business/tests/instance-settings.test.mjs | 13/0 |
-| packages/business/tests/library-projects-protected.test.mjs | 4/0 |
-| packages/business/tests/resolve.test.mjs | 11/0 |
-| packages/cli/tests/launcher.test.mjs | 31/0 |
-| packages/cli/tests/stack-release-external.test.mjs | 25/0 |
-| packages/cli/tests/stack-release.test.mjs | 196/0 |
-| packages/cli/tests/stack-upgrade.test.mjs | 21/0 |
-| packages/cli/tests/trackers-boot.test.mjs | 2/0 |
-| packages/library/tests/mirror.test.mjs | 16/0 |
-| packages/project/tests/project.test.mjs | 15/0 |
-| packages/seat/tests/checkout.test.mjs | 78/0 |
-| packages/webui/tests/library-cli.test.mjs | 1/0 |
-
-All29 product/test hashes equal their pre-run values. The final /proc cwd
-and argv scan was empty; the private test root was removed. Clear sent
-as herb-0082 at13:28:38Z. No further runs occurred. No image, Docker,
-lane, proof or full suite was part of this grant.
-
-Before commit, checked f8276c5eb..8a04f4aa4 on every215 source path and
-all16 test paths: no overlap. Row248's grant-executor test is outside them.
-The current root-consumer grep still returns14 sites, all classified by
-the earlier audit: business code roots after dispatch, guarded library
-skips at consumers, and queue's unrelated genesis-root invariant.
-
-Sage-2016 authorizes the source commit, packet receipts and seat-only push,
-then Filbert's candidate review. The landing gate stays with Sage. Earlier
-focused and old-base receipts are archived in granted-t1/, granted-t34/
-and granted-singles/, with their limits kept above. Full package/shell
-landing checks and implementation approval remain pending. No HTTP route,
-remote fetch, sync writer, timer or live operation was added.
-
-Raw Node error logs retain their original space-only lines. Packet whitespace
-checks exclude *.log so the recorded output bytes stay unchanged; source and
-other packet files pass the ordinary diff check.
-
-## Merge-scoped round 2 after rows 249 and 197 (sage-2054)
-
-Row197 landed as a36523713 after proof6 passed 8/8 gates. Row249's
-broker fix is also in this base. Source a6101e21c596e2972ab5a7e3087736075899505e, single parent a3652371338e60187d4e95cee4a0f30f3c8a8f06,
-is on the new herb/row215-on197 branch. The old branch stays untouched.
-No force push, branch deletion or stash was used. The merge was clean.
-
-Only broker.mjs and stack-release.test.mjs changed upstream among the30
-source/phase-log paths. Both retain every landed hunk. The broker keeps
-row249's installed flag and hostLineLeft handling. The stack-release test
-keeps row197's leasePort import, after hook and closed-port lease helper;
-215 adds only its library fixture copy. The other28 blobs and all modes
-match the prior source. All30 paths have exactly the same -U0 added and
-removed lines as f8276c5eb..e333af4dc. BUILD-LOG.md is append-only.
-
-Stable patch-id, old and new: d191e7e9586cd3b7c18310daacdf0c1fdbc8be01.
-r2-range-diff.txt reports only the commit message changed (!); its patch
-is unchanged.
-r2-MERGE.json records every path; r2-merge-only.patch contains both merged
-source diffs against the new base. SOURCE.json names the new source.
-
-Filbert approved round1 in comment30071, rev2897. This round requests
-merge-only review. The earlier451/0 receipts belong to the prior base;
-no test, probe, syntax check, Docker command or lane ran in this round.
-Merged-tree evidence remains pending Sage's explicit clear.
-r2-TEST-FILES.txt proposes all16 original whole singles plus all66
-bus test files whose local import closure reaches broker.mjs, deduplicated
-to80 whole files. This includes shared fixture and runtime imports.
-Sage's slot and row196 landing gate come first. The full landing gate
-remains Sage's. No library behavior, assertion or timeout changed.

agents/herb/work/queue-215/EVIDENCE.json

@@ -1,261 +0,0 @@
-{
-  "grant": "sage-2008",
-  "sourceCommit": "e333af4dc7af3a9d3789c8c0db26a0df8bdddfee",
-  "base": "f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87",
-  "start": "2026-10-21T13:15:15.548778+00:00",
-  "end": "2026-10-21T13:27:27.279728+00:00",
-  "summary": {
-    "tests": 451,
-    "pass": 451,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "results": [
-    {
-      "file": "packages/bus/tests/library.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 6,
-        "pass": 6,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "01-packages_bus_tests_library.test.mjs.log",
-      "sha256": "c19016583abc936534f41bde26eb39e095496eda944622142b1d18ffd5018bc0",
-      "nodeDurationMs": 359.869493
-    },
-    {
-      "file": "packages/bus/tests/project-runtime.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 3,
-        "pass": 3,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "02-packages_bus_tests_project-runtime.test.mjs.log",
-      "sha256": "f123231042d1562fee6dad3d885ac587967e0287f63603c861d04c1907363530",
-      "nodeDurationMs": 312.717335
-    },
-    {
-      "file": "packages/business/tests/business.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 19,
-        "pass": 19,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "03-packages_business_tests_business.test.mjs.log",
-      "sha256": "ae990ebccf7f21b9b32fd9c25fdd637873251c078e17dd95471b82b548322980",
-      "nodeDurationMs": 199.91256
-    },
-    {
-      "file": "packages/business/tests/cli.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 10,
-        "pass": 10,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "04-packages_business_tests_cli.test.mjs.log",
-      "sha256": "28512dc38e2bce04294048a2f1c7dc7cf0c322028f874d1d35aa83b87570ea54",
-      "nodeDurationMs": 2381.258516
-    },
-    {
-      "file": "packages/business/tests/instance-settings.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 13,
-        "pass": 13,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "05-packages_business_tests_instance-settings.test.mjs.log",
-      "sha256": "146623624012da1399fb4ee3de4c0e13df1af28caae81f4870315a67ac368f8f",
-      "nodeDurationMs": 608.08011
-    },
-    {
-      "file": "packages/business/tests/library-projects-protected.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 4,
-        "pass": 4,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "06-packages_business_tests_library-projects-protected.test.mjs.log",
-      "sha256": "675ae18523218ab70a4addee039f41df6ae08ee414f20527f975a2004dde65b2",
-      "nodeDurationMs": 118.54831
-    },
-    {
-      "file": "packages/business/tests/resolve.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 11,
-        "pass": 11,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "07-packages_business_tests_resolve.test.mjs.log",
-      "sha256": "6557938cb8e6d79617c0ea911a6e0ad7303cf5a4f9dd5a5631c70d093e6b06fe",
-      "nodeDurationMs": 94.022587
-    },
-    {
-      "file": "packages/cli/tests/launcher.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 31,
-        "pass": 31,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "08-packages_cli_tests_launcher.test.mjs.log",
-      "sha256": "c3404f1931595914d469cb00a951a5e1648f7792733c86bddbfa099552e5791c",
-      "nodeDurationMs": 24989.261794
-    },
-    {
-      "file": "packages/cli/tests/stack-release-external.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 25,
-        "pass": 25,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "09-packages_cli_tests_stack-release-external.test.mjs.log",
-      "sha256": "55224b6204d4d05a4cb669fb2845aa4168ab868223c3f341ab026032c47458b4",
-      "nodeDurationMs": 96332.465778
-    },
-    {
-      "file": "packages/cli/tests/stack-release.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 196,
-        "pass": 196,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "10-packages_cli_tests_stack-release.test.mjs.log",
-      "sha256": "3f7430ce1f28482a5b66fc0e7db76969298f0dd32c3793e242bc10110dc44e6e",
-      "nodeDurationMs": 533493.817869
-    },
-    {
-      "file": "packages/cli/tests/stack-upgrade.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 21,
-        "pass": 21,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "11-packages_cli_tests_stack-upgrade.test.mjs.log",
-      "sha256": "d18a3eff64b39a5128ab7e842721748b214dc3037ecc9d2c93c58f023859d695",
-      "nodeDurationMs": 60456.446459
-    },
-    {
-      "file": "packages/cli/tests/trackers-boot.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 2,
-        "pass": 2,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "12-packages_cli_tests_trackers-boot.test.mjs.log",
-      "sha256": "22e56455a6a56c98b02f942ed3d38504e4f8486343235c4035c88b967625bce5",
-      "nodeDurationMs": 502.723687
-    },
-    {
-      "file": "packages/library/tests/mirror.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 16,
-        "pass": 16,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "13-packages_library_tests_mirror.test.mjs.log",
-      "sha256": "def30105a3d561118e360535d9d3129226361f2e7902f316e47c74f65f1c0e47",
-      "nodeDurationMs": 5963.543966
-    },
-    {
-      "file": "packages/project/tests/project.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 15,
-        "pass": 15,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "14-packages_project_tests_project.test.mjs.log",
-      "sha256": "e63ab0d23ab24aa1f1f2c1ea8017e8541f415dcb20dff697a37bb7a6368e174d",
-      "nodeDurationMs": 355.86586
-    },
-    {
-      "file": "packages/seat/tests/checkout.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 78,
-        "pass": 78,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "15-packages_seat_tests_checkout.test.mjs.log",
-      "sha256": "c9e7168f589047b8176ec4ee8d2f03adb9fb68f692b363ba6d0036f670811ede",
-      "nodeDurationMs": 4880.907448
-    },
-    {
-      "file": "packages/webui/tests/library-cli.test.mjs",
-      "rc": 0,
-      "counts": {
-        "tests": 1,
-        "pass": 1,
-        "fail": 0,
-        "cancelled": 0,
-        "skipped": 0
-      },
-      "log": "16-packages_webui_tests_library-cli.test.mjs.log",
-      "sha256": "1ca5b92bc4f2de9ef6aa7156cdea62742fb9ddf054ebfb56a9548431e0cfec0d",
-      "nodeDurationMs": 191.536271
-    }
-  ],
-  "cleanup": {
-    "processes": [],
-    "removed": "/mnt/storage/scratch/gt-j5nm6iqn",
-    "sourceHashesUnchanged": 29
-  },
-  "drift": {
-    "base": "f8276c5eb",
-    "tip": "8a04f4aa4aba493eb89e92aa9e0c34084be7058e",
-    "overlap": []
-  },
-  "earlierRuns": {
-    "granted-t1": "focused T1/T2 red/green on a2c72ac95",
-    "granted-t34": "focused T3/T4 with baseline import refusal and corrected fixture errors recorded",
-    "granted-singles": "old fefd54e13 early315/0, not merged gate evidence"
-  },
-  "mergeRound": {
-    "sourceCommit": "a6101e21c596e2972ab5a7e3087736075899505e",
-    "base": "a3652371338e60187d4e95cee4a0f30f3c8a8f06",
-    "status": "not-run; awaiting Sage clear",
-    "priorReceipts": "sage-2008 receipts apply to e333af4dc on f8276c5eb only"
-  }
-}

