launchpad: row 192 packet, mutant 23 equivalent and the guard kept (sage-1407)

webui: Q175 phase 1 round 2, absolute post-sign-in Location checked on publicOrigin (row 192, #1690 )
webby-0019 B1, sage-1403: returnURL builds the Location from publicOrigin plus the parsed pathname and search, checks the origin again and returns the href, so a dot-segment `//host` path stays on the Console. Test 14 covers Webby's three cases and asserts each Location's origin; mutant 22 restores the r1 returnPath (killed). N1 design blob cite, N2 listed under Deviations, N3 SIGN_IN_COOKIE comment.
2026-10-20 15:07:24 -05:00 · 2026-10-20 14:54:43 -05:00 · 2026-10-20 14:30:24 -05:00
161 changed files with 561 additions and 18243 deletions
@@ -25,15 +25,10 @@ green at every step. Not production software — a proven foundation.
 1. **Root is bootstrap-only.** First-class system configuration lives at the
   repository root; everything else gets a dedicated directory (`roles/`,
   `contracts/`, `missions/`, `tasks/`, `docs/`). Do not add new files to root.
-2. **Configuration**: each stack instance has exactly one system config. The
-   default instance's is `~/.config/mosaic-dev/config.json`. Instance NAME's
-   is `~/.config/mosaic-NAME/config.json`, and its data root carries a marker
-   that names it. `~` is the home of the OS user that runs the instance. A
-   process reads only the config `MOSAIC_CONFIG` names, or the default's when
-   that is unset. Configs are created only by
-   `scripts/bootstrap.sh [--instance NAME]`, never overwritten, fail-closed on
-   any problem. Repo-scoped role authority lives in `roles/*.json`
-   (versioned, reviewed commits only).
+2. **Configuration**: `~/.config/mosaic-dev/config.json` is the sole system
+   config — created only by `scripts/bootstrap.sh`, never overwritten,
+   fail-closed on any problem. Repo-scoped role authority lives in
+   `roles/*.json` (versioned, reviewed commits only).
 3. **Secrets** never enter the repository or container images; auth is
   runtime-only (read-only mount or environment variable).
 4. **Contracts** (`contracts/`) are immutable and image-baked. Missions and
@@ -182,8 +177,8 @@ Full reference — usage, fields, exit codes, safety notes:

 ## Data map (canon)

- `~/.config/mosaic-dev/config.json`, or `~/.config/mosaic-NAME/config.json`
-  per named instance: system config (user-authored; never auto-written).
+- `~/.config/mosaic-dev/config.json` — system config (user-authored; never
+  auto-written).
 - `<dataRoot>` (from config; default `~/.mosaic-dev`):
  - `runs/` — write-once run evidence (`result.json`, snapshots, `stderr.txt`)
  - `sessions/` — pi JSONL session trees, one directory per named session
@@ -75,8 +75,7 @@ session's workspace and its own process group. Same contract, plus:
 | `MOSAIC_POLICY_FILE`, `MOSAIC_TOOLS_FILE` | The bundle's gate policy and typed tools. |
 | `MOSAIC_TOOL_SOCKET` | The runner's tool socket, which the typed tools call. |
 | `MOSAIC_TURN_MARKER` | `pi`: the extension writes it at `agent_end`; a pi turn that exits 0 without it failed. |
-| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. The pi module names two: the gate and typed tools extension, then the unslop check's `tools/unslop-hook/extension.ts` (row 66). |
-| `MOSAIC_UNSLOP_LOG` | The unslop check's JSONL log, `<run>/unslop.jsonl`, which the runner sets for both adapters and reads after each turn (row 66). |
+| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. |
 | `MOSAIC_CLAUDE_SETTINGS`, `MOSAIC_CLAUDE_MCP_CONFIG` | `claude` only: the bundle's gate hook and MCP server; required. |
 | `MOSAIC_THINKING` | The route's thinking level (row 65), which the harness module's `levels()` already checked. `pi` passes `--thinking` (`off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`) and omits it when unset, as for `run-task.sh` workers. `claude` passes `--effort` (`low`, `medium`, `high`, `xhigh`, `max`) and requires it; unset exits 2. |
 | `MOSAIC_CLAUDE_BIN` | `claude` only: absolute path of the CLI to run, from the host's environment (the bus unit pins it). Unset or empty runs `claude` from `PATH`; a relative path or a non-executable file exits 2. |
@@ -107,18 +106,3 @@ The cost is prompt size: a role's skill text is in every turn, where the
 other routes load a skill when it's used. The bundle caps a role's skills at
 64 KiB together, since `claude` passes `prompt.md` as one argument and Linux
 caps one argument at 128 KiB.
-
-### The unslop check (row 66)
-
-Both adapters run the mechanical writing check from `tools/unslop-hook`,
-driven by one `lists.json`. `pi` loads it as its second `-e` extension.
-`claude` runs `claude-hook.js` from the bundle's `settings.json`: the Stop
-hook checks the turn's replies, and the UserPromptSubmit hook adds the
-correction notice as context on the next turn when the last reply had
-tells. Each hook command ends `; exit 0`, so neither blocks. Both log to
-`MOSAIC_UNSLOP_LOG`, and the runner adds a note for the operator to the
-next RESULT it sends (`packages/harness/README.md`, the runner). The
-harness modules mount the three files read-only at their own paths, and
-the manifest records their digests. `MOSAIC_UNSLOP_HOOK` and `UNSLOP_LISTS`
-aren't in the session environment's allowlist, so a managed session can't
-switch the check off or swap its lists.
@@ -19,12 +19,6 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
-| Herb | Builder, a second gate lane (#1695) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
-| Bushroot | Builder, retire the control board writer on 7331 (#1696) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1008 | none, T3 only |
-| Megavolt | Builder, MVP T1 item 6 (agent credentials and git identity, #1697) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Quackerjack | Builder, federation R5 and R2 (#414) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1023 | none, T3 only |
-| Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
 | Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
 | Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
@@ -1,8 +0,0 @@
-# Bushroot
-
-Builder seat, Claude Haiku 5.5, started by Sage under mos-1008 item 2 (a low-level model under Q177) for the row
-that retires the control board writer on 7331 (#1696).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `bushroot/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0977, thread ffceafec). Reviews federation designs and MVP T1 row 193.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `duckworth/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `duckworth/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,8 +0,0 @@
-# Gander
-
-Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for the human
-boundary row (P19 333, #1694, mos-0989).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `gander/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,9 +0,0 @@
-# Gizmoduck
-
-Design and builder seat, Claude Opus 5.5, a T3 thread (9312a896). Author of the federation design
-(`agents/gizmoduck/work/federation/DESIGN.md` on `gizmoduck/federation-design`, #414). Builds FED R1, the
-access.json loader and validator, under Mos's order mos-1023 item 1.
-
-No launcher in this directory. The seat works in its own worktree and has no credentials of its own; until
-the credentials row settles per-agent identity, it pushes only its own `gizmoduck/*` branches through the
-repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,11 +0,0 @@
-# Gosalyn
-
-Worker seat for Mosaic Stack, MVP track T2 (Case 2, the creative writing hub, Vikunja #416).
-
- T3 thread: 7604438a-0ded-41c8-bd3f-26f57fdb5cd2
- Model: Opus 5.5 (Claude Code, T3)
- Launched by Mos (Jason's main agent, T3 38bc4c81-6270-4021-b00c-6a15c43b9b0e), who briefs the seat
- Repository lead and queue: Sage (T3 1ef1e4f8-3ead-4208-beca-38f9f1add079)
- Branch: gosalyn/case2-design, pushed only by this seat, landed on refactor by Sage
-
-Work lives in `work/`. The Case 2 design is `work/case2/DESIGN.md`.
@@ -1,8 +0,0 @@
-# Herb
-
-Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for a second gate lane
-design row (#1695, mos-0977 item 6).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `herb/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 194 (agent lifecycle, #1692) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `honker/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `honker/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,158 +0,0 @@
-# PRD 1.7 draft: the chief of staff's hire and fire authority, the coder's push to its fork, and agent
-# host access through the credential store
-
-Draft by Honker for row 194 (#1692), under Mos's ruling mos-1017 (through Sage, sage-1365). Not approved.