agents/herb/work/queue-215/MANIFEST.md

@@ -1,246 +0,0 @@
-# C2-04 library business entry implementation plan
-
-> Execution: Herb implements in this session using the executing-plans skill.
-> Filbert approves this manifest before any product implementation.
-
-**Goal:** Load a library mapping without giving an agent a checkout, protect
-all project mappings from organization writes, and expose human-only bus
-reads of the bare mirror's served commit and sync status.
-
-**Architecture:** C2-01 checks mappings and reads commits. Business consumers
-skip library entries. A host-only mirror module owns local mirror reads and
-initialization. runtime.mjs injects that module into the broker, preserving
-the broker's sandbox import closure. Sync and HTTP routes belong to later rows.
-
-**Tech stack:** Existing Node ESM, node:test and bounded local Git helpers.
-No dependencies. node_modules remains the plain canonical symlink.
-
-**Spec:** Pinned C2-04 brief; Gosalyn's approved design 1.1, 1.3, 2.1,
-M4/M9 and 7.2; BUILD.md's sage-1848/1852/1860 scope and shared-state contract.
-
-## Constraints and review focus
-
-- Base a2c72ac95; rebase only onto Sage's named 212 landing on a new branch.
-- Existing code-project entries retain root/repo/remote behavior. Library
-  entries have no root or repo override and use C2-01 checkMapping.
-- Preserve the broker's pinned imports. No library import in broker.mjs and
-  no new runner mount. Do not edit serve.mjs or add an HTTP route.
-- No fetch, remote config, credential read, timer, sync writer, bus write or
-  live operation. All tests use made-up content and local repositories.
-- All test/probe runs require Sage's grant (sage-1867), including singles.
-  Stop and report two failures in one gate. Do not push without authorization.
-
-Review focus, with owning tasks below: library-first iteration must not
-break a later code project (T1); serialized documents cannot bypass M9
-(T2); racing initialization must not replace another mirror (T3); stale or
-unsafe state must not leak content (T3); async socket replies must preserve
-the result and human-only admission (T4).
-
-## Paths and evidence from the base
-
-| Product path | Allowed change |
-| --- | --- |
-| packages/business/src/business.mjs | Dispatch kind:library to checkMapping before code-root validation (:228-244) |
-| packages/business/src/organization.mjs | Compare canonical projects in write before publication (:177 onward) |
-| packages/business/src/cli.mjs | Skip library roots in validate, resolve --project and credential exclusion roots (:60-61, :71-79, :118) |
-| packages/business/src/resolve.mjs | Skip library entries while matching a project file (:44) |
-| packages/business/src/instance-settings.mjs | Skip library before projectFilePath (:142), nothing else |
-| packages/seat/src/checkout.mjs | Skip library entries in ensureCheckouts (:315-327) |
-| packages/cli/src/launcher.mjs | Pass only code entries to ensureCheckouts (:354) |
-| packages/cli/src/config.mjs | Skip library entries in trackerFor's root loop (:61-63), per sage-1860 |
-| packages/project/src/paths.mjs | Skip library entries in overlap loop (:41-44); default record use refuses library, mirrorPath internally opts into allowLibrary |
-| packages/library/src/mirror.mjs | New bare init, checked state and served-commit file read module |
-| packages/library/src/index.mjs | Export mirror module interface and SYNC_STATE_FILE |
-| packages/bus/src/broker.mjs | New injected library adapter, human-only admission and two async verbs |
-| packages/bus/src/runtime.mjs | Library adapter wiring, mirror initialization and protectedRoots skip only |
-| packages/bus/src/server.mjs | Await the two library verbs only |
-| packages/webui/src/cli.mjs | Two library read callbacks beside project callbacks on main and tester listener; no routes |
-
-packages/business/src/project.mjs need not change: callers skip a library
-before projectFilePath or loadProject. Do not weaken their code-root checks.
-scripts/stack-copy.sh already copies packages/library/src and needs no edit.
-
-Test paths to modify: business/tests/business.test.mjs, cli.test.mjs,
-resolve.test.mjs, instance-settings.test.mjs; seat/tests/checkout.test.mjs;
-cli/tests/launcher.test.mjs, trackers-boot.test.mjs; project/tests/project.test.mjs;
-bus/tests/project-runtime.test.mjs. All paths are under packages/.
-
-T5 dependency-audit addition: cli/tests/stack-release.test.mjs and its
-stack-release-fixture.mjs helper copy packages/library/src alongside
-business/src, whose validator now imports the mapping checker. No assertions
-or timeouts change. Whole-file dependent singles require a later Sage slot.
-
-New tests: packages/business/tests/library-projects-protected.test.mjs;
-packages/library/tests/mirror.test.mjs; packages/bus/tests/library.test.mjs;
-packages/webui/tests/library-cli.test.mjs. Reuse existing made-up fixtures.
-If a new fixture is needed, define it within the corresponding new test file.
-No unrelated test assertion or timeout changes.
-
-Record paths: agents/herb/work/queue-215/{MANIFEST.md,BUILD.md}, later source
-manifest and test receipts there; one append-only BUILD-LOG.md phase for this
-row when implementation begins. Sage owns docs/SESSIONS.md.
-
-## T1. Mapping and consumer skips
-
-- [ ] Add failing business tests: accept a frozen library mapping without a
-  root, retain mixed/only-library documents, and propagate C2-01's mapping
-  and playground refusal codes. A role publish naming a library project
-  refuses at load, even with an otherwise valid fork identity and remote.
-  Existing code validation remains unchanged.
-- [ ] Add a separate regression for each consumer: CLI validate and its
-  credential exclusion roots; CLI resolve --project books has no project
-  layer; resolveInstance finds a later real project; instance settings still
-  writes an unrelated setting; ensureCheckouts returns no library checkout;
-  launcher creates no books workspace clone; projectRepo skips a library
-  while still rejecting overlap with a real code root. Put books first.
-- [ ] Add the real bus boot regression in cli/tests/trackers-boot.test.mjs:
-  tracker.baseUrl is set and books is a library entry; boot succeeds, books
-  produces no tracker, and a later real tracker project still works.
-- [ ] projectRepo(context, {allowLibrary = false} = {}) refuses a library
-  entry by default with project-invalid. Only mirrorPath opts in. Test that
-  ordinary human and tester record initialization leave no directory at the
-  future mirror path; no public verb can supply allowLibrary.
-- [ ] Add runtime's protectedRoots consumer regression in T4's real runtime
-  fixture. A valid credential outside code/data roots still loads with a
-  library entry, and existing credential protections still refuse unsafe files.
-- [ ] Run each changed test singly, confirm the new cases fail for the
-  intended root assumption, then implement only the table's guards and
-  checkMapping dispatch. Re-run the same files singly.
-
-CLI validate reports a library entry as library, without an absent-project
-warning. CLI resolve --project books resolves without loading a project file,
-as the design's skip requires. It does not fabricate project vars or a root.
-
-## T2. M9 at the organization writer
-
-- [ ] In the new business test file, call organizationWriter.write directly
-  with a changed playground prefix and, separately, a changed hybrid entry.
-  Both refuse organization-projects-protected. Snapshot business bytes and
-  changes.jsonl before each call; assert both remain identical afterward.
-- [ ] Cover addition, deletion and changes to code projects too, since M9
-  protects all projects. Reordered object keys are allowed; array changes
-  are changes. An ordinary non-project write still succeeds and logs.
-- [ ] Add a serialization regression so a proposed object's serialized
-  projects cannot differ from those checked before publication.
-- [ ] Run the file singly to see the missing refusal, compare canonical
-  projects against old disk JSON and the document that actually lands,
-  before any publication/receipt, then re-run it singly.
-
-## T3. Bare mirror, served file and read-only state
-
-- [ ] Add failing tests for mirrorPath and ensureMirror: exact projectRepo
-  default, no checkout/remote, retained no-links/overlap protections,
-  idempotence, simultaneous creators and preservation of a pre-existing
-  non-mirror directory or unsafe Git metadata.
-- [ ] Add failing state tests for BUILD.md's full version-1 contract: missing
-  state/ref, valid state, malformed JSON, unknown keys/types, branch mismatch,
-  invalid times/IDs/problem shape, symlink/hardlink/non-private file and
-  missing or mismatched served ref. Assert reads change no bytes.
-- [ ] Add shared-lock tests: withLibraryLock(mirror, operation) waits at most
-  5000 ms, refuses library-sync-busy on timeout and releases after a throw.
-  A reader arriving between the publisher's served move and state write
-  waits, then reads the consistent pair. Cover first sync and fast-forward
-  in independent processes, same-process independent acquisitions and
-  release after owner death. A callback-scoped reader expires on release.
-- [ ] Implement the lock by async spawn of flock on the parent's inherited
-  fd 3, as pinned in BUILD.md. Await acquisition-child exit before calling
-  operation. Never spawnSync during acquisition, which could freeze the bus
-  for 5 s. A parallel ordinary bus read remains responsive while a library
-  read waits. Only the publication/read lock is shared; fetch is outside it.
-- [ ] Add served-read tests against local fixtures containing spaces,
-  capitals, a .canvas and unmapped top-level note. Seed a served ref and state
-  without fetching. A newer unrelated HEAD does not change the returned
-  file. R1/R2/R7 exclusions, traversal, a missing path, a caller commit and a
-  never-synced mirror refuse. Status contains no fixture body marker.
-- [ ] Implement mirror.mjs and index exports using the shared contract.
-  Initialization stages into an owned private sibling directory and renames
-  atomically; a losing creator validates the winner and removes only its own
-  staging directory. Git uses existing bounded safe helpers, no remote.
-- [ ] Run mirror.test.mjs singly, red then green. Re-run C2-01 reader.test.mjs
-  singly if a reader assumption changes. Do not change C2-01 reader rules.
-
-mirror.mjs validates a bare mirror's metadata before Git reads it, including
-no remote/include/indirection. It does not apply inspectGit's working-tree
-.git assumption to a bare repository. Failures reuse library-git or the
-approved library-state-invalid code. State reads are bounded and private.
-
-## T4. Human-only bus reads and deferred Console callbacks
-
-- [ ] Add broker tests for library.file and library.status using injected
-  adapters. Each agent session refuses human-required before adapter access,
-  including bad arguments and an absent adapter. A reader or tester does not
-  gain a human capability. Human calls validate keys, then use checked
-  library context. Secret checking and bounded refusal evidence remain.
-- [ ] Add real startBroker/socket tests for both verbs. Seed only local
-  fixture mirror data. Assert result shape/content and an actual status
-  field, not merely successful transport or {}. Cover never-synced status
-  and runtime's protectedRoots skip. Keep the pinned import-closure test.
-- [ ] Inject a separate library adapter via runtime, initialize only library
-  mirrors, add the two async request paths, and include them in server's
-  awaited list. Do not import library or fs into broker.
-- [ ] Unsafe or pre-existing non-mirror initialization refuses bus boot,
-  closes opened resources and never publishes a ready socket. Add that
-  runtime regression in library.test.mjs.
-- [ ] Wire main and tester Console callbacks beside project-file callbacks.
-  No HTTP route is shipped. The new CLI test captures the startServer
-  options with a test-only module loader and calls the supplied callbacks
-  against a fixture bus, checking the verb and transport identity. No
-  product test seam, UI page, endpoint or serve.mjs change is needed.
-- [ ] Run library.test.mjs, project-runtime.test.mjs and library-cli.test.mjs
-  individually, red then green. Human admission may use the existing
-  fixture authentication seam; do not forge or bypass a live identity.
-
-## T5. Review packet and Sage's gate
-
-- [ ] Search packages/*/tests and scripts/test-*.sh for each changed source
-  path, imports and 64-hex pins. Record the resulting test-file list and run
-  each changed/touched test singly. Stop and report a scope error.
-- [ ] Self-review the diff against this manifest and all acceptance cases.
-  Record results, commands, skips, source hashes and remaining limits in
-  BUILD.md. Request Sage's slot for the required business, seat, cli, project,
-  bus and webui suites and every scripts/test-*.sh. Do not run them ungranted.
-- [ ] After applicable tests are green, make the source commit, build the
-  candidate manifest from the authorized pushed tip, and move the row with
-  scripts/mosaic. Sage posts token-requiring requests; Filbert reviews the
-  candidate. Push only when authorized. No merge or live change by Herb.
-
-## Self-review
-
-Every brief acceptance item is in T1-T4. Added host support paths match
-sage-1848/1860. BUILD.md records the complete 14-hit root audit. State shape
-and authority match sage-1852; the shared read/publication lock follows
-sage-1860 and Megavolt's agreement. Fetch, timers, outer sync serialization
-and HTTP stay with their later rows.
-This is a plan only; no product edits or test execution precede approval.
-
-
-Landing update: prepared herb/row215-on212 on fefd54e13 (includes row 212
-landing ee7b2f137), without history replay or stash. Only BUILD-LOG.md and
-cli/tests/stack-release.test.mjs overlap the a2c72ac95-to-landing change
-set. BUILD-LOG preserves all landed entries and appends the existing Herb
-entry. stack-release preserves the landing plus only the library/src copy
-list addition. No test has run on this landing yet. All further execution
-requires a Sage grant (supersedes the original COMMON singles rule).
-
-
-Current merge preparation per sage-1983/1987: new branch
-herb/row215-on-f827 on f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87.
-Nine landed overlaps are recorded in current-MERGE.json and the exact
-candidate deltas against the landing are in current-merge-only.patch.
-Two textual conflicts were resolved manually: Broker keeps hostKeys and
-adds library; business.mjs keeps CREATIVE_DEFINITIONS and adds checkMapping.
-The other seven merges preserve the landing plus the original C2-04 edits.
-All other product/test paths match the early215 tree byte for byte. The
-landing's BUILD-LOG is preserved and the existing Herb entry is appended.
-No history replay, stash, force push, branch deletion or source commit.
-No test/probe/syntax check ran on the merged tree after the slot was cleared.
-All16 whole singles need a new Sage grant before candidate commit/review.
-The10 old-base315/0 results are early reads only, never merged gate evidence.
-
-
-Candidate status: source commit e333af4dc7af3a9d3789c8c0db26a0df8bdddfee. The16 whole
-singles passed451/0 under sage-2008 with zero skips/cancellations; raw
-outputs and merge receipts are in this packet, indexed by EVIDENCE.json
-and SOURCE.json. Sage keeps the landing gate. Filbert's implementation
-review and that gate remain pending. Prior315/0 on fefd54e13 is early
-read evidence only. Sage-2016 authorizes the seat-only source/packet push.

agents/herb/work/queue-215/SOURCE.json

@@ -1,157 +0,0 @@
-{
-  "sourceCommit": "a6101e21c596e2972ab5a7e3087736075899505e",
-  "base": "a3652371338e60187d4e95cee4a0f30f3c8a8f06",
-  "paths": [
-    {
-      "path": "BUILD-LOG.md",
-      "sha256": "b7c8f906f2db095dfe02d29b4064836af83ae877a87b38c09466b8c9a327e019",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/bus/src/broker.mjs",
-      "sha256": "762234259d72db87aff510751fe14003099759ae37bc8eaf14f1ea1de61d2005",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/bus/src/runtime.mjs",
-      "sha256": "c759e665514a5bcad40536bc9f979837187fe6523462b3c0a0687182885c3ac6",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/bus/src/server.mjs",
-      "sha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/bus/tests/library.test.mjs",
-      "sha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/src/business.mjs",
-      "sha256": "5fd3fee664d3e70153d988b4c1a42406f888a31b3927fa52375e66619d8cec59",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/src/cli.mjs",
-      "sha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/src/instance-settings.mjs",
-      "sha256": "3873411688d927336a909d0299acddeba92a653102c660d276471f5a0f6eebd3",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/src/organization.mjs",
-      "sha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/src/resolve.mjs",
-      "sha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/tests/business.test.mjs",
-      "sha256": "910f924d90b6f9b18c1f36d97cebd0b7a0a15a080b73530c4fb847bfd435fb3f",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/tests/cli.test.mjs",
-      "sha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/tests/instance-settings.test.mjs",
-      "sha256": "072e25c5237e1be4294c7a4a95daa2ab593832786013e1283b19725c330647c1",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/tests/library-projects-protected.test.mjs",
-      "sha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/business/tests/resolve.test.mjs",
-      "sha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/src/config.mjs",
-      "sha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/src/launcher.mjs",
-      "sha256": "d8a870d8eb8254adfd576688696705359fefbf517b40e5d7482500bf27941022",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/tests/launcher.test.mjs",
-      "sha256": "99234f247e8414120d2fd214efd590e9d573eca86180d7b775cb506ac1c12c78",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/tests/stack-release-fixture.mjs",
-      "sha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/tests/stack-release.test.mjs",
-      "sha256": "46cc95a6e75a89b907cdd5e9bd03853e1d1f75f1ced81084d968c5476466822e",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/cli/tests/trackers-boot.test.mjs",
-      "sha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/library/src/index.mjs",
-      "sha256": "ecda99dea46390b81fffa6f414d56a13737233e01d883b82cd186e0e21b6c4d1",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/library/src/mirror.mjs",
-      "sha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/library/tests/mirror.test.mjs",
-      "sha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/project/src/paths.mjs",
-      "sha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/project/tests/project.test.mjs",
-      "sha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/seat/src/checkout.mjs",
-      "sha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/seat/tests/checkout.test.mjs",
-      "sha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/webui/src/cli.mjs",
-      "sha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02",
-      "mode": "100644"
-    },
-    {
-      "path": "packages/webui/tests/library-cli.test.mjs",
-      "sha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c",
-      "mode": "100644"
-    }
-  ],
-  "priorSourceCommit": "e333af4dc7af3a9d3789c8c0db26a0df8bdddfee"
-}

agents/herb/work/queue-215/TEST-FILES.txt

@@ -1,16 +0,0 @@
-packages/bus/tests/library.test.mjs
-packages/bus/tests/project-runtime.test.mjs
-packages/business/tests/business.test.mjs
-packages/business/tests/cli.test.mjs
-packages/business/tests/instance-settings.test.mjs
-packages/business/tests/library-projects-protected.test.mjs
-packages/business/tests/resolve.test.mjs
-packages/cli/tests/launcher.test.mjs
-packages/cli/tests/stack-release-external.test.mjs
-packages/cli/tests/stack-release.test.mjs
-packages/cli/tests/stack-upgrade.test.mjs
-packages/cli/tests/trackers-boot.test.mjs
-packages/library/tests/mirror.test.mjs
-packages/project/tests/project.test.mjs
-packages/seat/tests/checkout.test.mjs
-packages/webui/tests/library-cli.test.mjs

agents/herb/work/queue-215/current-MERGE.json

@@ -1,229 +0,0 @@
-{
-  "base": "fefd54e13",
-  "landing": "f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87",
-  "overlaps": [
-    "packages/bus/src/broker.mjs",
-    "packages/bus/src/runtime.mjs",
-    "packages/business/src/business.mjs",
-    "packages/business/src/instance-settings.mjs",
-    "packages/business/tests/business.test.mjs",
-    "packages/business/tests/instance-settings.test.mjs",
-    "packages/cli/src/launcher.mjs",
-    "packages/cli/tests/launcher.test.mjs",
-    "packages/library/src/index.mjs"
-  ],
-  "initialConflicts": [
-    "packages/bus/src/broker.mjs",
-    "packages/business/src/business.mjs"
-  ],
-  "remainingConflicts": [],
-  "resolutions": {
-    "packages/bus/src/broker.mjs": "retain landed hostKeys constructor parameter and add library parameter",
-    "packages/business/src/business.mjs": "retain landed CREATIVE_DEFINITIONS import and add checkMapping import"
-  },
-  "sourcePaths": [
-    {
-      "path": "packages/bus/src/broker.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "dca11dd58561bf3f399d18d7521aefa93f43e0ee3de9c532c1da073ce5a17466",
-      "sha256": "925b3dd6744565349ec421a58b3374ce3d21181e6c2d3d32ffb99c79271b9450"
-    },
-    {
-      "path": "packages/bus/src/runtime.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "6f69e9fb838cf1d8ee60d1b7090395193d3dbfdc6492a401a4b72c356c371ca9",
-      "sha256": "c759e665514a5bcad40536bc9f979837187fe6523462b3c0a0687182885c3ac6"
-    },
-    {
-      "path": "packages/bus/src/server.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899",
-      "sha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899"
-    },
-    {
-      "path": "packages/bus/tests/library.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301",
-      "sha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301"
-    },
-    {
-      "path": "packages/business/src/business.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "e132f92211cd35f951e85ff5e90471a2316755cb35ad7eabf516e780ce6c13ad",
-      "sha256": "5fd3fee664d3e70153d988b4c1a42406f888a31b3927fa52375e66619d8cec59"
-    },
-    {
-      "path": "packages/business/src/cli.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3",
-      "sha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3"
-    },
-    {
-      "path": "packages/business/src/instance-settings.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "04d61c1ec89a5d67da75aede46c3a8e2197aadd63b11bef8e4fc37d90e8862cf",
-      "sha256": "3873411688d927336a909d0299acddeba92a653102c660d276471f5a0f6eebd3"
-    },
-    {
-      "path": "packages/business/src/organization.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964",
-      "sha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964"
-    },
-    {
-      "path": "packages/business/src/resolve.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109",
-      "sha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109"
-    },
-    {
-      "path": "packages/business/tests/business.test.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "55aafd3f0eea816d5f42283b7b74323dd32a698d7b95dd9cc54529dbf7b16058",
-      "sha256": "910f924d90b6f9b18c1f36d97cebd0b7a0a15a080b73530c4fb847bfd435fb3f"
-    },
-    {
-      "path": "packages/business/tests/cli.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85",
-      "sha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85"
-    },
-    {
-      "path": "packages/business/tests/instance-settings.test.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "c0959f3af3df653bbf469471d3bbe3f28bc4478cba8ba57910af7f09498c4c3f",
-      "sha256": "072e25c5237e1be4294c7a4a95daa2ab593832786013e1283b19725c330647c1"
-    },
-    {
-      "path": "packages/business/tests/library-projects-protected.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f",
-      "sha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f"
-    },
-    {
-      "path": "packages/business/tests/resolve.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22",
-      "sha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22"
-    },
-    {
-      "path": "packages/cli/src/config.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0",
-      "sha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0"
-    },
-    {
-      "path": "packages/cli/src/launcher.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "2272232dbe6c362eddb23ad903987fd4b8e0ca1eb94dbe93b66b3e785e7d0712",
-      "sha256": "d8a870d8eb8254adfd576688696705359fefbf517b40e5d7482500bf27941022"
-    },
-    {
-      "path": "packages/cli/tests/launcher.test.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "38fb51c15764333642d75db7fb358d611e448049cf894b24686ea6cf2cf169c4",
-      "sha256": "99234f247e8414120d2fd214efd590e9d573eca86180d7b775cb506ac1c12c78"
-    },
-    {
-      "path": "packages/cli/tests/stack-release-fixture.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9",
-      "sha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9"
-    },
-    {
-      "path": "packages/cli/tests/stack-release.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "aa63fadca8b3a51e7af1ff7560fd2645f3ef56bf4e5625b2d5a5f6946db40996",
-      "sha256": "aa63fadca8b3a51e7af1ff7560fd2645f3ef56bf4e5625b2d5a5f6946db40996"
-    },
-    {
-      "path": "packages/cli/tests/trackers-boot.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22",
-      "sha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22"
-    },
-    {
-      "path": "packages/library/src/index.mjs",
-      "merged": true,
-      "sameAsEarlyTree": false,
-      "earlySha256": "b80e6c27daf908a0e71fcc1e5e8c91d05e857790bd77d92e06ff086ab3623306",
-      "sha256": "ecda99dea46390b81fffa6f414d56a13737233e01d883b82cd186e0e21b6c4d1"
-    },
-    {
-      "path": "packages/library/src/mirror.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480",
-      "sha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480"
-    },
-    {
-      "path": "packages/library/tests/mirror.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c",
-      "sha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c"
-    },
-    {
-      "path": "packages/project/src/paths.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9",
-      "sha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9"
-    },
-    {
-      "path": "packages/project/tests/project.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602",
-      "sha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602"
-    },
-    {
-      "path": "packages/seat/src/checkout.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a",
-      "sha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a"
-    },
-    {
-      "path": "packages/seat/tests/checkout.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127",
-      "sha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127"
-    },
-    {
-      "path": "packages/webui/src/cli.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02",
-      "sha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02"
-    },
-    {
-      "path": "packages/webui/tests/library-cli.test.mjs",
-      "merged": false,
-      "sameAsEarlyTree": true,
-      "earlySha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c",
-      "sha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c"
-    }
-  ]
-}

agents/herb/work/queue-215/current-merge-only.patch

@@ -1,155 +0,0 @@
-diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
-index 3baa709f9..512d57519 100644
---- a/packages/bus/src/broker.mjs
-+++ b/packages/bus/src/broker.mjs
-@@ -90,0 +91 @@ export const PROJECT_FILE_VERBS = Object.freeze(['project.files', 'project.file'
-+export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status']);
-@@ -281,0 +283 @@ export class Broker {
-+  #library;
-@@ -297 +299 @@ export class Broker {
--  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null }) {
-+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null }) {
-@@ -308,0 +311 @@ export class Broker {
-+    this.#library = library;
-@@ -2189,0 +2193,2 @@ export class Broker {
-+      if (LIBRARY_VERBS.includes(request.verb))
-+        return this.#requestLibrary(s, { verb: request.verb, args: structuredClone(args) });
-@@ -2438,0 +2444,20 @@ export class Broker {
-+  // C2-04 M4: only a verified human reads library text or status. Host Git
-+  // functions stay injected, preserving this module's sandbox import closure.
-+  async #requestLibrary(s, request) {
-+    const { verb, args } = request;
-+    try {
-+      this.#human(s);
-+      const fields = verb === 'library.file' ? ['project', 'path'] : ['project'];
-+      keys(args, fields, fields);
-+      if (!this.#library?.readFile || !this.#library?.status) fail('project-not-configured');
-+      const context = { business: this.#business(s.business), project: args.project };
-+      const result = verb === 'library.file'
-+        ? await this.#library.readFile({ ...context, path: args.path })
-+        : await this.#library.status(context);
-+      this.#secretCheck(result);
-+      return result;
-+    } catch (error) {
-+      const Failure = this.#library?.LibraryError;
-+      throw this.#refused(s, Failure && error instanceof Failure ? new BusError(error.code) : error, request);
-+    }
-+  }
-diff --git a/packages/bus/src/runtime.mjs b/packages/bus/src/runtime.mjs
-index f81f956f2..e265ff5d1 100644
---- a/packages/bus/src/runtime.mjs
-+++ b/packages/bus/src/runtime.mjs
-@@ -5,0 +6 @@ import * as projectModule from '../../project/src/index.mjs';
-+import * as libraryModule from '../../library/src/index.mjs';
-@@ -95 +96 @@ export async function startBroker({
--      ...Object.values(businesses).flatMap((b) => Object.values(b.projects ?? {}).map((p) => p.root)),
-+      ...Object.values(businesses).flatMap((b) => Object.values(b.projects ?? {}).filter(p => p.kind !== 'library').map((p) => p.root)),
-@@ -130,0 +132,5 @@ export async function startBroker({
-+    // C2-04: mirrors are host state, never session checkouts. An unsafe
-+    // existing mirror refuses startup before a socket can become ready.
-+    for (const business of Object.values(businesses))
-+      for (const [project, entry] of Object.entries(business.projects ?? {}))
-+        if (entry.kind === 'library') await libraryModule.ensureMirror({ business, project, dataRoot });
-@@ -138,0 +145,5 @@ export async function startBroker({
-+      library: {
-+        readFile: context => libraryModule.readLibraryFile({ ...context, dataRoot }),
-+        status: context => libraryModule.libraryStatus({ ...context, dataRoot }),
-+        LibraryError: libraryModule.LibraryError,
-+      },
-diff --git a/packages/business/src/business.mjs b/packages/business/src/business.mjs
-index d08a4f52e..e8337ea2b 100644
---- a/packages/business/src/business.mjs
-+++ b/packages/business/src/business.mjs
-@@ -12,0 +13 @@ import { checkPlugins } from "../../plugins/src/kinds.mjs";
-+import { checkMapping } from "../../library/src/mapping.mjs";
-@@ -241,0 +243,4 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
-+    if (entry.kind === 'library') {
-+      projects[id] = checkMapping(entry, `${file} projects.${id}`, { fail: (code, message) => refuse(`${code}: ${message}`) });
-+      continue;
-+    }
-@@ -257,0 +263 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
-+      if (projects[project].kind === 'library') refuse(`${file} roles.${instance}.publish names library project ${project}; library repositories cannot be published by agents`);
-diff --git a/packages/business/src/instance-settings.mjs b/packages/business/src/instance-settings.mjs
-index ff3a6d9d3..50cc36edc 100644
---- a/packages/business/src/instance-settings.mjs
-+++ b/packages/business/src/instance-settings.mjs
-@@ -149,0 +150 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null })
-+      if (entry.kind === 'library') continue;
-diff --git a/packages/business/tests/business.test.mjs b/packages/business/tests/business.test.mjs
-index b64659fa1..0f214a005 100644
---- a/packages/business/tests/business.test.mjs
-+++ b/packages/business/tests/business.test.mjs
-@@ -10,0 +11,30 @@ import { launchDoc, businessDoc, REPO, REPO_ROLES, rolesCopy, tmp, writeJson } f
-+test('C2-04: library mappings load without roots, remain frozen, and retain mapping refusals', async t => {
-+  const { mappingEntry } = await import('../../library/tests/helpers.mjs');
-+  const { rmSync } = await import('node:fs');
-+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
-+  const doc = businessDoc(root), file = join(root, 'businesses/acme.json');
-+  doc.projects = { books: mappingEntry(), ...doc.projects };
-+  const loaded = validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES });
-+  const { checkMapping } = await import('../../library/src/mapping.mjs');
-+  assert.deepEqual(loaded.projects.books, checkMapping(mappingEntry()));
-+  assert.equal(loaded.projects.books.root, undefined);
-+  assert.ok(Object.isFrozen(loaded.projects.books.universes.harbor.books));
-+  const only = structuredClone(doc); delete only.projects.stack;
-+  assert.deepEqual(Object.keys(validateBusinessDocument(only, file, { rolesDir: REPO_ROLES }).projects), ['books']);
-+  doc.projects.books.universes.harbor.playground = ['Elsewhere/Playground/'];
-+  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-outside-book/);
-+  doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
-+  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
-+});
-+
-+test('C2-04: an otherwise valid publish grant cannot name a library repo', async t => {
-+  const { mappingEntry } = await import('../../library/tests/helpers.mjs');
-+  const { rmSync } = await import('node:fs');
-+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
-+  const doc = businessDoc(root);
-+  doc.projects.books = { ...mappingEntry(), remote: 'https://git.example/writer/books' };
-+  doc.roles.coder.identity = { name: 'Coder', email: '[email protected]', gitea: { url: 'https://git.example', user: 'acme-coder' } };
-+  doc.roles.coder.publish = ['books'];
-+  refuses(() => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir: REPO_ROLES }), /publish.*library/);
-+});
-+
-diff --git a/packages/business/tests/instance-settings.test.mjs b/packages/business/tests/instance-settings.test.mjs
-index 6b19f9e89..a6c8fe665 100644
---- a/packages/business/tests/instance-settings.test.mjs
-+++ b/packages/business/tests/instance-settings.test.mjs
-@@ -22,0 +23,10 @@ const LEVELS = { pi: ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
-+test('C2-04: instance settings skip a library while checking a later code project', async () => {
-+  const { mappingEntry } = await import('../../library/tests/helpers.mjs');
-+  const f = fixture(doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; });
-+  writeJson(projectFilePath(f.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
-+  const before = f.settings.read('acme');
-+  f.settings.set('acme', { revision: before.revision, instance: 'gate-215', op: 'add', definition: 'merge-gate' }, 'jason');
-+  assert.deepEqual(JSON.parse(readFileSync(f.file, 'utf8')).projects.books, mappingEntry());
-+  assert.ok(f.settings.read('acme').instances['gate-215']);
-+});
-+
-diff --git a/packages/cli/src/launcher.mjs b/packages/cli/src/launcher.mjs
-index 604cef203..c721ee9e8 100644
---- a/packages/cli/src/launcher.mjs
-+++ b/packages/cli/src/launcher.mjs
-@@ -354 +354 @@ export function createLauncher({
--      checkouts = await ensureCheckouts({ workspace, projects: b.projects, env });
-+      checkouts = await ensureCheckouts({ workspace, projects: Object.fromEntries(Object.entries(b.projects).filter(([, entry]) => entry.kind !== 'library')), env });
-diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
-index 3b663ba94..4636df3de 100644
---- a/packages/cli/tests/launcher.test.mjs
-+++ b/packages/cli/tests/launcher.test.mjs
-@@ -32,0 +33,10 @@ const skip = sandboxProblem() ?? false;
-+test('C2-04: launcher workspace clones code but never the library', { skip, timeout: 30000 }, async t => {
-+  const { mappingEntry } = await import('../../library/tests/helpers.mjs');
-+  const f = await setup(t, doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
-+  await f.launcher.launchPm();
-+  const workspace = workspaceDir(f.f.dataRoot, 'acme', 'chief');
-+  assert.equal(existsSync(join(workspace, 'stack', '.git')), true);
-+  assert.equal(existsSync(join(workspace, 'books')), false);
-+  assert.equal(await f.close(), 0);
-+});
-+
-diff --git a/packages/library/src/index.mjs b/packages/library/src/index.mjs
-index f64d77860..53ce5cb43 100644
---- a/packages/library/src/index.mjs
-+++ b/packages/library/src/index.mjs
-@@ -8,0 +9 @@ export { survey, formatSurvey, surveyMain } from './survey.mjs';
-+export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';

agents/herb/work/queue-215/granted-2008/01-packages_bus_tests_library.test.mjs.log

@@ -1,14 +0,0 @@
-✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (30.144386ms)
-✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.434614ms)
-✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.684117ms)
-✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (45.253455ms)
-✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (23.246812ms)
-✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (107.052077ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 6
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 359.869493

agents/herb/work/queue-215/granted-2008/02-packages_bus_tests_project-runtime.test.mjs.log

@@ -1,11 +0,0 @@
-✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (2.265255ms)
-✔ without a trusted project adapter all three async paths refuse project-not-configured (57.448982ms)
-✔ real startBroker injects the project adapter for socket reads and bound-author record writes (102.784823ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 312.717335

agents/herb/work/queue-215/granted-2008/03-packages_business_tests_business.test.mjs.log

@@ -1,27 +0,0 @@
-✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (12.852402ms)
-✔ C2-04: an otherwise valid publish grant cannot name a library repo (2.693014ms)
-✔ config directory and file path follow MOSAIC_CONFIG (0.229245ms)
-✔ the fixture business validates and comes back frozen (1.006969ms)
-✔ two instances may share a definition (0.94271ms)
-✔ top-level refusals (3.474817ms)
-✔ arbiters and projects (5.543282ms)
-✔ role instances (2.7386ms)
-✔ Vikunja bots (6.181044ms)
-✔ a role without Vikunja takes no tracker block (5.900981ms)
-✔ credential references match the definition's services (3.012597ms)
-✔ launch (8.561546ms)
-✔ REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses (6.420869ms)
-✔ loadBusiness: file checks (2.241353ms)
-✔ loadBusiness: not a regular file (46.573969ms)
-✔ loading writes nothing (2.802338ms)
-✔ names that are Object.prototype properties don't count as declared (3.291238ms)
-✔ the shipped example refuses as written and validates once filled in (1.195924ms)
-✔ persona vars: agent layer, creative definition only, both or neither (9.0736ms)
-ℹ tests 19
-ℹ suites 0
-ℹ pass 19
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 199.91256

agents/herb/work/queue-215/granted-2008/04-packages_business_tests_cli.test.mjs.log

@@ -1,18 +0,0 @@
-✔ C2-04: business validate and resolve skip a library before code projects and credential checks (235.663956ms)
-✔ usage errors exit 4 (325.805811ms)
-✔ validate: a good business exits 0 and prints instance digests (69.331646ms)
-✔ validate: project files (344.919464ms)
-✔ validate: missing files and a broken system config (252.779029ms)
-✔ validate: credential reference problems exit 2 and name each one (66.663076ms)
-✔ validate: a token file inside the repository is refused (78.714732ms)
-✔ validate: role definitions come from MOSAIC_ROLES_DIR (201.487424ms)
-✔ resolve: prints one instance's record (281.684478ms)
-✔ resolve: refusals (454.610462ms)
-ℹ tests 10
-ℹ suites 0
-ℹ pass 10
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 2381.258516

agents/herb/work/queue-215/granted-2008/05-packages_business_tests_instance-settings.test.mjs.log

@@ -1,21 +0,0 @@
-✔ C2-04: instance settings skip a library while checking a later code project (32.527878ms)
-✔ row 165 read lists each instance and the definitions add accepts (3.218296ms)
-✔ row 165 add: two instances join, validate exits 0, the log names the human, and the bus restart is reported (93.702292ms)
-✔ row 165 change: definition, vars and launch membership log before and after; only a definition change asks for a restart (99.793939ms)
-✔ row 165 refuses each validation failure and leaves the file's bytes alone (33.820979ms)
-✔ row 165 refuses an added instance whose definition declares credentials, and says why (5.999086ms)
-✔ row 165 refuses a definition change to or from one that declares credentials (6.767714ms)
-✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (89.83786ms)
-✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (9.793219ms)
-✔ row 165 refuses while a project file doesn't resolve, as validate would (15.487298ms)
-✔ row 165 refuses a stale revision and leaves the file's bytes alone (10.871014ms)
-✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (38.02395ms)
-✔ row 213 a creative instance is the human's: add, vars and definition changes, persona digest only (90.045141ms)
-ℹ tests 13
-ℹ suites 0
-ℹ pass 13
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 608.08011

agents/herb/work/queue-215/granted-2008/06-packages_business_tests_library-projects-protected.test.mjs.log

@@ -1,12 +0,0 @@
-✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (23.242034ms)
-✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (15.756145ms)
-✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (17.060499ms)
-✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (9.833495ms)
-ℹ tests 4
-ℹ suites 0
-ℹ pass 4
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 118.54831

agents/herb/work/queue-215/granted-2008/07-packages_business_tests_resolve.test.mjs.log