-It changes nothing until Jason approves it as a `prd.approve` decision in the Console. Sage opens that
-decision and sends Mos its id. Base: `docs/prd/mosaic-stack.md` version 1.6 at 53bb59462.
-
-## What it changes
-
-Row 194 adds `role.hire` and `role.fire` to the vocabulary, and row 199 adds `git.push.remote`. Under
-REQ-WAIT-3 all three are hard waits, so today Jason resolves every hire, every fire and every push to a
-remote. This version routes hire and fire for the chief of staff within fixed bounds, so the chief hires
-and fires as needed and the user's per-agent forbid still holds. It routes `git.push.remote` for the coder
-only (Mos, mos-1028 item 3). It adds agent host access with sudo through the credential store for
-agents with a grant (Q183, Q184, Vikunja #424, due 2026-10-27). One `prd.approve` decision covers it all
-(Vikunja #420).
-
-When this version lands, a reviewed commit:
-
-1. adds `role.hire`, `role.fire` and `git.push.remote` to `ROUTED` in
-   `packages/business/src/vocabulary.mjs` and in `packages/bus/src/broker.mjs`.
-2. adds `role.hire` and `role.fire` to `roles/chief-of-staff.json` withinRole, and `git.push.remote` to
-   `roles/coder.json` withinRole. No other role file gets `git.push.remote`.
-3. switches the broker's check on `instance.hire` and `instance.fire` from a cited decision to the
-   `reason` form, as `role.end` works for REQ-ROLE-2, and makes `publish`'s `decision` optional for a
-   within-role class (row 199 D9 step 1).
-4. states, for a `git.push.remote` with no decision, where the source commit comes from: the latest work
-   commit the bus recorded for the coder's task. The check still matches it against the work ref tip and
-   the push sends it by oid (row 199, duckworth-0022 N9).
-5. adds the host credential grant check and the host access it allows (REQ-CRED-3, Vikunja #424).
-
-Every other check stays as rows 194 and 199 build it. Filling `hireable` stays a separate reviewed role
-file commit in `roles/`.
-
-## Text for the PRD
-
-Status line, appended to the current paragraph:
-
-> Version 1.7 routes the chief of staff's hire and fire actions and the coder's push to its own fork,
-> and adds agent host access through the credential store, approved by Jason in decision
-> <prd.approve decision id>.
-
-Source, a new bullet above "Version 1.6 source":
-
-> - Version 1.7 source, TARGET.md line 66: "Chief of staff agent has hire/fire authority for agents as
->   needed; unless user forbids per agent". And Jason through Mos (mos-1067), DECISIONS Q183, in part: "I will
->   still want to allow infra agent(s) on my .53 instance to access other servers, etc. However, not all
->   agents will need to have that access. I envision a credential store within Mosaic Stack that works
->   as some sort of variable for the agent to call. The system will enforce access to the credentials to
->   keep the agents sandboxed with proper security. I need to be able to trust my agents with assisting
->   me. This will require sudo access to several systems. If we can utilize the credential store in
->   Mosaic Stack and allow agents to perform their jobs with NOPASSWD sudo on various machines, I am a
->   happy man." DECISIONS Q184, on whether that is in place by 10-27: "Q5: by 10.27"
-
-Under "Added in version 1.2", after REQ-COS-2:
-
-> Added in version 1.7:
->
-> - **REQ-COS-3.** The chief of staff hires and fires role instances without a decision each time. Hiring
->   adds a role instance to the organization file and lists it for launch. Firing ends the instance's
->   runs and removes it from the launch list. It stays in the organization file. Only the user deletes
->   an instance. These actions are `role.hire` and `role.fire`. They leave the hard waits and route
->   under this requirement, within these bounds:
->   - The chief acts only in its own organization.
->   - The chief hires only role definitions that need no credentials, until a later version adds
->     credentialed roles.
->   - The chief hires only the role kinds its role file lists. Changing that list is a reviewed commit.
->   - The chief hires only a role whose every action is on a fixed list of plain work actions: sending
->     messages, writing records, asking for review, updating its assigned tasks, and the scope and
->     working-push actions of an assigned task. A role holding any other action, such as launch, end,
->     organization, naming, hire, review verdict or merge authority, or any action added later, is never
->     hired. So the chief never hires a chief, never picks its own reviewers or merge gate, and the author
->     is never the reviewer. This holds whatever the role file's list says. Adding to that list is a PRD
->     change.
->   - The chief may set a hired instance's model and narrow its limits, and nothing else about it.
->   - The user can forbid per agent. The user marks an instance so the chief can't fire it, end its runs
->     or change its model, and marks role kinds the chief can't hire. Only the user changes these marks, through the
->     WebUI or the CLI.
->   - The kill switch stops every hire and fire while it is on.
->   - Every hire and fire is logged with the chief's instance, its run and the reason.
-
-Under "Landing", after REQ-LAND-1:
-
-> Added in version 1.7:
->
-> - **REQ-LAND-2.** A coder pushes its own work to its own fork. The action is `git.push.remote`.
->   - What it pushes: one commit, by its oid, never a ref name. That commit is the latest work commit the
->     bus recorded for the coder's task, and the coder made that push. A decision that authorizes a push
->     names that commit, and it doesn't authorize any other.
->   - Where it lands: only the branch `refs/heads/<its Gitea user>/<branch>`. The host builds that
->     name, the agent never does. A push never forces.
->   - Which remote: the agent's own fork of the project's upstream. The business file names the upstream,
->     and the host never contacts it. For each push the host builds the fork's address over https from
->     the upstream's host, port and repository name and the agent's own Gitea user. The history check,
->     the push and the credential match all use that address. So the agent's own user owns the receiving
->     repository on every push, and the agent never names it.
->   - The host refuses an upstream on a host or port other than the agent's Gitea, and an upstream the
->     agent's own user owns. It refuses a fork that is missing, empty or doesn't share the project's
->     history. Gitea's push-to-create stays off, so a push never creates a repository.
->   - Who may: the action routes under REQ-DEC-2 and is granted within-role to the coder role only. No
->     other role file grants it.
->   - Before version 1.7 the action was a hard wait under REQ-WAIT-3, so each push needed a decision
->     the human resolved, and that decision named the commit.
->
->   Every push is logged with the remote, the ref, the commit and, when one was given, the decision.
-
-Under "Credentials", after REQ-CRED-2:
-
-> Added in version 1.7:
->
-> - **REQ-CRED-3.** An agent with a grant can run commands with sudo on another host. The agent asks
->   for the host credential by name. The stack checks that a grant exists for that agent and that host
->   before the credential is used. The agent never sees the key or any other secret value (REQ-CRED-1,
->   REQ-VAR-2). An agent without a grant for that host is refused. Not every agent gets a grant. Who
->   grants a host credential, and how, is set by the #424 design, which Jason approves.
-
-REQ-WAIT-3, appended:
-
-> `role.hire` and `role.fire` were added as hard waits and route under REQ-COS-3 since version 1.7.
-> `git.push.remote` was added as a hard wait and routes under REQ-LAND-2 since version 1.7.
-
-## Notes for the reviewer and for Mos
-
- REQ-COS-1 (1.2) already says the chief "hires and terminates role instances". REQ-COS-3 gives that
-  sentence its actions and bounds. It doesn't widen REQ-COS-1.
- The forbid now names what r3 called "replace": ending a kept instance's run with a reason and changing
-  its model (webby-0010 N2). A user-resolved decision still ends a kept run (row 194 D2.4).
- The fixed list is `HIRE_ALLOWED` in row 194 D2.3, an allowlist since r4 (webby-0010 B1). r3's text
-  named the refused authorities instead, which let merge-gate and any later action through.
- The kill switch is row 191's. If row 191 hasn't landed when this version is approved, the bound still
-  holds through row 194's chain on its candidate.
- REQ-LAND-2 follows row 199's design r6 (4d3007ec9 on megavolt/row199, approved by Duckworth in
-  duckworth-0027: D9 to D11, D9a, D9c, Q-M1 and Q-M2, and the oid binding from mos-1034 item 5) and
-  Megavolt's wording in megavolt-0005, megavolt-0008 and megavolt-0014, through Sage (sage-1377,
-  sage-1380, sage-1387). The fork bullet answers duckworth B5 and B6 and webby-0011 N1. Commit-email
-  checks, the refusal codes and the URL parse rules (D9c) are host checks with tests in row 199, not
-  bounds, so they stay out of the text (megavolt-0008).