@@ -1,19 +0,0 @@
-✔ C2-04: a library first in projects does not hide a later project layer (9.584516ms)
-✔ systemVars flattens the validated config (1.063324ms)
-✔ precedence: system, business, project, project role, agent (2.001802ms)
-✔ limits narrow the definition and never widen it (2.563505ms)
-✔ role.launch stays within-role only for the instance the launch block names (5.04696ms)
-✔ limits.authority without role.launch leaves the launcher with no launch block (2.106162ms)
-✔ limits.authority narrows cross-role actions too (1.098761ms)
-✔ classify (1.065895ms)
-✔ the record carries what the broker and launcher need (0.966677ms)
-✔ digest: key order doesn't matter, any value change does (7.43546ms)
-✔ refusals (2.150825ms)
-ℹ tests 11
-ℹ suites 0
-ℹ pass 11
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 94.022587

agents/herb/work/queue-215/granted-2008/08-packages_cli_tests_launcher.test.mjs.log

@@ -1,54 +0,0 @@
-✔ C2-04: launcher workspace clones code but never the library (1298.398732ms)
-✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1264.618734ms)
-usage: {"event":"usage-unknown","business":"acme","run":"r4accc4841d41","instance":"chief","turn":"81814ac7-9330-484a-95f8-cc2f80a9aeef","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r0719029c31b1","instance":"coder","turn":"fd2dfc33-9ab6-4d4d-9eef-ba46b6d7a510","source":"@none","code":"baseline-unknown"}
-✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (657.713119ms)
-usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"6c8768d3-4742-4ae2-87c6-4653182c8520","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"4b196787-1bf9-4702-82d2-397c84ab1e3c","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"1c6ec26d-97da-43b6-8cd8-91994e6c7c7b","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"a12fdeb9-e25d-45a4-bd25-e048621a3557","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"ad419687-0675-48a8-9932-90b2da5333ef","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"0d54926f-f5b8-4dbb-b38a-8ea23fdd5cb5","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"6891e20c-472e-4e67-815e-88728024acf4","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"9ac6fe37-9044-4f54-bae0-826a6c84c15b","source":"@none","code":"baseline-unknown"}
-✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1202.248105ms)
-✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3926.301471ms)
-✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (593.731622ms)
-✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (755.589469ms)
-usage: {"event":"usage-unknown","business":"acme","run":"rf7ecf1ef2b65","instance":"coder","turn":"744cb116-e163-4b18-831e-556df7e7bfd9","source":"@none","code":"baseline-unknown"}
-✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (739.551352ms)
-✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (564.790867ms)
-✔ after a restart, the new host's first tick starts a holder whose decision is still held (883.94802ms)
-✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (595.491854ms)
-✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (250.651304ms)
-✔ a runner that stops at once ends its launch with the runner's reason (336.620423ms)
-✔ a Claude Code launch with no session credential refuses before it starts (172.971844ms)
-✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (287.021469ms)
-usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on-f827/packages/plugins/harness/down is missing","kept":[]}
-plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on-f827/packages/plugins/harness/down is missing","kept":[]}
-✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (327.373038ms)
-✔ a runner killed from the host ends its launch as killed, not failed (381.927989ms)
-✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (198.778768ms)
-✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (184.44803ms)
-✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (239.197527ms)
-✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (230.64829ms)
-usage: {"event":"usage-unknown","business":"acme","run":"r800039251a09","instance":"chief","turn":"f2e6a1ad-767e-4316-be90-6194b840e2ef","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"rfeeb081c2983","instance":"coder","turn":"1abdb906-521d-4100-897b-f5eba12663cf","source":"@none","code":"baseline-unknown"}
-✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1612.164523ms)
-✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (909.716449ms)
-✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3844.434582ms)
-✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (224.265713ms)
-✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (193.925449ms)
-✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1181.783938ms)
-✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (166.842635ms)
-✔ an over-long launch request is refused at once, not at the 10 s idle timeout (171.101521ms)
-✔ a launch client that never closes its side doesn't hold the host's close (170.266667ms)
-✔ a runner that ignores SIGTERM is killed when the host closes (1305.753454ms)
-ℹ tests 31
-ℹ suites 0
-ℹ pass 31
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 24989.261794

agents/herb/work/queue-215/granted-2008/09-packages_cli_tests_stack-release-external.test.mjs.log

@@ -1,33 +0,0 @@
-✔ row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it (1129.148785ms)
-✔ row 232: pm-on and activate --pm-after-harness refuse external-pm (1112.631619ms)
-✔ row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down (2301.278572ms)
-✔ row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal (2229.906955ms)
-✔ row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED (1913.7476ms)
-✔ row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation (3892.845676ms)
-✔ row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed (3703.021367ms)
-✔ row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker (6350.955178ms)
-✔ row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start (3365.187863ms)
-✔ row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10 (4713.287991ms)
-✔ row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing (3014.18649ms)
-✔ row 232: the external PM check reads launches list: one live run of launch.by since the start passes (7715.019003ms)
-✔ row 232: revert puts the wrapper back and leaves the store when nothing migrated (1540.240269ms)
-✔ row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate (3838.859298ms)
-✔ row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup (4385.316411ms)
-✔ row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok (5668.17255ms)
-✔ row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3 (3356.512703ms)
-✔ row 232: sequence 3: activate, root's A4 fails, revert, confirm --rollback --cause A4: failed code units-start (3090.998502ms)
-✔ row 232: sequence 4: a capture failure leaves nothing open, then A2f's gate OLD writes nothing (2006.820211ms)
-✔ row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation (3716.790879ms)
-✔ row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run (2084.865556ms)
-✔ row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback (8859.407093ms)
-✔ row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3 (4066.89509ms)
-✔ row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base's calls (8472.325246ms)
-✔ row 232: user mode: a default activate --plan prints the base's bytes (2725.266801ms)
-ℹ tests 25
-ℹ suites 0
-ℹ pass 25
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 96332.465778

agents/herb/work/queue-215/granted-2008/10-packages_cli_tests_stack-release.test.mjs.log

@@ -1,227 +0,0 @@
-✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1604.406515ms)
-✔ T2 activate installs exactly the pointer's pm, claude and Console flags (2285.234425ms)
-▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
-  ✔ pm (1074.84155ms)
-  ✔ claude (1048.597035ms)
-  ✔ console (1069.472197ms)
-✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (3193.872973ms)
-▶ T4 each item 3 refusal changes nothing and logs one line with its code
-  ✔ copy-missing (970.101799ms)
-  ✔ copy-unreachable (976.867501ms)
-  ✔ copy-schema-unknown (942.411453ms)
-  ✔ already-active (966.01391ms)
-  ✔ instance-busy (another business active) (1033.865857ms)
-  ✔ instance-busy (this business activating) (989.106934ms)
-  ✔ drop-in-override (1051.252734ms)
-  ✔ no-pointer (535.256184ms)
-✔ T4 each item 3 refusal changes nothing and logs one line with its code (7466.71817ms)
-✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (2298.616234ms)
-✔ T6 a migration without --migrate rolls back with migration-needs-flag (2085.91559ms)
-✔ T7 --migrate takes the backup before the migration runs (2415.592569ms)
-✔ T8 a failed migration restores the backup and keeps the store it replaced (2571.261148ms)
-✔ T9 a store outside the target's chain rolls back with store-newer (2405.058696ms)
-▶ T10 each gate check failing alone rolls back and puts every file back
-  ✔ units-inactive (5907.690999ms)
-  ✔ bus-status (6093.058453ms)
-  ✔ healthz (6393.330472ms)
-  ✔ copy-check (5442.480521ms)
-  ✔ pm-launch-unconfirmed (5607.705975ms)
-✔ T10 each gate check failing alone rolls back and puts every file back (29445.44482ms)
-▶ T10b the PM check needs exactly one launched line for a live run of this start
-  ✔ no launched line (5534.978468ms)
-  ✔ two lines (5372.975087ms)
-  ✔ a changed word (5420.826895ms)
-  ✔ run not in launches list (5601.520776ms)
-  ✔ run started before the start (5448.208485ms)
-  ✔ a human launch with no journal line (5346.70067ms)
-  ✔ run for another business (5684.948726ms)
-  ✔ run not live (5860.307931ms)
-  ✔ one well-formed line and a live run pass (2078.4402ms)
-✔ T10b the PM check needs exactly one launched line for a live run of this start (46350.52861ms)
-✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (7145.208417ms)
-✔ T12 rollback takes the previous copy from the log (3164.021139ms)
-✔ T13 a rollback across a migration needs --restore, then restores and goes live (3796.056873ms)
-✔ T14 events written after the backup need --events N with the right N (4384.802883ms)
-✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5813.087127ms)
-✔ T14c a rollback without --restore whose gate fails runs item 6 (6237.609182ms)
-✔ T15 --plan names the migration and the restore and changes nothing (2849.139286ms)
-✔ T26 --plan lists the commits an activate adds, after the migration lines (1481.868533ms)
-✔ T27 --plan names each migration step, or says the steps cannot be read (1173.748951ms)
-✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (569.344968ms)
-▶ T23 --plan reads the store without changing a file, stopped or held
-  ✔ stopped store (721.626407ms)
-  ✔ held store (690.820461ms)
-✔ T23 --plan reads the store without changing a file, stopped or held (1413.175682ms)
-✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1463.46361ms)
-✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (910.07629ms)
-✔ T19 a started line with no final line: status shows it and every changing verb refuses (1271.59212ms)
-✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1515.929929ms)
-✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1789.2511ms)
-▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
-  ✔ bus.sqlite-wal (1954.988144ms)
-  ✔ bus.sqlite-shm (2042.456191ms)
-  ✔ clean (2209.768749ms)
-✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (6208.13226ms)
-▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
-  ✔ unit path (938.058563ms)
-  ✔ drop-in directory (934.896589ms)
-  ✔ drop-in file (958.129787ms)
-  ✔ relative unit path (943.563721ms)
-✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3775.662901ms)
-▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
-  ✔ --plan (932.393863ms)
-  ✔ rollback --restore (2879.958858ms)
-✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3812.923223ms)
-✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (6646.085499ms)
-▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
-  ✔ Environment double quotes (1976.227811ms)
-  ✔ Environment single quotes (2063.211816ms)
-  ✔ Environment backslash (2038.183771ms)
-  ✔ ExecStart quotes (1984.451614ms)
-  ✔ Console ExecStart quotes (1980.466835ms)
-✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (10043.710809ms)
-▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
-  ✔ usage: not with --pm, and only for activate (721.955423ms)
-  ✔ pm-after-harness-target (1015.757752ms)
-  ✔ pm-after-harness-set (1371.242025ms)
-  ✔ a pointer without pm (841.537689ms)
-  ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (1915.010297ms)
-✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (5866.555622ms)
-▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
-  ✔ read_pointer (1570.154285ms)
-  ✔ pm-pending, already-adopted and the status line (3037.065347ms)
-✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (4607.778248ms)
-▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
-  ✔ not-pending (719.010856ms)
-  ✔ harness-unset (2272.485716ms)
-  ✔ a launched line passes: the bus alone restarts with --pm (3276.598137ms)
-  ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6693.543553ms)
-  ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (8141.636634ms)
-✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (21104.286659ms)
-▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
-  ✔ rollback from pending gates pm_launched on the old copy (3372.092831ms)
-  ✔ after the harness set, rollback refuses until harness is gone (5046.857905ms)
-  ✔ activate names every kind the target lacks (1244.308621ms)
-✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (9663.997607ms)
-✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3695.067003ms)
-✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (6897.072525ms)
-✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (3812.546819ms)
-✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (904.276249ms)
-✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (819.160889ms)
-✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (8462.827367ms)
-✔ T42 tester-port pm-on preserves pointer Console flags (3200.83272ms)
-▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
-  ✔ activate then pm-on on the same copy (3520.417628ms)
-  ✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6507.524064ms)
-  ✔ adopt takes the next free id too (703.050442ms)
-  ✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (956.29941ms)
-  ✔ --restore takes an id with or without -1 to -9 and nothing else (971.565868ms)
-✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (12659.952034ms)
-▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
-  ✔ a bad tester port (1970.260005ms)
-  ✔ without --plan a bad port is usage before any pointer read (650.605696ms)
-  ✔ a target Console without --tester-port (1005.8136ms)
-✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3627.354723ms)
-▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table
-  ✔ both modes count events and each listed table, and a table the store lacks counts 0 (817.850391ms)
-  ✔ one instance_names row and no event refuses before any stop; --events 1 restores (4258.491111ms)
-  ✔ one usage_records row and no event refuses before any stop; --events 1 restores (4200.77682ms)
-  ✔ a listed table that cannot be read refuses restore-mismatch before any stop (2308.610496ms)
-  ✔ the in-run recount counts the listed tables too (3113.596786ms)
-✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (14700.29833ms)
-✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (3.037176ms)
-✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (1868.973993ms)
-✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5804.760552ms)
-▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP
-  ✔ no rows after STAMP: restores and goes live (3320.288695ms)
-  ✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (3651.108762ms)
-✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (6972.06843ms)
-✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2352.202566ms)
-✔ T51 row 185 test 5: an activate with no store file takes no backup (2180.71818ms)
-▶ T52 row 186: the activate plan's backup line says what the run will do
-  ✔ same schema (2482.119077ms)
-  ✔ same schema with --migrate (2194.383877ms)
-  ✔ in chain with --migrate (2161.378827ms)
-  ✔ in chain without --migrate (1945.096692ms)
-  ✔ outside the chain (1933.991036ms)
-  ✔ outside the chain with --migrate (1982.219098ms)
-✔ T52 row 186: the activate plan's backup line says what the run will do (12700.35568ms)
-✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3084.56264ms)
-✔ T178 proxy proof pair survives a tester-port replacement as well (1871.352274ms)
-▶ T53 row 187: activate sets, carries and drops the proof pair
-  ✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (5957.458612ms)
-  ✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (4748.919152ms)
-  ✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (6348.550383ms)
-  ✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (3766.45236ms)
-  ✔ test 3: pm-on keeps the pair (2959.180793ms)
-  ✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (5233.036939ms)
-  ✔ test 5: each refusal exits 3 before anything stops (3649.68534ms)
-  ✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (836.025341ms)
-  ✔ test 6: usage errors (773.25631ms)
-  ✔ test 7: a rollback to a copy without proof support drops the pair and says so (3311.183201ms)
-  ✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (3616.1202ms)
-✔ T53 row 187: activate sets, carries and drops the proof pair (41201.876404ms)
-▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses
-  ✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2194.421439ms)
-  ✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (2189.529552ms)
-  ✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2243.035352ms)
-  ✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2336.000835ms)
-  ✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1105.046097ms)
-  ✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1150.666433ms)
-✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (11219.876632ms)
-▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off
-  ✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2274.3857ms)
-  ✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (3110.763383ms)
-  ✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (4485.563548ms)
-  ✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (3260.741012ms)
-  ✔ test 4: pm-on after --no-send keeps --send off (3151.996202ms)
-  ✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (654.253174ms)
-  ✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (9881.189087ms)
-✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (26820.278319ms)
-▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso
-  ✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (3703.052075ms)
-  ✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (8819.731338ms)
-  ✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (692.195455ms)
-  ✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (5662.393194ms)
-  ✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4284.150525ms)
-  ✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (11448.283647ms)
-  ✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4548.577973ms)
-  ✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2401.295904ms)
-  ✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2172.272961ms)
-  ✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (4291.803296ms)
-  ✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1134.427878ms)
-✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (49160.357454ms)
-✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (3480.635997ms)
-✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (3538.664935ms)
-✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (352.394887ms)
-✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (22497.071985ms)
-✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (4425.852712ms)
-✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (5628.652507ms)
-✔ R7 a host on another copy fails copy-match (5626.942239ms)
-✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (483.876429ms)
-✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (737.183647ms)
-✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (336.641991ms)
-✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1329.146892ms)
-✔ R12 mos-0962: a notifier config with a binding fails notify-off (322.530573ms)
-✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (467.892209ms)
-✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (9332.612807ms)
-✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (9980.867141ms)
-✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (3438.884089ms)
-✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (190.873827ms)
-✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (117.903969ms)
-▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins
-  ✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (1497.847969ms)
-  ✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (1995.198242ms)
-  ✔ T-I6 alpha's activate and rollback reach nothing of beta's (3765.448219ms)
-  ✔ T-I6 swapped: beta's reach nothing of alpha's (3738.069466ms)
-  ✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (672.561735ms)
-  ✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (5819.537565ms)
-✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (17490.000329ms)
-ℹ tests 196
-ℹ suites 0
-ℹ pass 196
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 533493.817869

agents/herb/work/queue-215/granted-2008/11-packages_cli_tests_stack-upgrade.test.mjs.log

@@ -1,29 +0,0 @@
-✔ row 233: sequence 1: confirm fails healthz, the driver reverts, renders the old copy and confirm --rollback --cause A5 passes: exit 1 (6210.373434ms)
-✔ row 233: sequence 2: activate --migrate fails at the wrapper, revert restores the store, confirm --rollback --cause A3: exit 1 (3236.556603ms)
-✔ row 233: sequence 3: root's render of the new copy fails, the driver rolls back with --cause A4, and holds the lock to the end: exit 1 (3088.506825ms)
-✔ row 233: sequence 4: a capture failure is exit 3 from the stage, and A2f restarts the old units and gates them: exit 1 (2296.722984ms)
-✔ row 233: N1: a bus that outlives A2's timeout keeps its old start, so A2f's gate fails stale-start: exit 2, both units stopped (7977.855045ms)
-✔ row 233: sequence 5: confirm of the wrong copy is refused, and the driver rolls back with --cause A5: exit 1 (3484.271196ms)
-✔ row 233: sequence 6: a revert that fails stops both units at exit 2, and the next run refuses at its --plan with nothing stopped (2709.834241ms)
-✔ row 233: sequence 7: two upgrades and a rollback --to the previous copy with --restore, the args file following each confirm (7481.097653ms)
-✔ row 240: I3 N1: a failed args move after A5 exits 5 args-failed, the new copy live and confirmed and both args files kept (2791.714439ms)
-✔ row 233: sequence 8: a migration that writes and fails: the driver reverts to the backup byte for byte, --cause A3: exit 1 (3155.287145ms)
-✔ row 233: a second run while the lock is held refuses upgrade-running with one log line and no call (659.849042ms)
-✔ row 233: A1 refuses open-activation on any AWAITING-UNITS file, through the stack's user's --plan, with nothing stopped (1064.03698ms)
-✔ row 233: a target that migrates refuses migrate-required without --migrate, with nothing stopped (1067.011634ms)
-✔ row 233: the rehearsal runs after the plan and before A2; a failed one refuses rehearsal-failed with nothing stopped (1099.022074ms)
-✔ row 233: the rehearsal's BACKUP_STORE line goes to the step log after a match, a malformed one as none, the rest of its output never (2918.095196ms)
-✔ row 233: a real rehearsal with no backup in the log refuses no-backup, and goes on only with --no-rehearsal, which logs the skip (3400.448853ms)
-✔ row 233: a real rehearsal after an upgrade names the log's newest backup; --no-rehearsal with a backup refuses rehearsal-required (3795.598553ms)
-✔ row 233: the args file must be the running user's, with no group or other write, one --copy, and the copy the units run (839.804685ms)
-✔ row 233: hostcheck (row 240): a nonzero --check or a missing file refuses profile-drift before the plan (962.315692ms)
-✔ row 233: the checkout must be at --sha (head-mismatch), and a commit the clone can't fast-forward to refuses fetch-failed (936.914531ms)
-✔ row 233: usage exits 4 before any log or lock (685.887579ms)
-ℹ tests 21
-ℹ suites 0
-ℹ pass 21
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 60456.446459

agents/herb/work/queue-215/granted-2008/12-packages_cli_tests_trackers-boot.test.mjs.log

@@ -1,12 +0,0 @@
-✔ C2-04: a library-only business with tracker.baseUrl boots without a project tracker (143.257728ms)
-task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
-task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
-✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (274.054339ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 502.723687

agents/herb/work/queue-215/granted-2008/13-packages_library_tests_mirror.test.mjs.log

@@ -1,24 +0,0 @@
-✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (35.180686ms)
-✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (28.575775ms)
-✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (100.935123ms)
-✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (11.206477ms)
-✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (20.077192ms)
-✔ C2-04 state: missing state is empty only while the served ref is absent (32.816347ms)
-✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (34.864084ms)
-✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (97.291867ms)
-✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (29.030379ms)
-✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (71.409306ms)
-✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (78.061049ms)
-✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (230.30816ms)
-✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5027.25259ms)
-✔ C2-04 lock: owner death releases the kernel lock without replacing its file (52.471475ms)
-✔ C2-04 lock: a missing flock binary becomes a handled refusal (44.850141ms)
-✔ C2-04 lock: an unawaited scoped read drains before the lock is released (19.645975ms)
-ℹ tests 16
-ℹ suites 0
-ℹ pass 16
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 5963.543966

agents/herb/work/queue-215/granted-2008/14-packages_project_tests_project.test.mjs.log

@@ -1,23 +0,0 @@
-✔ C2-04: record APIs refuse a library before creating a repository (2.136303ms)
-✔ init creates a checked versioned layout, valid templates and human-authored local history (25.282114ms)
-✔ init honors repo, refuses a non-empty directory and an undeclared project without touching files (13.067957ms)
-✔ check reports every bad record, filename mismatch and unknown top-level path (11.851979ms)
-✔ one writer commits validated docs, requirements and decisions with the bound agent author (66.653ms)
-✔ writer refuses spec paths, bad schemas, mismatched IDs and invalid actor metadata before changing history (14.848593ms)
-✔ writer refuses human pending edits and remotes instead of absorbing or contacting them (18.544136ms)
-✔ links, repo/code overlap, identity mismatch and a busy writer refuse safely (17.705717ms)
-✔ schemas remain package-owned and reject invalid nested data and dates (0.249795ms)
-✔ git commit failure restores only the attempted record and leaves human history unchanged (36.217826ms)
-✔ git hooks and ambient git identity cannot alter the record writer or execute outside actions (25.483658ms)
-✔ project-local schemas cannot weaken checks; invalid UTF-8 and linked git directories refuse (14.206204ms)
-✔ schema constraints and layout omissions are reported independently (12.868115ms)
-✔ unsupported schema keywords, malformed contexts, ignored local config and nonempty markers refuse (18.523225ms)
-✔ a linked git directory is refused before a writer lock can touch its target (30.574055ms)
-ℹ tests 15
-ℹ suites 0
-ℹ pass 15
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 355.86586

agents/herb/work/queue-215/granted-2008/15-packages_seat_tests_checkout.test.mjs.log

@@ -1,91 +0,0 @@
-✔ C2-04: ensureCheckouts skips a library before a real clone and leaves no books path (22.355495ms)
-✔ a first launch clones the root at its branch, with the root's path as origin (23.522928ms)
-✔ the clone is not at its place until git clone has finished (19.304369ms)
-✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (56.365259ms)
-✔ a clone ahead of the root keeps its commits and counts as current (35.573942ms)
-▶ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves
-  ✔ a modified file (41.519272ms)
-  ✔ an untracked file (42.31579ms)
-  ✔ a staged file (42.328417ms)
-  ✔ another branch (40.470049ms)
-  ✔ a detached HEAD (40.702516ms)
-✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (208.344457ms)
-✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (42.026437ms)
-▶ a clone kept before the branch check, or for a failed status, gets no fetch
-  ✔ not-a-clone (22.404264ms)
-  ✔ hooks-present (23.073574ms)
-  ✔ submodule (30.027272ms)
-  ✔ config-changed (26.84014ms)
-  ✔ root-unreadable (27.464656ms)
-  ✔ root-detached (32.242501ms)
-  ✔ status-failed, on the root's branch and clean (35.760734ms)
-  ✔ status-failed, dirty (35.340017ms)
-✔ a clone kept before the branch check, or for a failed status, gets no fetch (234.251087ms)
-✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (37.035833ms)
-✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (44.392371ms)
-✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (71.033894ms)
-▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
-  ✔ user.name (25.544784ms)
-  ✔ user.email (25.14754ms)
-✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (51.146879ms)
-✔ a commit git can't read after the fast-forward is null (45.746486ms)
-✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (18.576825ms)
-▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
-  ✔ core.fsmonitor (33.120199ms)
-  ✔ core.hooksPath (33.027016ms)
-  ✔ a hook file (30.549575ms)
-  ✔ include.path (33.355749ms)
-  ✔ includeIf (33.915275ms)
-  ✔ a filter driver (34.236367ms)
-  ✔ origin moved (34.552998ms)
-  ✔ a second origin url (33.217597ms)
-  ✔ the origin url twice, both the root (34.870837ms)
-  ✔ an ext:: origin (33.6526ms)
-  ✔ a branch tracking another remote (33.582081ms)
-  ✔ a branch merging a tag (33.08648ms)
-  ✔ a fetch line onto local branches (34.366694ms)
-  ✔ no origin (33.938644ms)
-  ✔ a config file over the size cap (31.285987ms)
-  ✔ config a symlink to /dev/zero (31.094858ms)
-  ✔ the clone a symlink to the bait (32.754738ms)
-  ✔ the clone a file (31.24085ms)
-  ✔ the clone a plain directory (30.973366ms)
-  ✔ .git a gitdir: file (31.404094ms)
-  ✔ .git a symlink (30.769522ms)
-  ✔ .git/logs a symlink (30.883317ms)
-  ✔ .git/refs/heads a symlink (31.770074ms)
-  ✔ .git/objects a symlink (30.840803ms)
-  ✔ a reflog hard-linked to a file outside (30.322982ms)
-  ✔ HEAD a fifo (31.496048ms)
-  ✔ a commondir file (30.352537ms)
-  ✔ an alternates file (30.782307ms)
-  ✔ a gitlink staged, no .gitmodules (43.468245ms)
-  ✔ a gitlink and .gitmodules staged (44.893483ms)
-  ✔ a gitlink to a repository with its own gitlink (51.849481ms)
-  ✔ a gitlink and .gitmodules committed (47.718755ms)
-  ✔ a gitlink and submodule.active in config (44.861481ms)
-  ✔ a .git/modules with no gitlink (33.279554ms)
-✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1175.645437ms)
-▶ a root that can't be cloned refuses with the project id and leaves nothing behind
-  ✔ missing (10.161685ms)
-  ✔ not a repository (9.929001ms)
-  ✔ a plain directory inside another repository (14.613067ms)
-  ✔ unreadable (9.85915ms)
-  ✔ on no branch (11.8808ms)
-  ✔ missing an object (15.129485ms)
-✔ a root that can't be cloned refuses with the project id and leaves nothing behind (72.336456ms)
-✔ a clone whose root is on no branch, or gone, is kept and named (28.236024ms)
-✔ no credential or forge remote of the root reaches a clone (47.533999ms)
-✔ every project in the business file gets its own clone at its own branch (36.497038ms)
-✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (513.397369ms)
-✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1018.126958ms)
-✔ a timeout signals git's process group, so a process git started dies with it (515.579592ms)
-✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (515.62296ms)
-ℹ tests 78
-ℹ suites 0
-ℹ pass 78
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 4880.907448

agents/herb/work/queue-215/granted-2008/16-packages_webui_tests_library-cli.test.mjs.log

@@ -1,9 +0,0 @@
-✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (109.519835ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 191.536271

agents/herb/work/queue-215/granted-2008/cleanup.json

@@ -1 +0,0 @@
-{"processes": [], "removed": "/mnt/storage/scratch/gt-j5nm6iqn", "sourceHashesUnchanged": 29}

agents/herb/work/queue-215/granted-2008/drift.json

@@ -1,5 +0,0 @@
-{
-  "base": "f8276c5eb",
-  "tip": "8a04f4aa4aba493eb89e92aa9e0c34084be7058e",
-  "overlap": []
-}

agents/herb/work/queue-215/granted-2008/end.txt

@@ -1 +0,0 @@
-2026-10-21T13:27:27.279728+00:00

agents/herb/work/queue-215/granted-2008/results.json

@@ -1,194 +0,0 @@
-[
-  {
-    "file": "packages/bus/tests/library.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 6,
-      "pass": 6,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "01-packages_bus_tests_library.test.mjs.log"
-  },
-  {
-    "file": "packages/bus/tests/project-runtime.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 3,
-      "pass": 3,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "02-packages_bus_tests_project-runtime.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/business.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 19,
-      "pass": 19,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "03-packages_business_tests_business.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/cli.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 10,
-      "pass": 10,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "04-packages_business_tests_cli.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/instance-settings.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 13,
-      "pass": 13,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "05-packages_business_tests_instance-settings.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/library-projects-protected.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 4,
-      "pass": 4,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "06-packages_business_tests_library-projects-protected.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/resolve.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 11,
-      "pass": 11,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "07-packages_business_tests_resolve.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/launcher.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 31,
-      "pass": 31,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "08-packages_cli_tests_launcher.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/stack-release-external.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 25,
-      "pass": 25,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "09-packages_cli_tests_stack-release-external.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/stack-release.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 196,
-      "pass": 196,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "10-packages_cli_tests_stack-release.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/stack-upgrade.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 21,
-      "pass": 21,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "11-packages_cli_tests_stack-upgrade.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/trackers-boot.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 2,
-      "pass": 2,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "12-packages_cli_tests_trackers-boot.test.mjs.log"
-  },
-  {
-    "file": "packages/library/tests/mirror.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 16,
-      "pass": 16,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "13-packages_library_tests_mirror.test.mjs.log"
-  },
-  {
-    "file": "packages/project/tests/project.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 15,
-      "pass": 15,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "14-packages_project_tests_project.test.mjs.log"
-  },
-  {
-    "file": "packages/seat/tests/checkout.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 78,
-      "pass": 78,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "15-packages_seat_tests_checkout.test.mjs.log"
-  },
-  {
-    "file": "packages/webui/tests/library-cli.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 1,
-      "pass": 1,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "16-packages_webui_tests_library-cli.test.mjs.log"
-  }
-]

agents/herb/work/queue-215/granted-2008/root.txt

@@ -1 +0,0 @@
-/mnt/storage/scratch/gt-j5nm6iqn

agents/herb/work/queue-215/granted-2008/start.txt

@@ -1 +0,0 @@
-2026-10-21T13:15:15.548778+00:00

agents/herb/work/queue-215/granted-2008/summary.json

@@ -1 +0,0 @@
-{"tests": 451, "pass": 451, "fail": 0, "cancelled": 0, "skipped": 0}

agents/herb/work/queue-215/granted-singles/01-packages_bus_tests_library.test.mjs.log

@@ -1,14 +0,0 @@
-✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (31.111616ms)
-✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (12.907709ms)
-✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.631614ms)
-✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (42.32493ms)
-✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (20.701022ms)
-✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (82.322654ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 6
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 342.882774

agents/herb/work/queue-215/granted-singles/02-packages_bus_tests_project-runtime.test.mjs.log

@@ -1,11 +0,0 @@
-✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (1.629219ms)
-✔ without a trusted project adapter all three async paths refuse project-not-configured (43.976856ms)
-✔ real startBroker injects the project adapter for socket reads and bound-author record writes (68.038516ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 209.393305

agents/herb/work/queue-215/granted-singles/03-packages_business_tests_business.test.mjs.log

@@ -1,26 +0,0 @@
-✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (9.717487ms)
-✔ C2-04: an otherwise valid publish grant cannot name a library repo (1.932435ms)
-✔ config directory and file path follow MOSAIC_CONFIG (0.219374ms)
-✔ the fixture business validates and comes back frozen (0.988926ms)
-✔ two instances may share a definition (0.940973ms)
-✔ top-level refusals (3.202519ms)
-✔ arbiters and projects (4.893652ms)
-✔ role instances (2.749701ms)
-✔ Vikunja bots (5.88131ms)
-✔ a role without Vikunja takes no tracker block (4.097438ms)
-✔ credential references match the definition's services (2.14689ms)
-✔ launch (7.492201ms)
-✔ REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses (4.633228ms)
-✔ loadBusiness: file checks (1.761847ms)
-✔ loadBusiness: not a regular file (36.320112ms)
-✔ loading writes nothing (1.117059ms)
-✔ names that are Object.prototype properties don't count as declared (2.898886ms)
-✔ the shipped example refuses as written and validates once filled in (0.943369ms)
-ℹ tests 18
-ℹ suites 0
-ℹ pass 18
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 152.091247

agents/herb/work/queue-215/granted-singles/04-packages_business_tests_cli.test.mjs.log