- Once the routing lands and the decision is optional for the within-role class, the commit is the task's
-  latest recorded push at check time. It is still checked against the work ref tip and pushed by oid, so
-  the binding holds without a decision (megavolt-0008). Step 4 of "When this version lands" puts that in
-  the routing commit (duckworth-0022 N9, sage-1387).
- REQ-LAND-2 and REQ-COS-3 meet at the coder. Coder declares Gitea credentials, so REQ-COS-3's
-  credentials bound keeps the chief from hiring one until a later version lifts it. `git.push.remote` isn't
-  on REQ-COS-3's fixed list either, so a coder holding it stays unhireable until a PRD version adds it
-  (row 194 D2.3).
- Adding to the fixed action list is a PRD change (mos-1035 item 3, sage-1395). The role file's
-  `hireable` list stays a reviewed commit in `roles/`.
- The credentials bound names no row number, so the text doesn't go stale when row 199 lands. A later
-  version lifts it.
- REQ-CRED-3 states only what Jason said in Q183 and Q184 (sage-1422). It names the outcome and the
-  check, not how the stack reaches the host. Proxying the ssh and a signing socket are both designs, and
-  the #424 design picks one (duckworth-0038 B1).
- Open point: Q183 doesn't say who grants host access or how, so the text leaves it open and defines no
-  mechanism. The #424 design settles it, Jason approves that design, and Duckworth reviews it because it
-  gives agents sudo on hosts (Q184, Mos's reading, duckworth-0038 B2). The build is row 210 (#1707,
-  owner Gizmoduck), a new row on top of row 199 (megavolt-0019, sage-1430).
- This draft follows the PRD's own style: plain words, no semicolons in new sentences, and the status
-  paragraph never edited in place except to append.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 192 (Q175 SSO phase 1, #1690) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `launchpad/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `launchpad/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,178 @@
+# Row 192: Q175 phase 1, the Console verifies sign-in itself (`--sso`)
+
+Launchpad, 2026-10-20. Author Launchpad, reviewer Webby, gate owner Sage. Issue #1690. Brief
+`docs/plans/2026-10-20_sso-phase1.md`. Design `agents/sage/work/q175-sso/DESIGN.md` (blob 9e3eadb15c80).
+Rulings sage-1340 (F1 to F6) and sage-1347 (F7, F8). Plan launchpad-0001.
+
+Base 53bb59462 (`base.txt`). Candidate: branch `launchpad/row192`, r1 83b32d8d8 and the round 2 commit on it.
+`candidate-manifest.sha256` lists the 18 changed code, test and doc paths; the packet files are not in it. Drift
+check at the r2 commit: `git log 53bb59462..origin/refactor` (origin/refactor ae3c36f24) touches none of the 18 paths.
+
+No request in any test goes to auth.diversecanvas.com, mosaic.woltje.com or 127.0.0.1:7332. Every provider
+is the fake OP in `tests/helpers/fake-oidc.mjs`: https on 127.0.0.1 with a throwaway self-signed certificate,
+and a fetch that refuses any other origin. The public Host in the tests is `console.example.test`, sent as a
+header to the test's own loopback listener. No test reads or writes `~/.mosaic-dev`, `~/.config/mosaic-dev`,
+`~/.mosaic`, a slot file outside its temp dir, or a live unit.
+
+## Files
+
+| Path | Change |
+| --- | --- |
+| `package.json`, `package-lock.json` | `oauth4webapi` 3.8.8, exact, at the root (design: the copy runs `npm ci` there). No other dependency. |
+| `scripts/mosaic-config.mjs` | Accepts an optional `console.sso` key and checks it with `checkConsole`. Without the key, output is byte-identical (F2). |
+| `scripts/test-config.sh` | Test 25: a good `console.sso` passes; each refusal class refuses. 31/31. |
+| `packages/webui/src/sso-config.mjs` (new) | `checkConsole`: shape, `publicOrigin`, 1 to 8 providers, issuer https with a trailing slash, slot names, `ALGS` (asymmetric only), 1 to 64 subjects. |
+| `packages/webui/src/sso.mjs` (new) | The relying party: `readSlot`, discovery and JWKS with retry, `/auth/login`, `/auth/callback`, `/auth/logout`, sessions, `health()`, `summary()`, `formTargets()`. |
+| `packages/webui/src/serve.mjs` | Under `sso`: public Host only on the human listener (F4), `/auth/*` routes, session check before every page and API route, CSP `form-action` adds the end-session origins, tester listener refusals (F8). |
+| `packages/webui/src/cli.mjs` | `--sso`, its refusals, slot reads, the start lines, `close()` on stop. |
+| `packages/webui/src/chat-http.mjs` | Under `--sso` the session check already ran, so the header-user check is skipped; the Origin check uses `publicOrigin`. |
+| `packages/webui/src/public/app.js`, `bus.js`, `index.html` | 401 `sign-in required` signs the page out with a link to `/auth/login?return=...` (design test 24, F1). The Sign out form shows only when `/api/config` says `sso` (F7). |
+| `scripts/webui-service.sh` | Passes `--sso` through; `--send` refusal text names `--sso`. |
+| `packages/webui/tests/service.test.mjs` | The `--send` refusal regex follows the new text. |
+| `packages/webui/README.md` | New section "Sign-in in the Console (Q175 phase 1, #1690)". |
+| `packages/webui/tests/helpers/fake-oidc.mjs` (new) | The fake OP. |
+| `packages/webui/tests/sso.test.mjs` (new) | 28 tests: three positives and design tests 1 to 23 (some split in parts). |
+| `packages/webui/tests/sso-browser.test.mjs` (new) | 2 tests: design test 24 with F1, and F7. |
+
+## Tests run (single files, this worktree, final tree)
+
+| File | Pass | Fail |
+| --- | --- | --- |
+| sso | 28 | 0 |
+| sso-browser | 2 | 0 |
+| pinned-copy | 10 | 0 |
+| serve | 4 | 0 |
+| preview | 11 | 0 |
+| proof | 4 | 0 |
+| proof-cli | 3 | 0 |
+| send | 13 | 0 |
+| service | 31 | 0 |
+| tester-listener | 10 | 0 |
+| tester-cli | 2 | 0 |
+| board-held | 3 | 0 |
+| send-browser | 2 | 0 |
+| docs-browser | 1 | 0 |
+| chat | 23 | 0 |
+| chat-browser | 11 | 0 |
+| bus-browser | 2 | 0 |
+| settings-write | 4 | 0 |
+| project-file | 10 | 0 |
+| instances | 5 | 0 |
+| routes | 5 | 0 |
+| `scripts/test-config.sh` | 31 | 0 |
+
+The first singles pass failed `pinned-copy` 1 of 10: `ERR_MODULE_NOT_FOUND: Cannot find package
+'oauth4webapi'` from a copy's `sso.mjs`. The test's fixture repo writes an empty package.json and lock, so the
+copy's `npm ci` installs nothing, and `sso.mjs` imported oauth4webapi at module load. `cli.mjs` imports
+`sso.mjs` on every start, so plain `serve` broke. Fix: `sso.mjs` loads oauth4webapi inside `createSso`
+(`oauth ??= await import('oauth4webapi')`). A Console without `--sso` never resolves the package. A real copy
+still has it from the root lock. Mutant 21 restores the static import and `pinned-copy` kills it. After the
+fix: pinned-copy, sso, sso-browser and serve rerun green (counts above).
+
+Not run by me (slot work, busy at the time): the full webui package suite, the cli suite, and
+`scripts/test-*.sh` other than test-config. `packages/cli/tests/stack-copy.test.mjs` and
+`stack-release.test.mjs` also build copies with an empty lock and are the ones to watch for the same
+failure. They need Sage's gate.
+
+## Mutants (`mutants.py`, run as `python3 mutants.py <tree> [N ...]`)
+
+Each mutant edits one source file, runs one test file filtered to one test name, and restores the file
+checked by sha256. Final run on the final tree: `/mnt/storage/scratch/launchpad-r192/mutants-final.log`.