@@ -1,18 +0,0 @@
-✔ C2-04: business validate and resolve skip a library before code projects and credential checks (219.31729ms)
-✔ usage errors exit 4 (321.939555ms)
-✔ validate: a good business exits 0 and prints instance digests (76.14497ms)
-✔ validate: project files (353.409636ms)
-✔ validate: missing files and a broken system config (238.885921ms)
-✔ validate: credential reference problems exit 2 and name each one (72.187146ms)
-✔ validate: a token file inside the repository is refused (66.603163ms)
-✔ validate: role definitions come from MOSAIC_ROLES_DIR (212.341091ms)
-✔ resolve: prints one instance's record (340.865306ms)
-✔ resolve: refusals (526.732262ms)
-ℹ tests 10
-ℹ suites 0
-ℹ pass 10
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 2493.367293

agents/herb/work/queue-215/granted-singles/05-packages_business_tests_instance-settings.test.mjs.log

@@ -1,20 +0,0 @@
-✔ C2-04: instance settings skip a library while checking a later code project (33.384562ms)
-✔ row 165 read lists each instance and the definitions add accepts (2.667885ms)
-✔ row 165 add: two instances join, validate exits 0, the log names the human, and the bus restart is reported (87.186598ms)
-✔ row 165 change: definition, vars and launch membership log before and after; only a definition change asks for a restart (92.493768ms)
-✔ row 165 refuses each validation failure and leaves the file's bytes alone (29.566007ms)
-✔ row 165 refuses an added instance whose definition declares credentials, and says why (3.207564ms)
-✔ row 165 refuses a definition change to or from one that declares credentials (4.215516ms)
-✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (72.107052ms)
-✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (7.281711ms)
-✔ row 165 refuses while a project file doesn't resolve, as validate would (13.645202ms)
-✔ row 165 refuses a stale revision and leaves the file's bytes alone (10.119096ms)
-✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (29.171515ms)
-ℹ tests 12
-ℹ suites 0
-ℹ pass 12
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 450.444507

agents/herb/work/queue-215/granted-singles/06-packages_business_tests_library-projects-protected.test.mjs.log

@@ -1,12 +0,0 @@
-✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (20.276877ms)
-✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (16.209877ms)
-✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (13.103686ms)
-✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (12.598611ms)
-ℹ tests 4
-ℹ suites 0
-ℹ pass 4
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 112.92317

agents/herb/work/queue-215/granted-singles/07-packages_business_tests_resolve.test.mjs.log

@@ -1,19 +0,0 @@
-✔ C2-04: a library first in projects does not hide a later project layer (6.304379ms)
-✔ systemVars flattens the validated config (0.828852ms)
-✔ precedence: system, business, project, project role, agent (1.532829ms)
-✔ limits narrow the definition and never widen it (2.353655ms)
-✔ role.launch stays within-role only for the instance the launch block names (4.439921ms)
-✔ limits.authority without role.launch leaves the launcher with no launch block (1.815884ms)
-✔ limits.authority narrows cross-role actions too (0.827532ms)
-✔ classify (0.829892ms)
-✔ the record carries what the broker and launcher need (0.755977ms)
-✔ digest: key order doesn't matter, any value change does (5.452ms)
-✔ refusals (1.724971ms)
-ℹ tests 11
-ℹ suites 0
-ℹ pass 11
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 79.941483

agents/herb/work/queue-215/granted-singles/08-packages_cli_tests_launcher.test.mjs.log

@@ -1,53 +0,0 @@
-✔ C2-04: launcher workspace clones code but never the library (1262.341325ms)
-✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1237.473965ms)
-usage: {"event":"usage-unknown","business":"acme","run":"r4414332d2ef5","instance":"chief","turn":"382a782c-719a-48e8-a249-ec24caf5ad1e","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"reaca93954ae7","instance":"coder","turn":"70bcac05-fbc1-41b2-85cb-725c15884a94","source":"@none","code":"baseline-unknown"}
-✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (579.516254ms)
-usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"c228faeb-6e3c-4453-ba9b-b9a27b9790af","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"a5d09ce0-4208-4eb4-8178-6e06a1792ab9","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"25722023-5270-4c50-a8a0-7c3645d08bd7","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"f4a76756-4300-4cdf-a64b-542fc075c137","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"99ea9441-ce4e-4aab-a56c-614a30c9f0da","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"d85fa6e4-7557-4adf-b1f6-5e76455a1e51","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"87f4bf91-2ef2-4fe7-8e99-09fc8b14887e","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"6db9d009-2cb9-41ba-a07e-da13d92b8182","source":"@none","code":"baseline-unknown"}
-✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (917.244851ms)
-✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3692.977114ms)
-✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (439.559581ms)
-✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (324.77099ms)
-usage: {"event":"usage-unknown","business":"acme","run":"rd33ea739f0c8","instance":"coder","turn":"434622cc-98ff-44b4-99c9-58a8c92f32af","source":"@none","code":"baseline-unknown"}
-✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (502.385034ms)
-✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (453.667705ms)
-✔ after a restart, the new host's first tick starts a holder whose decision is still held (654.880099ms)
-✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (498.662638ms)
-✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (208.782448ms)
-✔ a runner that stops at once ends its launch with the runner's reason (261.153743ms)
-✔ a Claude Code launch with no session credential refuses before it starts (143.737058ms)
-✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (239.874115ms)
-usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212/packages/plugins/harness/down is missing","kept":[]}
-plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212/packages/plugins/harness/down is missing","kept":[]}
-✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (281.577833ms)
-✔ a runner killed from the host ends its launch as killed, not failed (297.263791ms)
-✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (151.327191ms)
-✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (151.537445ms)
-✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (166.552674ms)
-usage: {"event":"usage-unknown","business":"acme","run":"rc42c73baf400","instance":"chief","turn":"e62acc78-0ddd-4cd3-bb90-c828cf5dc76e","source":"@none","code":"baseline-unknown"}
-usage: {"event":"usage-unknown","business":"acme","run":"r9fac1139247f","instance":"coder","turn":"e634dd74-b64a-4c8d-8e8d-90244a1070d4","source":"@none","code":"baseline-unknown"}
-✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1685.572916ms)
-✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (791.200293ms)
-✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3731.707174ms)
-✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (196.993732ms)
-✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (159.584006ms)
-✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1086.093241ms)
-✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (132.916552ms)
-✔ an over-long launch request is refused at once, not at the 10 s idle timeout (143.651083ms)
-✔ a launch client that never closes its side doesn't hold the host's close (144.715063ms)
-✔ a runner that ignores SIGTERM is killed when the host closes (1275.914847ms)
-ℹ tests 30
-ℹ suites 0
-ℹ pass 30
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 21918.233853

agents/herb/work/queue-215/granted-singles/09-packages_cli_tests_stack-release-external.test.mjs.log

@@ -1,33 +0,0 @@
-✔ row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it (832.842347ms)
-✔ row 232: pm-on and activate --pm-after-harness refuse external-pm (934.889182ms)
-✔ row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down (2121.604528ms)
-✔ row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal (1777.227274ms)
-✔ row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED (1712.692045ms)
-✔ row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation (3642.165244ms)
-✔ row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed (3522.196896ms)
-✔ row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker (5641.501857ms)
-✔ row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start (3076.294408ms)
-✔ row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10 (4471.752137ms)
-✔ row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing (2692.190142ms)
-✔ row 232: the external PM check reads launches list: one live run of launch.by since the start passes (9781.807961ms)
-✔ row 232: revert puts the wrapper back and leaves the store when nothing migrated (1409.775029ms)
-✔ row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate (3556.739549ms)
-✔ row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup (3258.873111ms)
-✔ row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok (4878.560819ms)
-✔ row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3 (3203.155908ms)
-✔ row 232: sequence 3: activate, root's A4 fails, revert, confirm --rollback --cause A4: failed code units-start (2844.170694ms)
-✔ row 232: sequence 4: a capture failure leaves nothing open, then A2f's gate OLD writes nothing (1940.493148ms)
-✔ row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation (3423.561744ms)
-✔ row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run (1732.106092ms)
-✔ row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback (8298.40004ms)
-✔ row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3 (3658.849346ms)
-✔ row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base's calls (7450.661653ms)
-✔ row 232: user mode: a default activate --plan prints the base's bytes (2572.062595ms)
-ℹ tests 25
-ℹ suites 0
-ℹ pass 25
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 89317.249955

agents/herb/work/queue-215/granted-singles/10-packages_cli_tests_stack-release.test.mjs.log

@@ -1,227 +0,0 @@
-✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1372.806902ms)
-✔ T2 activate installs exactly the pointer's pm, claude and Console flags (2175.278069ms)
-▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
-  ✔ pm (940.434448ms)
-  ✔ claude (905.331444ms)
-  ✔ console (953.801488ms)
-✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (2800.414725ms)
-▶ T4 each item 3 refusal changes nothing and logs one line with its code
-  ✔ copy-missing (828.258816ms)
-  ✔ copy-unreachable (750.040135ms)
-  ✔ copy-schema-unknown (804.784952ms)
-  ✔ already-active (767.83377ms)
-  ✔ instance-busy (another business active) (836.742584ms)
-  ✔ instance-busy (this business activating) (824.181046ms)
-  ✔ drop-in-override (819.802212ms)
-  ✔ no-pointer (432.597537ms)
-✔ T4 each item 3 refusal changes nothing and logs one line with its code (6065.707472ms)
-✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (1974.205406ms)
-✔ T6 a migration without --migrate rolls back with migration-needs-flag (1689.71261ms)
-✔ T7 --migrate takes the backup before the migration runs (1874.080499ms)
-✔ T8 a failed migration restores the backup and keeps the store it replaced (1879.088438ms)
-✔ T9 a store outside the target's chain rolls back with store-newer (1695.743767ms)
-▶ T10 each gate check failing alone rolls back and puts every file back
-  ✔ units-inactive (5145.320966ms)
-  ✔ bus-status (5504.739824ms)
-  ✔ healthz (4630.494167ms)
-  ✔ copy-check (4953.814776ms)
-  ✔ pm-launch-unconfirmed (5175.714883ms)
-✔ T10 each gate check failing alone rolls back and puts every file back (25411.164743ms)
-▶ T10b the PM check needs exactly one launched line for a live run of this start
-  ✔ no launched line (5309.620588ms)
-  ✔ two lines (5271.450965ms)
-  ✔ a changed word (5207.189363ms)
-  ✔ run not in launches list (5249.94294ms)
-  ✔ run started before the start (5297.104798ms)
-  ✔ a human launch with no journal line (5012.384828ms)
-  ✔ run for another business (5255.258408ms)
-  ✔ run not live (5155.194619ms)
-  ✔ one well-formed line and a live run pass (1936.667118ms)
-✔ T10b the PM check needs exactly one launched line for a live run of this start (43696.539474ms)
-✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (9445.48752ms)
-✔ T12 rollback takes the previous copy from the log (3164.86878ms)
-✔ T13 a rollback across a migration needs --restore, then restores and goes live (3832.433037ms)
-✔ T14 events written after the backup need --events N with the right N (4300.182861ms)
-✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5706.078353ms)
-✔ T14c a rollback without --restore whose gate fails runs item 6 (7364.684709ms)
-✔ T15 --plan names the migration and the restore and changes nothing (2976.558ms)
-✔ T26 --plan lists the commits an activate adds, after the migration lines (1448.921448ms)
-✔ T27 --plan names each migration step, or says the steps cannot be read (1074.961775ms)
-✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (504.611631ms)
-▶ T23 --plan reads the store without changing a file, stopped or held
-  ✔ stopped store (612.654192ms)
-  ✔ held store (615.45405ms)
-✔ T23 --plan reads the store without changing a file, stopped or held (1228.613968ms)
-✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1504.453363ms)
-✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (969.540282ms)
-✔ T19 a started line with no final line: status shows it and every changing verb refuses (1272.112268ms)
-✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1363.537596ms)
-✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1516.277233ms)
-▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
-  ✔ bus.sqlite-wal (1776.498328ms)
-  ✔ bus.sqlite-shm (1805.948894ms)
-  ✔ clean (1860.970301ms)
-✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (5444.145497ms)
-▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
-  ✔ unit path (838.2428ms)
-  ✔ drop-in directory (770.669306ms)
-  ✔ drop-in file (787.861386ms)
-  ✔ relative unit path (799.918614ms)
-✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3197.49908ms)
-▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
-  ✔ --plan (842.842612ms)
-  ✔ rollback --restore (2383.664939ms)
-✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3227.016275ms)
-✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (4822.028878ms)
-▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
-  ✔ Environment double quotes (1747.115914ms)
-  ✔ Environment single quotes (1747.871141ms)
-  ✔ Environment backslash (1718.42505ms)
-  ✔ ExecStart quotes (1733.916441ms)
-  ✔ Console ExecStart quotes (1805.192313ms)
-✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (8753.514814ms)
-▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
-  ✔ usage: not with --pm, and only for activate (630.81989ms)
-  ✔ pm-after-harness-target (949.989597ms)
-  ✔ pm-after-harness-set (1400.026643ms)
-  ✔ a pointer without pm (849.389257ms)
-  ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (2037.948918ms)
-✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (5869.092521ms)
-▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
-  ✔ read_pointer (1646.25297ms)
-  ✔ pm-pending, already-adopted and the status line (2899.447167ms)
-✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (4546.229216ms)
-▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
-  ✔ not-pending (781.816005ms)
-  ✔ harness-unset (2528.770078ms)
-  ✔ a launched line passes: the bus alone restarts with --pm (3635.97518ms)
-  ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6129.763508ms)
-  ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (10681.440065ms)
-✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (23758.959718ms)
-▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
-  ✔ rollback from pending gates pm_launched on the old copy (3432.493856ms)
-  ✔ after the harness set, rollback refuses until harness is gone (4814.40527ms)
-  ✔ activate names every kind the target lacks (1278.267995ms)
-✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (9525.935986ms)
-✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3442.637109ms)
-✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (6713.755862ms)
-✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (3556.909655ms)
-✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (816.518752ms)
-✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (798.151327ms)
-✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (8335.191178ms)
-✔ T42 tester-port pm-on preserves pointer Console flags (3045.995877ms)
-▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
-  ✔ activate then pm-on on the same copy (3077.866023ms)
-  ✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6478.022663ms)
-  ✔ adopt takes the next free id too (676.463788ms)
-  ✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (927.509173ms)
-  ✔ --restore takes an id with or without -1 to -9 and nothing else (1026.017549ms)
-✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (12186.978758ms)
-▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
-  ✔ a bad tester port (2101.036117ms)
-  ✔ without --plan a bad port is usage before any pointer read (417.577025ms)
-  ✔ a target Console without --tester-port (1050.997021ms)
-✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3570.568101ms)
-▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table
-  ✔ both modes count events and each listed table, and a table the store lacks counts 0 (819.811738ms)
-  ✔ one instance_names row and no event refuses before any stop; --events 1 restores (4281.220981ms)
-  ✔ one usage_records row and no event refuses before any stop; --events 1 restores (4339.553222ms)
-  ✔ a listed table that cannot be read refuses restore-mismatch before any stop (3011.194623ms)
-  ✔ the in-run recount counts the listed tables too (3456.814799ms)
-✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (15910.111456ms)
-✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (2.96277ms)
-✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (1839.922479ms)
-✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5782.007105ms)
-▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP
-  ✔ no rows after STAMP: restores and goes live (3276.614244ms)
-  ✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (3603.193575ms)
-✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (6880.328466ms)
-✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2392.362463ms)
-✔ T51 row 185 test 5: an activate with no store file takes no backup (2055.74343ms)
-▶ T52 row 186: the activate plan's backup line says what the run will do
-  ✔ same schema (2076.652498ms)
-  ✔ same schema with --migrate (2103.728264ms)
-  ✔ in chain with --migrate (2343.740358ms)
-  ✔ in chain without --migrate (2172.44891ms)
-  ✔ outside the chain (2018.610199ms)
-  ✔ outside the chain with --migrate (2286.782735ms)
-✔ T52 row 186: the activate plan's backup line says what the run will do (13003.221353ms)
-✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3428.609169ms)
-✔ T178 proxy proof pair survives a tester-port replacement as well (2005.665148ms)
-▶ T53 row 187: activate sets, carries and drops the proof pair
-  ✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (5369.617405ms)
-  ✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (4877.926077ms)
-  ✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (6411.791056ms)
-  ✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (3823.440479ms)
-  ✔ test 3: pm-on keeps the pair (2929.528358ms)
-  ✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (6134.571168ms)
-  ✔ test 5: each refusal exits 3 before anything stops (4080.818538ms)
-  ✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (921.495619ms)
-  ✔ test 6: usage errors (791.940368ms)
-  ✔ test 7: a rollback to a copy without proof support drops the pair and says so (3569.742095ms)
-  ✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (4102.029003ms)
-✔ T53 row 187: activate sets, carries and drops the proof pair (43015.196531ms)
-▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses
-  ✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2443.927487ms)
-  ✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (2451.543098ms)
-  ✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2371.886229ms)
-  ✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2440.808004ms)
-  ✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1028.022624ms)
-  ✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1092.396277ms)
-✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (11829.775747ms)
-▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off
-  ✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2297.315751ms)
-  ✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (3372.219555ms)
-  ✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (4822.032599ms)
-  ✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (3681.502406ms)
-  ✔ test 4: pm-on after --no-send keeps --send off (3384.224907ms)
-  ✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (646.332677ms)
-  ✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (10576.556687ms)
-✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (28781.800109ms)
-▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso
-  ✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (3731.038851ms)
-  ✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (9441.965146ms)
-  ✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (804.681755ms)
-  ✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (6340.571003ms)
-  ✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4474.330517ms)
-  ✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (11258.382547ms)
-  ✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4811.481384ms)
-  ✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2548.588058ms)
-  ✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2148.082108ms)
-  ✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (4427.346674ms)
-  ✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1072.216503ms)
-✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (51060.894572ms)
-✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (3501.665564ms)
-✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (2615.765886ms)
-✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (406.432761ms)
-✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (23643.921414ms)
-✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (4522.753011ms)
-✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (5695.642056ms)
-✔ R7 a host on another copy fails copy-match (5707.109175ms)
-✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (564.078959ms)
-✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (739.463019ms)
-✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (356.527698ms)
-✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1415.617777ms)
-✔ R12 mos-0962: a notifier config with a binding fails notify-off (346.615997ms)
-✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (495.179039ms)
-✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (10325.286968ms)
-✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (9991.220342ms)
-✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (3454.052038ms)
-✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (203.934243ms)
-✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (127.433768ms)
-▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins
-  ✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (1595.173571ms)
-  ✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (1992.011586ms)
-  ✔ T-I6 alpha's activate and rollback reach nothing of beta's (3927.69359ms)
-  ✔ T-I6 swapped: beta's reach nothing of alpha's (4046.222781ms)
-  ✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (707.673985ms)
-  ✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (6093.674502ms)
-✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (18364.096442ms)
-ℹ tests 196
-ℹ suites 0
-ℹ pass 196
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 530980.947325

agents/herb/work/queue-215/granted-singles/cleanup.json

@@ -1 +0,0 @@
-{"processes": [], "removed": "/mnt/storage/scratch/gt-t2e8hpyu", "trees": ["/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212", "/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197-r8"]}

agents/herb/work/queue-215/granted-singles/paused-driver.json

@@ -1 +0,0 @@
-{"pid": 765123, "reason": "sage-1983 stop after file10; do not start file11"}

agents/herb/work/queue-215/granted-singles/results.json

@@ -1,122 +0,0 @@
-[
-  {
-    "file": "packages/bus/tests/library.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 6,
-      "pass": 6,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "01-packages_bus_tests_library.test.mjs.log"
-  },
-  {
-    "file": "packages/bus/tests/project-runtime.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 3,
-      "pass": 3,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "02-packages_bus_tests_project-runtime.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/business.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 18,
-      "pass": 18,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "03-packages_business_tests_business.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/cli.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 10,
-      "pass": 10,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "04-packages_business_tests_cli.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/instance-settings.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 12,
-      "pass": 12,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "05-packages_business_tests_instance-settings.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/library-projects-protected.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 4,
-      "pass": 4,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "06-packages_business_tests_library-projects-protected.test.mjs.log"
-  },
-  {
-    "file": "packages/business/tests/resolve.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 11,
-      "pass": 11,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "07-packages_business_tests_resolve.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/launcher.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 30,
-      "pass": 30,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "08-packages_cli_tests_launcher.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/stack-release-external.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 25,
-      "pass": 25,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "09-packages_cli_tests_stack-release-external.test.mjs.log"
-  },
-  {
-    "file": "packages/cli/tests/stack-release.test.mjs",
-    "rc": 0,
-    "counts": {
-      "tests": 196,
-      "pass": 196,
-      "fail": 0,
-      "cancelled": 0,
-      "skipped": 0
-    },
-    "log": "10-packages_cli_tests_stack-release.test.mjs.log"
-  }
-]

agents/herb/work/queue-215/granted-singles/root.txt

@@ -1 +0,0 @@
-/mnt/storage/scratch/gt-t2e8hpyu

agents/herb/work/queue-215/granted-singles/start.txt

@@ -1 +0,0 @@
-2026-10-21T11:56:56.177608+00:00

agents/herb/work/queue-215/granted-t1/business-green.log

@@ -1,10 +0,0 @@
-✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (9.004507ms)
-✔ C2-04: an otherwise valid publish grant cannot name a library repo (1.807264ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 67.488189

agents/herb/work/queue-215/granted-t1/business-red.log

@@ -1,23 +0,0 @@
-✖ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (5.192384ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 54.487487
-
-✖ failing tests:
-
-test at packages/business/tests/business.test.mjs:11:1
-✖ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (5.192384ms)
-  Error [BusinessError]: unsupported /mnt/storage/scratch/gt-PvGtsQ/mosaic-business-4vAhxB/businesses/acme.json projects.books key: "kind"
-      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/errors.mjs:12:9)
-      at rejectUnknownKeys (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/util.mjs:17:33)
-      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/business.mjs:232:5)
-      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/business.test.mjs:17:18)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
-    exitCode: 2
-  }

agents/herb/work/queue-215/granted-t1/checkout-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: ensureCheckouts skips a library before a real clone and leaves no books path (24.411494ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 72.211367

agents/herb/work/queue-215/granted-t1/cleanup.json

@@ -1,8 +0,0 @@
-{
-  "at": "2026-10-21T08:51:07Z",
-  "tempRoot": "/mnt/storage/scratch/gt-PvGtsQ",
-  "fixtureCwdOrArgv": [],
-  "testProcesses": [],
-  "excluded": "current scan process and its ancestors",
-  "tempRootRemoved": true
-}

agents/herb/work/queue-215/granted-t1/cli-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: business validate and resolve skip a library before code projects and credential checks (206.597157ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 260.97412

agents/herb/work/queue-215/granted-t1/instance-settings-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: instance settings skip a library while checking a later code project (22.656666ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 79.494698

agents/herb/work/queue-215/granted-t1/launcher-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: launcher workspace clones code but never the library (1241.43402ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 1338.915726

agents/herb/work/queue-215/granted-t1/m9-green.log

@@ -1,12 +0,0 @@
-✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.916712ms)
-✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (17.081275ms)
-✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (14.304068ms)
-✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (9.595281ms)
-ℹ tests 4
-ℹ suites 0
-ℹ pass 4
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 116.250811

agents/herb/work/queue-215/granted-t1/m9-red.log

@@ -1,28 +0,0 @@
-✖ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.728048ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 71.097427
-
-✖ failing tests:
-
-test at packages/business/tests/library-projects-protected.test.mjs:35:1
-✖ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.728048ms)
-  AssertionError [ERR_ASSERTION]: Missing expected exception.
-      at protectedWrite (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/library-projects-protected.test.mjs:29:10)
-      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/library-projects-protected.test.mjs:37:3)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.start (node:internal/test_runner/test:1262:17)
-      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
-    generatedMessage: false,
-    code: 'ERR_ASSERTION',
-    actual: undefined,
-    expected: { code: 'organization-projects-protected' },
-    operator: 'throws',
-    diff: 'simple'
-  }

agents/herb/work/queue-215/granted-t1/project-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: record APIs refuse a library before creating a repository (3.426617ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 61.266328

agents/herb/work/queue-215/granted-t1/resolve-green.log

@@ -1,9 +0,0 @@
-✔ C2-04: a library first in projects does not hide a later project layer (6.517821ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 62.270511

agents/herb/work/queue-215/granted-t1/results.json

@@ -1,90 +0,0 @@
-[
-  {
-    "file": "business-green.log",
-    "tests": 2,
-    "pass": 2,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "business-red.log",
-    "tests": 1,
-    "pass": 0,
-    "fail": 1,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "checkout-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "cli-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "instance-settings-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "launcher-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "m9-green.log",
-    "tests": 4,
-    "pass": 4,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "m9-red.log",
-    "tests": 1,
-    "pass": 0,
-    "fail": 1,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "project-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "resolve-green.log",
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  {
-    "file": "trackers-boot-green.log",
-    "tests": 2,
-    "pass": 2,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  }
-]

agents/herb/work/queue-215/granted-t1/start.txt

@@ -1 +0,0 @@
-2026-10-21T08:48:14Z

agents/herb/work/queue-215/granted-t1/tmp-root.txt

@@ -1 +0,0 @@
-/mnt/storage/scratch/gt-PvGtsQ

agents/herb/work/queue-215/granted-t1/trackers-boot-green.log

@@ -1,12 +0,0 @@
-✔ C2-04: a library-only business with tracker.baseUrl boots without a project tracker (132.133246ms)
-task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
-task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
-✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (261.808635ms)
-ℹ tests 2
-ℹ suites 0
-ℹ pass 2
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 480.083569

agents/herb/work/queue-215/granted-t34/cleanup.json

@@ -1 +0,0 @@
-{"processes": [], "removed": "/mnt/storage/scratch/gt-iwfcrf5s"}

agents/herb/work/queue-215/granted-t34/files.json

@@ -1 +0,0 @@
-["packages/library/tests/mirror.test.mjs", "packages/bus/tests/library.test.mjs", "packages/webui/tests/library-cli.test.mjs", "packages/bus/tests/project-runtime.test.mjs"]

agents/herb/work/queue-215/granted-t34/library-cli.test-baseline-r2.log

@@ -1,31 +0,0 @@
-✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (140.263767ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 244.49705
-
-✖ failing tests:
-
-test at packages/webui/tests/library-cli.test.mjs:10:1
-✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (140.263767ms)
-  AssertionError [ERR_ASSERTION]: refused: missing library callbacks
-  
-  
-  2 !== 0
-  
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/tests/library-cli.test.mjs:27:10)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.start (node:internal/test_runner/test:1262:17)
-      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
-    generatedMessage: false,
-    code: 'ERR_ASSERTION',
-    actual: 2,
-    expected: 0,
-    operator: 'strictEqual',
-    diff: 'simple'
-  }

agents/herb/work/queue-215/granted-t34/library-cli.test-baseline.log

@@ -1,47 +0,0 @@
-✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (31.496523ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 122.065824
-
-✖ failing tests:
-
-test at packages/webui/tests/library-cli.test.mjs:10:1
-✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (31.496523ms)
-  AssertionError [ERR_ASSERTION]: file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/src/bus.mjs:1
-  import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,args)=>{appendFileSync("/mnt/storage/scratch/gt-iwfcrf5s/library-cli-1eUPUX/calls.jsonl",JSON.stringify({verb,args,cli:o.cli??"/mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/human-cli.mjs"})+'
-                                                                                                                                                                                                                                                                                                                               ^
-  
-  SyntaxError: Invalid or unexpected token
-      at compileSourceTextModule (node:internal/modules/esm/utils:355:16)
-      at ModuleLoader.moduleStrategy (node:internal/modules/esm/translators:93:18)
-      at #translate (node:internal/modules/esm/loader:441:20)
-      at afterLoad (node:internal/modules/esm/loader:509:29)
-      at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:514:12)
-      at #getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:567:36)
-      at afterResolve (node:internal/modules/esm/loader:614:52)
-      at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:620:12)
-      at ModuleJob.syncLink (node:internal/modules/esm/module_job:277:33)
-      at ModuleJob.link (node:internal/modules/esm/module_job:389:17)
-  
-  Node.js v26.8.1
-  
-  
-  1 !== 0
-  
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/tests/library-cli.test.mjs:27:10)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.start (node:internal/test_runner/test:1262:17)
-      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
-    generatedMessage: false,
-    code: 'ERR_ASSERTION',
-    actual: 1,
-    expected: 0,
-    operator: 'strictEqual',
-    diff: 'simple'
-  }

agents/herb/work/queue-215/granted-t34/library-cli.test-final.log

@@ -1,9 +0,0 @@
-✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (110.620217ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 194.067409

agents/herb/work/queue-215/granted-t34/library-cli.test-green-r2.log

@@ -1,9 +0,0 @@
-✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (107.138425ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 1
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 193.527058

agents/herb/work/queue-215/granted-t34/library.test-baseline-focused.log

@@ -1,71 +0,0 @@
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (14.387463ms)
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (8.808227ms)
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.107055ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 0
-ℹ fail 3
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 125.805576
-
-✖ failing tests:
-
-test at packages/bus/tests/library.test.mjs:28:1
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (14.387463ms)
-  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
-  + actual - expected
-  
-    Comparison {
-  +   code: 'unknown-verb'
-  -   code: 'human-required'
-    }
-  
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
-    generatedMessage: true,
-    code: 'ERR_ASSERTION',
-    actual: Error: unknown-verb
-        at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-        at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
-        at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
-        at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
-        at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
-        at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
-        at async waitForActual (node:assert:615:5)
-        at async strict.rejects (node:assert:738:25)
-        at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
-        at async Test.run (node:internal/test_runner/test:1409:7),
-    expected: { code: 'human-required' },
-    operator: 'rejects',
-    diff: 'simple'
-  }
-
-test at packages/bus/tests/library.test.mjs:45:1
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (8.808227ms)
-  Error: unknown-verb
-      at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-      at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
-      at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
-      at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
-      at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
-      at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:49:17)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    code: 'unknown-verb'
-  }
-
-test at packages/bus/tests/library.test.mjs:56:1
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.107055ms)
-  Error: unknown-verb
-      at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
-      at Socket.emit (node:events:514:20)
-      at addChunk (node:internal/streams/readable:575:12)
-      at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
-      at Readable.push (node:internal/streams/readable:406:5)
-      at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
-    code: 'unknown-verb'
-  }

agents/herb/work/queue-215/granted-t34/library.test-baseline-r2.log

@@ -1,118 +0,0 @@
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (16.66162ms)
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (9.880605ms)
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.417761ms)
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (27.11473ms)
-✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.990752ms)
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (21.295513ms)
-
-Interrupted while running:
-
-⚠ packages/bus/tests/library.test.mjs (packages/bus/tests/library.test.mjs:1:1)
-✖ packages/bus/tests/library.test.mjs (34335.85978ms)
-ℹ tests 7
-ℹ suites 0
-ℹ pass 0
-ℹ fail 6
-ℹ cancelled 1
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 34341.308382
-
-✖ failing tests:
-
-test at packages/bus/tests/library.test.mjs:28:1
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (16.66162ms)
-  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
-  + actual - expected
-  
-    Comparison {
-  +   code: 'unknown-verb'
-  -   code: 'human-required'
-    }
-  
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
-    generatedMessage: true,
-    code: 'ERR_ASSERTION',
-    actual: Error: unknown-verb
-        at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-        at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
-        at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
-        at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
-        at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
-        at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
-        at async waitForActual (node:assert:615:5)
-        at async strict.rejects (node:assert:738:25)
-        at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
-        at async Test.run (node:internal/test_runner/test:1409:7),
-    expected: { code: 'human-required' },
-    operator: 'rejects',
-    diff: 'simple'
-  }
-
-test at packages/bus/tests/library.test.mjs:45:1
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (9.880605ms)
-  Error: unknown-verb
-      at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-      at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
-      at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
-      at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
-      at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
-      at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:49:17)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    code: 'unknown-verb'
-  }
-
-test at packages/bus/tests/library.test.mjs:56:1
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.417761ms)
-  Error: unknown-verb
-      at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
-      at Socket.emit (node:events:514:20)
-      at addChunk (node:internal/streams/readable:575:12)
-      at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
-      at Readable.push (node:internal/streams/readable:406:5)
-      at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
-    code: 'unknown-verb'
-  }
-
-test at packages/bus/tests/library.test.mjs:67:1
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (27.11473ms)
-  TypeError: library.mirrorPath is not a function
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:74:26)
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
-
-test at packages/bus/tests/library.test.mjs:81:1
-✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.990752ms)
-  AssertionError [ERR_ASSERTION]: Missing expected rejection.
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:87:3)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    generatedMessage: false,
-    code: 'ERR_ASSERTION',
-    actual: undefined,
-    expected: { code: 'library-git' },
-    operator: 'rejects',
-    diff: 'simple'
-  }
-
-test at packages/bus/tests/library.test.mjs:92:1
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (21.295513ms)
-  Error: unknown-verb
-      at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
-      at Socket.emit (node:events:514:20)
-      at addChunk (node:internal/streams/readable:575:12)
-      at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
-      at Readable.push (node:internal/streams/readable:406:5)
-      at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
-    code: 'unknown-verb'
-  }
-
-test at packages/bus/tests/library.test.mjs:1:1
-✖ packages/bus/tests/library.test.mjs (34335.85978ms)
-  'Promise resolution is still pending but the event loop has already resolved'