+
+| # | Mutant | Test | Result |
+| --- | --- | --- | --- |
+| 1 | drop validateApplicationLevelSignature | sso 9 | KILLED |
+| 2 | wrap the signature call in a continuing try/catch | sso 9 | KILLED |
+| 3 | drop the subjects check | sso 10 | KILLED |
+| 4 | accept HS256 and none in ALGS | sso 11 start | KILLED |
+| 5 | take the provider from the query | sso 15 | KILLED |
+| 6 | tester listener reads sign-in cookies (F8) | sso 12 | KILLED |
+| 7 | tester listener takes Authorization (F8) | sso 12 | KILLED |
+| 8 | tester listener takes x-authentik-* (F8) | sso 12 | KILLED |
+| 9 | skip the login record delete | sso 7 | KILLED |
+| 10 | drop HttpOnly from the session cookie | sso 20 and 21 | KILLED |
+| 11 | refresh last-seen on every request | sso 13 idle | KILLED |
+| 12 | build redirect_uri from the request Host | sso 22 | KILLED |
+| 13 | serve the loopback read path under --sso (F4) | sso 22 | KILLED |
+| 14 | bus.js fetchRead ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
+| 15 | bus.js fetchApi ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
+| 16 | app.js getJSON ignores 401 sign-in required | sso-browser 1 | KILLED |
+| 17 | app.js api() ignores 401 sign-in required | sso-browser 1 | KILLED |
+| 18 | signInRequired takes any 401 | sso-browser 1 | KILLED |
+| 19 | Sign out shown without the sso condition (F7) | sso-browser 2 | KILLED |
+| 20 | CSP form-action without the end-session origins | sso 13 CSP | KILLED |
+| 21 | import oauth4webapi at module load | pinned-copy | KILLED |
+| 22 | restore the r1 relative returnPath (round 2, B1) | sso 14 | KILLED |
+| 23 | drop the second origin check (round 2, sage-1403) | sso 14 | SURVIVED, equivalent, guard kept (sage-1407) |
+
+Mutant 16 survived its first run: test 1 had no `getJSON` path. The History click on
+`/api/conversations` was added and it is now killed.
+
+## Deviations from the design
+
+- **F1 (sage-1340).** `bus.js` `fetchRead` and `fetchApi` apply the same 401 `sign-in required` rule as
+  `app.js`, even when `/api/config` has no `sso`. Tested in sso-browser 1, mutants 14 and 15.
+- **F7 (sage-1347).** A Sign out form (`POST /auth/logout`) in the command bar, hidden unless `/api/config`
+  says `sso`. Tested in sso-browser 2, mutant 19.
+
+- **Proof header on 7333 under `--sso` (webby-0019 N2).** `cli.mjs` passes `testerProofHeader: null` under
+  `--sso`, since `--sso` refuses the proof pair and there is no header name to refuse. A request to 7333 that
+  still carries the old proof header is not refused for it. It gains nothing: under `--sso` no listener
+  reads a proof header (`proof` is null in `startServer`). Left as is.
+
+## Assumptions and choices
+
+- **F8 (sage-1347).** Under `--sso` the tester listener refuses a request carrying `Authorization`, either
+  `__Host-mosaic` cookie or any `x-authentik-*` header, case-insensitive (Node lower-cases header names).
+  sso 12 sends one of each; mutants 6 to 8.
+- **oauth4webapi loads lazily** inside `createSso` (see the pinned-copy failure above).
+- **Client authentication** is `ClientSecretBasic`; the fake OP's token endpoint checks Basic auth.
+- **Caps**: 1 to 8 providers, 1 to 64 subjects per provider, 64 sessions, 32 pending logins. The 33rd login
+  drops the oldest record (sso 17).
+- **CSP**: under `--sso`, `form-action` adds each provider's end-session origin. Chrome applies
+  `form-action` to the redirect after the Sign out POST, so without it the logout stops at the Console.
+  Tested in sso 13 CSP, mutant 20. Without `--sso` the CSP string is unchanged.
+- **`--send` refusal text** in cli.mjs and webui-service.sh now ends "or --sso".
+- **Start lines**: one `Sign-in provider:` line per provider with id, issuer, subject count and state
+  (`ready`, `refused` or `unreachable`). No client id, secret or sub.
+- **Test 1** uses `console.example.test` as the public Host, not mosaic.woltje.com (no request goes there).
+- **Test 11 slot files**: the owner check is not tested; the test can't create a file owned by another uid
+  without privilege. Symlink, 0644, 0640 and a file under the repository are tested.
+- **Test 23** covers a provider down at start: the Console starts, `/auth/login` is 503, loopback `/healthz`
+  is 200 with `sso: { a: 'unreachable' }`, one `discovery-failed` line, and the retry makes sign-in work. An
+  HS-only discovery at start refuses the start (in test 23 and in test 11 start).
+- **Test 22**: a Host of bare `localhost` without a port is not in the table. It hits the older
+  `non-local Host refused` check before the sso check; a comment in the test says so.
+
+## Round 2 (webby-0019)
+
+- **B1, open redirect after sign-in.** `returnPath` took any URL on `publicOrigin`, and dot segments can
+  normalize to a pathname of `//evil.example`, which a browser reads as scheme-relative in a relative
+  Location. Fix per sage-1403: `returnURL` (renamed) builds an absolute URL, `publicOrigin + pathname +
+  search`, checks its origin again, and returns its href. Anything else is `publicOrigin/`. The callback's
+  Location is now always absolute on the Console. Test 14 asserts the exact Location and its origin for each
+  case. It adds Webby's three rows (`/.//evil.example`, `/x/..//evil.example`,
+  `https://console.example.test//evil.example`), each now `https://console.example.test//evil.example`, a path
+  on the Console. It also adds `/board/./x`, which lands on `/board/x`. The positive test expects
+  `https://console.example.test/board?x=1`.
+- **Mutant 22** restores the r1 relative `returnPath`; test 14 kills it.
+- **Mutant 23** drops the second origin check. It SURVIVES, and I read it as equivalent: `checkConsole`
+  holds `publicOrigin` to a bare https origin, and a parsed https pathname always starts with `/`, so
+  `publicOrigin + pathname` can't parse to another origin. Webby agrees (webby-0022). Sage's ruling
+  (sage-1407): the check stays as an unreachable guard, and 23 is listed here as equivalent. That is a packet
+  note, not a candidate change.
+- **N1.** The design cite is now blob 9e3eadb15c80 (`git rev-parse 83b32d8d8:agents/sage/work/q175-sso/DESIGN.md`).
+- **N2.** Listed under Deviations.
+- **N3.** `SIGN_IN_COOKIE` has its own comment, above the row 177 comment and `TESTER_CHAT_WRITE`.
+- **N4.** Row 200 (#1698) covers it: `stack-release.sh` refuses `config-console-key` before any stop when the
+  target's loader refuses the key, on activate and rollback.
+- **N5.** No change.
+
+Round 2 runs, this worktree, final tree: `sso.test.mjs` 28/28 (`/mnt/storage/scratch/launchpad-r192/sso-r2.log`);
+mutants 22 and 23 (`/mnt/storage/scratch/launchpad-r192/mutants-r2.log`).
+
+## Not done here
+
+- Row 200 (#1698, `stack-release.sh activate --sso`) is chained on this candidate and starts only after the
+  manifest is with Webby (sage-1369).
+- Full suites are for Sage's gate.
@@ -0,0 +1 @@
+53bb59462120a03a9f54b02881895e3f575e501c
@@ -0,0 +1,18 @@
+95d9a48812eebc415e3605239788e5b0746f1457a3bf0f9b9651a8c745e8b0f6  package.json
+390cbb0ef88de6cbc6d8f43b9e212abfdf0ef0e1c88fa02f5ab790caabc53eed  package-lock.json
+726b71bcfdb4d9409cefc86bed2fbe8e678c6efb50bcf5bb22344aeda1eee201  packages/webui/README.md
+f7b6b68906f13a644854b8083287dfa2936e8defc6207d05739e89763cc91440  packages/webui/src/chat-http.mjs
+4a2d226bdbfee98b180103f71b3cb8122303cfac4aeece42bd30ce167ba6ff55  packages/webui/src/cli.mjs
+41ee8798c34ee491b80ae1b42c3e96cd5d12fb1603b1ab88ac2dd10b5fb27964  packages/webui/src/public/app.js
+e6c8f838eb7cdc2ae556c04451ca4c8f2d433117a17f285a144cfc7dff03e2a4  packages/webui/src/public/bus.js
+f276fa440ec938638cb3e0f1b812fafa929460a6b96f1dab4cf1076a7c0c18ea  packages/webui/src/public/index.html
+333d474b1c7e753938aedc639c08f9db0e787faf56aa8068d013fd304a0b3b7e  packages/webui/src/serve.mjs
+37b01ab0479d5f2a7ab9aac790931c6d88c790465392d9c0b65a105513f3e36b  packages/webui/src/sso-config.mjs
+b624f044d361c648cefa161abe5f2b96e0cd8a83bc7816c9d501a2cd840988ca  packages/webui/src/sso.mjs
+84e31d4beba0de5ed6d192921bd7b016296c8b2a42b3fcf1176663e182320d9e  packages/webui/tests/helpers/fake-oidc.mjs
+ac01037743fcbf1efa641794d3878f113b6206033d2f66cde072a52ccfae1a51  packages/webui/tests/service.test.mjs
+9358e3755e174b61532e2c528e733ffcdb48941cbadb825f1b0254bc55d1920e  packages/webui/tests/sso-browser.test.mjs
+3f8527fd7ae1ffb2bffce3450971f125bd616954b534577ef54249c87f36e248  packages/webui/tests/sso.test.mjs
+f8307d4bd998634467fbed8748157754132b76affac051f320196161ce385e4a  scripts/mosaic-config.mjs
+3301c1fabf616bb961d62f6decd0a46dadb0f399b8ba7f3c2ca60023d2b24c78  scripts/test-config.sh
+7678bb6b45861c3dc6d775fc99269b1db7350ced60b89517d6ebeb4cc161781c  scripts/webui-service.sh
@@ -0,0 +1,59 @@
+# Row 192 (#1690) mutants: `python3 mutants.py <tree> [N ...]`. Each applies to the tree's source, runs one
+# test file (optionally one name pattern) and restores the file from a saved copy, checked by sha256.
+# Killed = test exit != 0.
+import hashlib, os, subprocess, sys, signal
+W = os.path.join(os.path.abspath(sys.argv[1]), 'packages', 'webui')
+if not os.path.isfile(os.path.join(W, 'src', 'sso.mjs')): sys.exit(f'ABORT no packages/webui/src/sso.mjs under {sys.argv[1]}')
+S, B, C, F = 'src/sso.mjs', 'src/serve.mjs', 'src/sso-config.mjs', 'src/public/'
+T, P = 'tests/sso.test.mjs', 'tests/sso-browser.test.mjs'
+M = [
+ ('drop validateApplicationLevelSignature (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { } catch (err) {")], T, '^9:'),
+ ('wrap the signature call in a continuing try/catch (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch {} } catch (err) {")], T, '^9:'),
+ ('drop the subjects check (10)', S, [("if (name === undefined) {", "if (false) {")], T, '^10:'),
+ ('accept HS* in algs (11)', C, [("export const ALGS = Object.freeze(['PS256',", "export const ALGS = Object.freeze(['HS256', 'none', 'PS256',")], T, '^11: start'),
+ ('take the provider from the query (15)', S, [("const entry = record && providers.get(record.provider);", "const entry = record && providers.get(query.get('provider') ?? record.provider);")], T, '^15:'),
+ ('let the tester listener read cookies (12, F8)', B, [("SIGN_IN_COOKIE.test(req.headers.cookie ?? '') ||", "")], T, '^12:'),
+ ('tester listener takes Authorization (12, F8)', B, [("Object.hasOwn(req.headers, 'authorization') ||", "")], T, '^12:'),
+ ('tester listener takes x-authentik-* (12, F8)', B, [(" || Object.keys(req.headers).some(h => h.startsWith('x-authentik-'))", "")], T, '^12:'),
+ ('skip the login record delete (7)', S, [("if (key !== null) logins.delete(key);\n    // The provider", "// The provider")], T, '^7:'),
+ ('drop HttpOnly from the session cookie (21)', S, [("`${SESSION_COOKIE}=${id}; ${ATTRS}`", "`${SESSION_COOKIE}=${id}; Path=/; Secure; SameSite=Lax`")], T, '^20 and 21'),
+ ('refresh seen on every request (13)', B, [("sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) })", "sso.session(req, { touch: true })")], T, '^13: idle'),
+ ('build redirect_uri from the request Host (22)', S, [("const redirectUri = `${publicOrigin}/auth/callback`;", "let redirectUri = `${publicOrigin}/auth/callback`;"), ("    const query = new URLSearchParams(search);\n", "    const query = new URLSearchParams(search);\n    redirectUri = `https://${req.headers.host}/auth/callback`;\n")], T, '^22:'),
+ ('serve the loopback read path under --sso (22)', B, [("if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });", "")], T, '^22:'),
+ ('bus.js fetchRead ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || !Array.isArray(body.rows))", "    if (!res.ok || !body || !Array.isArray(body.rows))")], P, '^a 401'),
+ ('bus.js fetchApi ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || typeof body !== 'object'", "    if (!res.ok || !body || typeof body !== 'object'")], P, '^a 401'),
+ ('app.js getJSON ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, body)) { sso = true; signOut(); throw signedOut(); }\n    return { ok: res.ok, body };", "    return { ok: res.ok, body };")], P, '^a 401'),
+ ('app.js api() ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, result)) { sso = true; signOut(); throw signedOut(); }\n", "")], P, '^a 401'),
+ ('signInRequired takes any 401 (24)', F+'app.js', [("res.status === 401 && body?.error === 'sign-in required'", "res.status === 401")], P, '^a 401'),
+ ('Sign out shown without the sso condition (F7)', F+'app.js', [("if (config.sso === true) { sso = true; $('sign-out').hidden = out(); }", "{ $('sign-out').hidden = out(); }")], P, '^the Sign out'),
+ ('form-action without the end-session origins (CSP)', B, [("form-action 'self'${sso ? sso.formTargets().map(o => ` ${o}`).join('') : ''}`", "form-action 'self'`")], T, '^13: the CSP'),
+ ('import oauth4webapi at module load (copies)', S, [("let oauth;\n", "import * as oauth from 'oauth4webapi';\n"), ("  oauth ??= await import('oauth4webapi');\n", "")], 'tests/pinned-copy.test.mjs', '^serve runs from a copy'),
+ ('restore the r1 relative returnPath (14, webby-0019 B1)', S, [("      if (u.origin !== publicOrigin) return home;\n      const out = new URL(`${publicOrigin}${u.pathname}${u.search}`);\n      return out.origin === publicOrigin ? out.href : home;", "      return u.origin === publicOrigin ? u.pathname + u.search : '/';")], T, '^14:'),
+ ('drop the second origin check (14, sage-1403)', S, [("      return out.origin === publicOrigin ? out.href : home;", "      return `${publicOrigin}${u.pathname}${u.search}`;")], T, '^14:'),
+]
+sha = lambda b: hashlib.sha256(b).hexdigest()
+only = sys.argv[2:]
+os.chdir(W)
+survived = []
+for i, (name, path, pairs, test, pat) in enumerate(M, 1):
+    if only and str(i) not in only: continue
+    orig = open(path, 'rb').read(); h = sha(orig)
+    src = orig.decode()
+    for a, b in pairs:
+        if src.count(a) != 1: sys.exit(f'ABORT {i} {name}: pattern found {src.count(a)} times')
+        src = src.replace(a, b)
+    try:
+        open(path, 'w').write(src)
+        p = subprocess.Popen(['node', '--test', f'--test-name-pattern={pat}', test], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session=True)
+        try: out, _ = p.communicate(timeout=240)
+        except subprocess.TimeoutExpired:
+            os.killpg(p.pid, signal.SIGKILL); out, _ = p.communicate(); out += b'\nTIMEOUT'
+        text = out.decode(errors='replace')
+        ran = [l for l in text.splitlines() if l.startswith('ℹ tests ')]
+        verdict = 'KILLED' if p.returncode != 0 else 'SURVIVED'
+        if verdict == 'SURVIVED': survived.append(name)
+        print(f'{i:2} {verdict} {name} [{ran[0] if ran else "no count"}]', flush=True)
+    finally:
+        open(path, 'wb').write(orig)
+        if sha(open(path, 'rb').read()) != h: sys.exit(f'ABORT restore failed for {path}')
+print('survived:', survived or 'none')
@@ -1,8 +0,0 @@
-# Megavolt
-
-Builder seat, Claude Opus 5.5, started by Sage under mos-0974 and mos-0977 item 5 for MVP T1 item 6, the
-credential store per agent with its own git identity (#1697).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `megavolt/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 193 (human users and RBAC, #1691) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `morgana/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `morgana/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,10 +0,0 @@
-# Quackerjack
-
-Builder seat, Claude Haiku 5.5 at high effort, started by Sage under mos-1023 item 1 and Q177 for federation
-rows R5 (`mosaic access list, grant, revoke`) and R2 (the `federation` config key), per Gizmoduck's design
-section 7 (#414).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own
-`quackerjack/*` branches through the repository credential helper (mos-0981), never `refactor`, `main` or
-another seat's branch.