agents/herb/work/queue-215/granted-t34/library.test-baseline.log

@@ -1,126 +0,0 @@
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (24.976387ms)
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (7.097425ms)
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (6.894431ms)
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (34.318499ms)
-✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.188728ms)
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (11.406264ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 0
-ℹ fail 6
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 197.495962
-
-✖ failing tests:
-
-test at packages/bus/tests/library.test.mjs:28:1
-✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (24.976387ms)
-  Error: invalid-business
-      at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-      at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
-      at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:30:13)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.start (node:internal/test_runner/test:1262:17)
-      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
-    code: 'invalid-business'
-  }
-
-test at packages/bus/tests/library.test.mjs:45:1
-✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (7.097425ms)
-  Error: invalid-business
-      at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-      at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
-      at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:47:13)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19)
-      at Test.run (node:internal/test_runner/test:1467:12)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
-    code: 'invalid-business'
-  }
-
-test at packages/bus/tests/library.test.mjs:56:1
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (6.894431ms)
-  Error: invalid-business
-      at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-      at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
-      at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:57:13)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19)
-      at Test.run (node:internal/test_runner/test:1467:12)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    code: 'invalid-business'
-  }
-
-test at packages/bus/tests/library.test.mjs:67:1
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (34.318499ms)
-  Error: credential-format
-      at deny (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:10:9)
-      at #format (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:232:28)
-      at #read (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:222:37)
-      at new Credentials (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:145:35)
-      at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:108:19)
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:72:25)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19) {
-    code: 'credential-format'
-  }
-
-test at packages/bus/tests/library.test.mjs:81:1
-✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.188728ms)
-  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
-  + actual - expected
-  
-    Comparison {
-  +   code: 'invalid-business'
-  -   code: 'library-git'
-    }
-  
-      at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:86:3)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    generatedMessage: true,
-    code: 'ERR_ASSERTION',
-    actual: Error: invalid-business
-        at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
-        at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
-        at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:126:20)
-        at async waitForActual (node:assert:615:5)
-        at async strict.rejects (node:assert:738:25)
-        at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:86:3)
-        at async Test.run (node:internal/test_runner/test:1409:7)
-        at async Test.processPendingSubtests (node:internal/test_runner/test:974:7),
-    expected: { code: 'library-git' },
-    operator: 'rejects',
-    diff: 'simple'
-  }
-
-test at packages/bus/tests/library.test.mjs:91:1
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (11.406264ms)
-  Error: ENOENT: no such file or directory, lstat '/mnt/storage/scratch/gt-iwfcrf5s/library-m65UFF/data'
-      at lstatSync (node:fs:2138:25)
-      at new Store (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:137:22)
-      at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:99:13)
-      at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:94:25)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19)
-      at Test.run (node:internal/test_runner/test:1467:12)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    errno: -2,
-    code: 'ENOENT',
-    syscall: 'lstat',
-    path: '/mnt/storage/scratch/gt-iwfcrf5s/library-m65UFF/data'
-  }

agents/herb/work/queue-215/granted-t34/library.test-final.log

@@ -1,14 +0,0 @@
-✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (28.309128ms)
-✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.198339ms)
-✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.717312ms)
-✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (42.066656ms)
-✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (23.773967ms)
-✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (89.925539ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 6
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 301.460553

agents/herb/work/queue-215/granted-t34/library.test-green-r2.log

@@ -1,63 +0,0 @@
-✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (27.706148ms)
-✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (10.128912ms)
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.255977ms)
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (20.969978ms)
-✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (19.148653ms)
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (10.834076ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 3
-ℹ fail 3
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 192.486443
-
-✖ failing tests:
-
-test at packages/bus/tests/library.test.mjs:56:1
-✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.255977ms)
-  Error: unauthenticated
-      at Socket.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/client.mjs:42:17)
-      at Socket.emit (node:events:514:20)
-      at addChunk (node:internal/streams/readable:575:12)
-      at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
-      at Readable.push (node:internal/streams/readable:406:5)
-      at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
-    code: 'unauthenticated'
-  }
-
-test at packages/bus/tests/library.test.mjs:67:1
-✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (20.969978ms)
-  Error: credential-format
-      at deny (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:10:9)
-      at #format (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:232:28)
-      at #read (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:222:37)
-      at new Credentials (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:145:35)
-      at startBroker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/runtime.mjs:109:19)
-      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/tests/library.test.mjs:72:25)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19) {
-    code: 'credential-format'
-  }
-
-test at packages/bus/tests/library.test.mjs:91:1
-✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (10.834076ms)
-  Error: ENOENT: no such file or directory, lstat '/mnt/storage/scratch/gt-iwfcrf5s/library-rRi0EP/data'
-      at lstatSync (node:fs:2138:25)
-      at new Store (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/store.mjs:137:22)
-      at startBroker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/runtime.mjs:100:13)
-      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/tests/library.test.mjs:94:25)
-      at Test.runInAsyncScope (node:async_hooks:226:14)
-      at Test.run (node:internal/test_runner/test:1402:25)
-      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
-      at Test.postRun (node:internal/test_runner/test:1542:19)
-      at Test.run (node:internal/test_runner/test:1467:12)
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
-    errno: -2,
-    code: 'ENOENT',
-    syscall: 'lstat',
-    path: '/mnt/storage/scratch/gt-iwfcrf5s/library-rRi0EP/data'
-  }

agents/herb/work/queue-215/granted-t34/library.test-green-r3.log

@@ -1,14 +0,0 @@
-✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (29.476748ms)
-✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.765761ms)
-✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.523467ms)
-✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (41.028545ms)
-✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (20.174444ms)
-✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (89.276012ms)
-ℹ tests 6
-ℹ suites 0
-ℹ pass 6
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 314.116154

agents/herb/work/queue-215/granted-t34/mirror.test-baseline-r2.log

@@ -1,35 +0,0 @@
-node:internal/modules/esm/resolve:272
-    throw new ERR_MODULE_NOT_FOUND(
-          ^
-
-Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/src/mirror.mjs' imported from /mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/tests/mirror.test.mjs
-    at finalizeResolution (node:internal/modules/esm/resolve:272:11)
-    at moduleResolve (node:internal/modules/esm/resolve:879:10)
-    at defaultResolve (node:internal/modules/esm/resolve:1006:11)
-    at #cachedDefaultResolve (node:internal/modules/esm/loader:708:20)
-    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:728:38)
-    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:766:56)
-    at #resolve (node:internal/modules/esm/loader:690:17)
-    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:610:35)
-    at ModuleJob.syncLink (node:internal/modules/esm/module_job:277:33)
-    at ModuleJob.link (node:internal/modules/esm/module_job:389:17) {
-  code: 'ERR_MODULE_NOT_FOUND',
-  url: 'file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/src/mirror.mjs'
-}
-
-Node.js v26.8.1
-✖ packages/library/tests/mirror.test.mjs (35.196517ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 41.636181
-
-✖ failing tests:
-
-test at packages/library/tests/mirror.test.mjs:1:1
-✖ packages/library/tests/mirror.test.mjs (35.196517ms)
-  'test failed'

agents/herb/work/queue-215/granted-t34/mirror.test-baseline.log

@@ -1,35 +0,0 @@
-node:internal/modules/esm/resolve:272
-    throw new ERR_MODULE_NOT_FOUND(
-          ^
-
-Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/src/mirror.mjs' imported from /mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/tests/mirror.test.mjs
-    at finalizeResolution (node:internal/modules/esm/resolve:272:11)
-    at moduleResolve (node:internal/modules/esm/resolve:879:10)
-    at defaultResolve (node:internal/modules/esm/resolve:1006:11)
-    at #cachedDefaultResolve (node:internal/modules/esm/loader:708:20)
-    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:728:38)
-    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:766:56)
-    at #resolve (node:internal/modules/esm/loader:690:17)
-    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:610:35)
-    at ModuleJob.syncLink (node:internal/modules/esm/module_job:277:33)
-    at ModuleJob.link (node:internal/modules/esm/module_job:389:17) {
-  code: 'ERR_MODULE_NOT_FOUND',
-  url: 'file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/library/src/mirror.mjs'
-}
-
-Node.js v26.8.1
-✖ packages/library/tests/mirror.test.mjs (29.912154ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 35.532092
-
-✖ failing tests:
-
-test at packages/library/tests/mirror.test.mjs:1:1
-✖ packages/library/tests/mirror.test.mjs (29.912154ms)
-  'test failed'

agents/herb/work/queue-215/granted-t34/mirror.test-final-r2.log

@@ -1,24 +0,0 @@
-✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (38.226069ms)
-✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (28.230282ms)
-✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (102.534821ms)
-✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (13.3233ms)
-✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (21.415494ms)
-✔ C2-04 state: missing state is empty only while the served ref is absent (35.194627ms)
-✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (37.132264ms)
-✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (99.673047ms)
-✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (28.715976ms)
-✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (71.638861ms)
-✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (78.457144ms)
-✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (228.356974ms)
-✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5027.769608ms)
-✔ C2-04 lock: owner death releases the kernel lock without replacing its file (52.875238ms)
-✔ C2-04 lock: a missing flock binary becomes a handled refusal (49.021765ms)
-✔ C2-04 lock: an unawaited scoped read drains before the lock is released (20.779739ms)
-ℹ tests 16
-ℹ suites 0
-ℹ pass 16
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 5980.465131

agents/herb/work/queue-215/granted-t34/mirror.test-final.log

@@ -1,30 +0,0 @@
-✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (42.294098ms)
-✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (29.430204ms)
-✖ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (15050.820834ms)
-✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (13.507402ms)
-✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (19.93202ms)
-✔ C2-04 state: missing state is empty only while the served ref is absent (33.088494ms)
-✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (34.798253ms)
-✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (96.144919ms)
-✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (28.529103ms)
-✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (71.331837ms)
-✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (80.081788ms)
-✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (232.208946ms)
-✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5028.099129ms)
-✔ C2-04 lock: owner death releases the kernel lock without replacing its file (55.474555ms)
-✔ C2-04 lock: a missing flock binary becomes a handled refusal (51.152959ms)
-✔ C2-04 lock: an unawaited scoped read drains before the lock is released (21.006119ms)
-ℹ tests 16
-ℹ suites 0
-ℹ pass 15
-ℹ fail 0
-ℹ cancelled 1
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 20945.326932
-
-✖ failing tests:
-
-test at packages/library/tests/mirror.test.mjs:53:1
-✖ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (15050.820834ms)
-  'test timed out after 15000ms'

agents/herb/work/queue-215/granted-t34/mirror.test-green-r2.log

@@ -1,23 +0,0 @@
-✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (37.162857ms)
-✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (28.538429ms)
-✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (10.987669ms)
-✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (20.080027ms)
-✔ C2-04 state: missing state is empty only while the served ref is absent (33.757482ms)
-✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (35.501927ms)
-✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (96.276094ms)
-✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (28.464199ms)
-✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (72.087911ms)
-✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (78.120774ms)
-✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (230.905584ms)
-✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5029.743303ms)
-✔ C2-04 lock: owner death releases the kernel lock without replacing its file (51.842651ms)
-✔ C2-04 lock: a missing flock binary becomes a handled refusal (48.619585ms)
-✔ C2-04 lock: an unawaited scoped read drains before the lock is released (19.747384ms)
-ℹ tests 15
-ℹ suites 0
-ℹ pass 15
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 5872.380072

agents/herb/work/queue-215/granted-t34/mirror.test-green.log

@@ -1,51 +0,0 @@
-✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (35.114121ms)
-✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (28.344028ms)
-✖ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (11.29287ms)
-✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (21.069667ms)
-✔ C2-04 state: missing state is empty only while the served ref is absent (33.576129ms)
-✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (36.355449ms)
-✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (98.678405ms)
-✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (28.476513ms)
-✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (72.613881ms)
-✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (78.072657ms)
-✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (230.109966ms)
-✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5027.239374ms)
-✔ C2-04 lock: owner death releases the kernel lock without replacing its file (53.970224ms)
-✔ C2-04 lock: a missing flock binary becomes a handled refusal (45.088532ms)
-✔ C2-04 lock: an unawaited scoped read drains before the lock is released (19.793614ms)
-ℹ tests 15
-ℹ suites 0
-ℹ pass 14
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 5869.613351
-
-✖ failing tests:
-
-test at packages/library/tests/mirror.test.mjs:53:1
-✖ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (11.29287ms)
-  AssertionError [ERR_ASSERTION]: The input did not match the regular expression /overlap/. Input:
-  
-  'Error: project-path: unsafe mirror path'
-  
-      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/tests/mirror.test.mjs:64:10)
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
-    generatedMessage: true,
-    code: 'ERR_ASSERTION',
-    actual: Error: project-path: unsafe mirror path
-        at Module.mirrorPath (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:40:25)
-        at file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/tests/mirror.test.mjs:64:27
-        at getActual (node:assert:580:5)
-        at strict.throws (node:assert:728:24)
-        at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/tests/mirror.test.mjs:64:10)
-        at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-        at async Test.run (node:internal/test_runner/test:1409:7)
-        at async Test.processPendingSubtests (node:internal/test_runner/test:974:7),
-    expected: /overlap/,
-    operator: 'throws',
-    diff: 'simple'
-  }

agents/herb/work/queue-215/granted-t34/mv-debug.log

@@ -1,20 +0,0 @@
-✖ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (56.393634ms)
-ℹ tests 1
-ℹ suites 0
-ℹ pass 0
-ℹ fail 1
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 102.30317
-
-✖ failing tests:
-
-test at packages/library/tests/mirror.test.mjs:53:1
-✖ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (56.393634ms)
-  Error: {"code":1,"stderr":"file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:18\nconst fail = (code, message = code) => { throw new LibraryError(code, message); };\n                                               ^\n\nLibraryError: library-git: expected a private owned bare mirror\n    at fail (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:18:48)\n    at ownedRoot (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:49:13)\n    at inspectMirrorUnchecked (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:57:3)\n    at inspectMirror (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:94:15)\n    at ensureMirror (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/src/mirror.mjs:128:11)\n    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)\n    at async file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/[eval1]:7:149 {\n  code: 'library-git'\n}\n\nNode.js v26.8.1\n"}
-      at file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/tests/mirror.test.mjs:65:108
-      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
-      at async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/library/tests/mirror.test.mjs:65:22)
-      at async Test.run (node:internal/test_runner/test:1409:7)
-      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)

agents/herb/work/queue-215/granted-t34/project-runtime.test-final.log

@@ -1,11 +0,0 @@
-✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (1.794155ms)
-✔ without a trusted project adapter all three async paths refuse project-not-configured (39.865453ms)
-✔ real startBroker injects the project adapter for socket reads and bound-author record writes (65.643553ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 197.45826

agents/herb/work/queue-215/granted-t34/project-runtime.test-green-r2.log

@@ -1,11 +0,0 @@
-✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (1.418597ms)
-✔ without a trusted project adapter all three async paths refuse project-not-configured (34.510685ms)
-✔ real startBroker injects the project adapter for socket reads and bound-author record writes (59.944824ms)
-ℹ tests 3
-ℹ suites 0
-ℹ pass 3
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-ℹ duration_ms 183.05447

agents/herb/work/queue-215/granted-t34/results.json

@@ -1,51 +0,0 @@
-{
-  "mirror.test-final-r2.log": {
-    "tests": 16,
-    "pass": 16,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "library.test-final.log": {
-    "tests": 6,
-    "pass": 6,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "library-cli.test-final.log": {
-    "tests": 1,
-    "pass": 1,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "project-runtime.test-final.log": {
-    "tests": 3,
-    "pass": 3,
-    "fail": 0,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "library.test-baseline-focused.log": {
-    "tests": 3,
-    "pass": 0,
-    "fail": 3,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "library-cli.test-baseline-r2.log": {
-    "tests": 1,
-    "pass": 0,
-    "fail": 1,
-    "cancelled": 0,
-    "skipped": 0
-  },
-  "mirror.test-baseline-r2.log": {
-    "tests": 1,
-    "pass": 0,
-    "fail": 1,
-    "cancelled": 0,
-    "skipped": 0
-  }
-}

agents/herb/work/queue-215/granted-t34/root.txt

@@ -1 +0,0 @@
-/mnt/storage/scratch/gt-iwfcrf5s