@@ -1,8 +0,0 @@
-#!/bin/bash
-n=0
-for p in /proc/[0-9]*; do
-  c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null) || continue
-  case "$c" in *shell-snapshots*|*chrome-devtools-mcp*|*sage-busy-now*) continue;; esac
-  if echo "$c" | grep -qE 'node --test|gate\.sh|mutant|scripts/test-[a-z-]+\.sh|docker compose'; then echo "BUSY ${p#/proc/}: ${c:0:160}"; n=$((n+1)); fi
-done
-[ $n -eq 0 ] && echo CLEAR
@@ -1,24 +0,0 @@
-#!/bin/bash
-set -o pipefail
-# Landing gate template (2026-10-14): sed the G= and OUT= lines and this comment.
-# Sequential suites, each teed to its own log; stops at the first failure.
-G=/mnt/storage/scratch/SET-ME-wt
-OUT=/mnt/storage/scratch/SET-ME-out
-cd "$G" || exit 9
-mkdir -p "$OUT" || exit 9  # a missing OUT failed the row 142 gate at step 1 (2026-10-15)
-# test-task.sh live cases run `docker compose` from $G, so without a name the project is "wt"
-# and leaves wt_default behind (row 142 gate, 2026-10-15). Name it per gate dir and remove it on exit.
-export COMPOSE_PROJECT_NAME="$(basename "$(dirname "$G")")"
-trap 'docker network rm "${COMPOSE_PROJECT_NAME}_default" >/dev/null 2>&1 && echo "removed network ${COMPOSE_PROJECT_NAME}_default"' EXIT
-# A gate tree without the node_modules link fails cli tests with ENOENT (2026-10-13).
-[ -d "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
-echo "base $(git rev-parse --short HEAD) dirty $(git status --short | grep -vc node_modules) DOCKER_HOST=${DOCKER_HOST:-unset}"
-run() { local name="$1" dir="$2" cmd="$3"
-  (cd "$G/$dir" && bash -c "$cmd") > "$OUT/$name.log" 2>&1; local rc=$?
-  echo "$name rc=$rc $(grep -E '^ℹ (pass|fail) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
-  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
-# No pkg-queue step: scripts/test-queue.sh runs packages/queue/tests/ itself (same 156 tests; CI debate item 2a, Vikunja #274).
-for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue; [ "$p" = queue ] && continue
-  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
-for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
-echo GATE_PASSED
@@ -1,36 +0,0 @@
-# Row 189 gate timing (for row 197, Herb)
-
-Sage, 2026-10-20T19:25:04Z. Gate on 0c177e9ef (base 0217b71c8), one lane. The slot was mine. Seats may have run single test files at the same time, which the slot rules allow, and I did not record that.
-Start 2026-10-20T19:09:37Z, end 2026-10-20T19:20:36Z. Total wall time: 659 s.
-
-Wall time per suite is the gap between one suite's log mtime and the one before it (the first suite starts at start.txt), so it includes node start-up. node's duration_ms is listed where the suite prints it. Scripts print no duration.
-
-| Suite | Wall s | duration_ms s | Ended (UTC) |
-|---|---|---|---|
-| pkg-bus | 3 | 3.8 | 19:09:40 |
-| pkg-business | 3 | 2.2 | 19:09:43 |
-| pkg-cli | 388 | 388.5 | 19:16:11 |
-| pkg-control-board | 1 | 0.8 | 19:16:12 |
-| pkg-conversation | 35 | 35.4 | 19:16:47 |
-| pkg-discord | 3 | 2.6 | 19:16:50 |
-| pkg-harness | 12 | 11.6 | 19:17:02 |
-| pkg-ledger | 13 | 13.5 | 19:17:15 |
-| pkg-mosaic | 3 | 2.3 | 19:17:18 |
-| pkg-plugins | 0 | 0.3 | 19:17:18 |
-| pkg-project | 1 | 1.2 | 19:17:19 |
-| pkg-runs | 1 | 0.8 | 19:17:20 |
-| pkg-seat | 6 | 6.2 | 19:17:26 |
-| pkg-tasks | 1 | 1.2 | 19:17:27 |
-| pkg-webui | 58 | 57.9 | 19:18:25 |
-| script-auth | 1 | - | 19:18:26 |
-| script-conductor | 5 | - | 19:18:31 |
-| script-config | 2 | - | 19:18:33 |
-| script-discord | 8 | - | 19:18:41 |
-| script-extension-package | 1 | - | 19:18:42 |
-| script-foundation | 40 | - | 19:19:22 |
-| script-land-work | 11 | - | 19:19:33 |
-| script-queue | 21 | - | 19:19:54 |
-| script-release | 11 | - | 19:20:05 |
-| script-task | 31 | - | 19:20:36 |
-
-Source: /mnt/storage/scratch/sage-g189/out/*.log mtimes and gate.log. The cli suite is about 59% of the run, and webui plus conversation add about 14%.
@@ -1,35 +0,0 @@
-{
- "seq": 22,
- "id": "3a6c8fb9-a5ab-42f8-9755-902a88375ca2",
- "at": "2026-10-20T22:41:14.444Z",
- "business": "mosaic-stack",
- "project": null,
- "raised_by_role": "pm",
- "raised_by_run": "rc9e993da24cf",
- "class": "gated",
- "action": "prd.approve",
- "route_to": "human",
- "question": "Approve PRD 1.8 exactly as drafted?\n\nFile: agents/honker/work/queue-194/PRD-1.8-DRAFT.md on mosaicstack/stack at commit 762a6711ff7ed049aa73dfde98b75ebf326bdd99 (revision 5), 319 lines, sha256 8eee52470b1d7df139164e3ba5cc128dc469457b2b52f298c12685c3483011a8. Duckworth reviewed it (duckworth-0061, confirmed duckworth-0062) and Mos checked it (mos-1140). The tip of branch honker/row194-b2 holds a later r6 (aba3cbdeb), which is not used here. This approval covers only the r5 commit and sha256 above. The PM copied these values from the request and did not compute or check the sha256.\n\nNotes the approval carries:\n1. Mos's reading: \"the main agent or chief of staff\" in Q10 is one role under two names, the chief of staff. Only the chief raises a grant request; the assistant passes the user's request to the chief. To change it, say so at approval and REQ-GRANT-1 changes first.\n2. Mos's reading: revoke by \"you, Mos or the tester\" means the user, the assistant (\"Mos\", Jason's assistant) for grants in its own organization, and the tester only on a dev instance.\n3. N5: host.sudo keeps the arbiter route version 1.7 set for git.push.remote. A raise for it that cites the spec and isn't within-role goes to the arbiter for its domain, not to the user. In manual mode it comes to the user.\n4. B7 residual: only an Approve creates a grant, but an agent running as the stack's OS user can still write the stack's own store (Q182 on dragon-lin, #423 on .53 and .54). This version doesn't close it.\n5. N6: the broker enforces only that the chief of staff raised a grant request. The rest of the chain of command is the messaging lists and role contracts, not a broker check.\n\nSource: a tester request relayed by the chief (message 6990efb4, tester message d54a190e). It is a test request, not Jason's instruction. It takes the same route as PRD 1.7 (decision d52febb5): non-blocking, no task, uncited, so it goes to the human's Inbox. I recommend yes because two reviewers have passed r5 and the open points are written down above, not hidden.",
- "options": [
-  {
-   "key": "yes",
-   "text": "Approve PRD 1.8 exactly as drafted: the r5 file at commit 762a6711ff7ed049aa73dfde98b75ebf326bdd99 with the sha256 below, and only that."
-  },
-  {
-   "key": "no",
-   "text": "Don't approve. Say what changes, and a new revision comes back for review."
-  }
- ],
- "recommendation": "yes",
- "task_ref": null,
- "requirement_ref": null,
- "blocking": false,
- "supersedes": null,
- "spec_path": null,
- "spec_commit": null,
- "authorization": {
-  "action": "prd.approve",
-  "target": null,
-  "approvalChoice": "yes"
- }
-}
@@ -1,37 +0,0 @@
-[
-  {
-    "seq": 22,
-    "id": "3a6c8fb9-a5ab-42f8-9755-902a88375ca2",
-    "at": "2026-10-20T22:41:14.444Z",
-    "business": "mosaic-stack",
-    "project": null,
-    "raised_by_role": "pm",
-    "raised_by_run": "rc9e993da24cf",
-    "class": "gated",
-    "action": "prd.approve",
-    "route_to": "human",
-    "question": "Approve PRD 1.8 exactly as drafted?\n\nFile: agents/honker/work/queue-194/PRD-1.8-DRAFT.md on mosaicstack/stack at commit 762a6711ff7ed049aa73dfde98b75ebf326bdd99 (revision 5), 319 lines, sha256 8eee52470b1d7df139164e3ba5cc128dc469457b2b52f298c12685c3483011a8. Duckworth reviewed it (duckworth-0061, confirmed duckworth-0062) and Mos checked it (mos-1140). The tip of branch honker/row194-b2 holds a later r6 (aba3cbdeb), which is not used here. This approval covers only the r5 commit and sha256 above. The PM copied these values from the request and did not compute or check the sha256.\n\nNotes the approval carries:\n1. Mos's reading: \"the main agent or chief of staff\" in Q10 is one role under two names, the chief of staff. Only the chief raises a grant request; the assistant passes the user's request to the chief. To change it, say so at approval and REQ-GRANT-1 changes first.\n2. Mos's reading: revoke by \"you, Mos or the tester\" means the user, the assistant (\"Mos\", Jason's assistant) for grants in its own organization, and the tester only on a dev instance.\n3. N5: host.sudo keeps the arbiter route version 1.7 set for git.push.remote. A raise for it that cites the spec and isn't within-role goes to the arbiter for its domain, not to the user. In manual mode it comes to the user.\n4. B7 residual: only an Approve creates a grant, but an agent running as the stack's OS user can still write the stack's own store (Q182 on dragon-lin, #423 on .53 and .54). This version doesn't close it.\n5. N6: the broker enforces only that the chief of staff raised a grant request. The rest of the chain of command is the messaging lists and role contracts, not a broker check.\n\nSource: a tester request relayed by the chief (message 6990efb4, tester message d54a190e). It is a test request, not Jason's instruction. It takes the same route as PRD 1.7 (decision d52febb5): non-blocking, no task, uncited, so it goes to the human's Inbox. I recommend yes because two reviewers have passed r5 and the open points are written down above, not hidden.",
-    "options": [
-      {
-        "key": "yes",
-        "text": "Approve PRD 1.8 exactly as drafted: the r5 file at commit 762a6711ff7ed049aa73dfde98b75ebf326bdd99 with the sha256 below, and only that."
-      },
-      {
-        "key": "no",
-        "text": "Don't approve. Say what changes, and a new revision comes back for review."
-      }
-    ],
-    "recommendation": "yes",
-    "task_ref": null,
-    "requirement_ref": null,
-    "blocking": false,
-    "supersedes": null,
-    "spec_path": null,
-    "spec_commit": null,
-    "authorization": {
-      "action": "prd.approve",
-      "target": null,
-      "approvalChoice": "yes"
-    }
-  }
-]
@@ -1,13 +0,0 @@
-[mos test] Please have the PM raise a prd.approve decision for PRD 1.8, the same route as PRD 1.7 (decision d52febb5): blocking false, no task_ref, recommendation yes, gated to the human. The PM must not compute or change the sha256; it copies the values below.
-
-Question: "Approve PRD 1.8 exactly as drafted?"
-File: agents/honker/work/queue-194/PRD-1.8-DRAFT.md on mosaicstack/stack at commit 762a6711ff7ed049aa73dfde98b75ebf326bdd99 (revision 5), 319 lines, sha256 8eee52470b1d7df139164e3ba5cc128dc469457b2b52f298c12685c3483011a8. Reviewed by Duckworth (duckworth-0061, confirmed duckworth-0062) and checked by Mos (mos-1140). The branch tip of honker/row194-b2 holds a later r6 (aba3cbdeb) that is not used; the approval covers only the r5 commit and sha256 above.
-
-The decision notes must carry these five items:
-1. Mos's reading: "the main agent or chief of staff" in Q10 is one role under two names, the chief of staff. Only the chief raises a grant request; the assistant passes the user's request to the chief. To change it, say so at approval and REQ-GRANT-1 changes first.
-2. Mos's reading: revoke by "you, Mos or the tester" means the user, the assistant ("Mos", Jason's assistant) for grants in its own organization, and the tester only on a dev instance.
-3. N5: host.sudo keeps the arbiter route version 1.7 set for git.push.remote. A raise for it that cites the spec and isn't within-role goes to the arbiter for its domain, not to the user. In manual mode it comes to the user.
-4. B7 residual: only an Approve creates a grant, but an agent running as the stack's OS user can still write the stack's own store (Q182 on dragon-lin, #423 on .53 and .54). This version doesn't close it.
-5. N6: the broker enforces only that the chief of staff raised a grant request. The rest of the chain of command is the messaging lists and role contracts, not a broker check.
-
-Reply with the decision id once raised. Do not resolve it.
@@ -1,8 +0,0 @@
-sent d54a190e to chief
-chief (RESULT, re d54a190e) cc46a7b4:
-I passed your request to the pm without changing any of it, and launched the pm so it can act on it. No decision id yet, because the pm hasn't raised the decision.
-
- **Message to pm:** 6990efb4-8321-4d0e-9b8a-771f65625b83. It says the request comes from a tester and authorizes nothing, and it carries your PRD 1.8 values and the five notes as you wrote them.
- **pm launch:** run rc9e993da24cf.
-
-When the pm answers with the decision id, I'll send it to you.
@@ -1,5 +0,0 @@
-trail 3a6c8fb9-a5ab-42f8-9755-902a88375ca2: 4 row(s)
-2026-10-20T22:40:47.949Z  events#1550  session.launched  pm
-2026-10-20T22:40:47.969Z  role_claims#102  claim pm by rc9e993da24cf
-2026-10-20T22:41:14.444Z  decisions#22  gated prd.approve → human: Approve PRD 1.8 exactly as drafted? File: agents/honker/work/queue-194/PRD-1.8-DRAFT.md on mosaicstack/stack at commit …
-2026-10-20T22:41:14.445Z  events#1553  action.allowed  pm  decision.raise  decision 3a6c8fb9
@@ -1,86 +0,0 @@
-# Row 189: `stack-release.sh activate --no-send`
-
-Gitea #1687. Vikunja P19 #413 (Q175 interim, #412). Brief: docs/plans/2026-10-20_activate-no-send.md.
-Rulings: mos-0972 (the Console runs without `--send` until Q175 phase 2), mos-0973 (go; Sage builds,
-Dewey reviews; gate is the cli suite plus every scripts/test-*.sh). Base: def2e7932 (refactor, the
-brief commit on 9ae8c73ac).
-
-## What it does
-
-`activate ID BUSINESS --no-send` drops `--send` from `RUN_CONSOLE` in a new `send_for_target`, which
-`console_for_target` calls after `proof_for_target`. `install_stack` renders the unit from
-`RUN_CONSOLE` and `write_pointer` writes the pointer from it, so both lose the flag and `flags_drift`
-stays quiet afterwards. Only `activate` takes the flag; the parser sends every other op to usage
-(exit 4).
-
-`check_target` lets a `--no-send` activate name the pointer's copy only when the pointer's Console
-flags hold `--send`. That run is a live-copy re-pin, the same path row 187 uses for the proof pair:
-the plan prints the live-copy note, the run stops both units, backs up the stopped store and starts
-them again. A plain same-copy activate, or a same-copy `--no-send` once `--send` is gone, still
-refuses `already-active`.
-
-`--plan` prints one `send:` line after the `proof:` line, for activate and rollback:
-
- `send: dropped; --no-send was given`
- `send: off; --no-send was given and the pointer holds no --send`
- `send: carried` (the pointer's `--send` goes on unchanged)
- `send: off`
-
-The steps log gets `drop --send; --no-send was given`, or `--no-send was given and the pointer holds no
--send, so there is nothing to drop`.
-
-Rollback and pm-on carry the pointer's flags as they are, so once `--no-send` has run, nothing adds
-`--send` back. There is no re-enable flag (mos-0973). Q175 phase 2 changes the Console flags in its
-own row.
-
-docs/TOOLS.md: `[--no-send]` in the usage block and one paragraph after the proof paragraph.
-
-## Tests (packages/cli/tests/stack-release.test.mjs, T55)
-
-1. Seeded preview pointer with `--send --tester-port 7333`: a same-copy `activate B acme --no-send`
-   passes. The pointer and the unit ExecStart lack `--send` and keep the other flags in order, status
-   says the unit flags match, the steps log has the drop line, the log line has from = to = B and the
-   backup sum equals the stopped store's, and the units stop and start in order.
-2. Plain same-copy activate, with `--tester-port` and with `--no-proof`, refuses `already-active`. So does
-   a same-copy `--no-send` once `--send` is gone, and on a pointer that never held it.
-3. The four `send:` lines, the live-copy note on the same-copy plan only, and the Console line right
-   after `send:` without `--send`. The run on a pointer with no `--send` logs the nothing-to-drop line
-   and no drop line.
-4. After `--no-send` on C1, a rollback to B leaves `--send` out of the pointer and the unit, the steps
-   log never names `--send`, and status matches. pm-on after `activate --pm-after-harness --no-send`
-   keeps it off.
-5. `--no-send` on rollback (with and without `--plan`), pm-on, status, adopt and rehearse is a usage
-   error with the usage text, nothing written, started or logged. The usage text shows `[--no-send]`.
-6. A pointer holding both the proof pair and `--send`: the plans for `--no-proof`, `--no-send` and both
-   name what each drops and carries. `--no-send` keeps the pair, `--no-send` with a new pair replaces it,
-   `--no-proof` keeps `--send`, and both together leave neither. Status matches after each.
-
-`planTail` gains `'send: off'` after `'proof: off'`, because every plan now prints the line. T36 takes
-`out.slice(-n)` around `planTail`, so its four slice counts grow by one.
-
-## Mutants
-
-mutants.sh in this packet, run on the candidate. Each mutates scripts/stack-release.sh and runs T55
-plus T1 and T2.
-
- M1: the same-copy exception ignores `--no-send`.
- M2: the same-copy exception allows `--no-send` without `--send` in the pointer.
- M3: with `--no-send`, the pointer is written from `P_CONSOLE`, so it keeps `--send` while the unit
-  drops it.
- M4: rollback re-adds `--send`.
- M5: the parser accepts `--no-send` for rollback.
-
-Results: mutants-run.log, all five killed (M1 5 failures, M2 2, M3 7, M4 2, M5 2).
-
-## Deviations from the brief
-
- The brief's line numbers were taken before row 163 landed. The candidate corrects them to the
-  9ae8c73ac lines (check_target :249-256, flags_drift :646-657, console_for_target :664-693, adopt
-  :828).
- Test 5 also covers rehearse and `rollback --plan`, which the brief did not list.
-
-## Outbound calls
-
-None. The change edits an array before the existing unit render and pointer write. Every test uses
-the stand-in systemctl, units, stores and data root the file already builds; no test touches
-`~/.mosaic-dev`, the live units or a slot file.
@@ -1,5 +0,0 @@
-M1 KILLED fail=5
-M2 KILLED fail=2
-M3 KILLED fail=7
-M4 KILLED fail=2
-M5 KILLED fail=2
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Row 189 mutants M1-M5: each mutates scripts/stack-release.sh in the sage-b189 worktree, runs T55 and
-# the plan-tail tests, and restores the file from a checked backup.
-set -uo pipefail
-WT=/mnt/storage/scratch/sage-b189
-OUT=/mnt/storage/scratch/sage-b189-mut/out
-S=$WT/scripts/stack-release.sh
-mkdir -p "$OUT" || exit 1
-cp -p "$S" "$OUT/stack-release.sh.orig" || { echo "backup failed"; exit 1; }
-ORIG=$(sha256sum "$S" | cut -d' ' -f1)
-[ "$(sha256sum "$OUT/stack-release.sh.orig" | cut -d' ' -f1)" = "$ORIG" ] || { echo "backup differs"; exit 1; }
-restore() { cp -p "$OUT/stack-release.sh.orig" "$S"; [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ] || { echo "RESTORE FAILED"; exit 1; }; }
-trap restore EXIT
-
-mutate() {
-    case "$1" in
-        M1) sed -i '/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/d' "$S" ;;
-        M2) sed -i 's/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/{ [ "$NO_SEND" = 1 ]; } ||/' "$S" ;;
-        M3) sed -i 's/^    write_pointer "\$TO" "\$RUN_PM" "\$RUN_PENDING" "\$P_CLAUDE" "\$T_SCHEMA" "\${RUN_CONSOLE\[@\]}"$/    if [ "$NO_SEND" = 1 ]; then write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${P_CONSOLE[@]}"; else write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${RUN_CONSOLE[@]}"; fi/' "$S" ;;
-        M4) sed -i 's/^        SEND_PLAN="send: off"$/        SEND_PLAN="send: off"; [ "$OP" != rollback ] || RUN_CONSOLE+=(--send)/' "$S" ;;
-        M5) sed -i 's/--no-send) \[ "\$OP" = activate \] || usage;/--no-send) { [ "$OP" = activate ] || [ "$OP" = rollback ]; } || usage;/' "$S" ;;
-    esac
-}
-
-for m in M1 M2 M3 M4 M5; do
-    restore
-    mutate "$m"
-    if [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ]; then echo "$m NOT-APPLIED"; continue; fi
-    bash -n "$S" || { echo "$m SYNTAX"; continue; }
-    diff "$OUT/stack-release.sh.orig" "$S" > "$OUT/$m.diff"
-    (cd "$WT" && TMPDIR=/mnt/storage/scratch/t189 timeout 900 node --test --test-reporter=tap --test-name-pattern='T55|T1 |T2 ' packages/cli/tests/stack-release.test.mjs) > "$OUT/$m.log" 2>&1
-    fails=$(awk '/^# fail /{print $3}' "$OUT/$m.log")
-    if [ "${fails:-0}" -gt 0 ]; then echo "$m KILLED fail=$fails"; else echo "$m SURVIVED"; fi
-done
@@ -1,149 +0,0 @@
-# Row 66: managed sessions run the unslop check on both harnesses
-
-Sage, 2026-10-20. Brief: `docs/plans/2026-10-11_managed-session-config.md`, section "Managed
-sessions run the unslop check on both harnesses", blob 21ae25a328d4. Issue #1559. Reviewers:
-Dewey and Filbert. Built in the worktree `/mnt/storage/scratch/sage-b66` (branch `sage/row66`)
-on base 5487ed39d.
-
-Candidate: see the commit line in the review request. `candidate-manifest.sha256` in this
-directory has the sha256 of each changed file at the candidate.
-
-## What changed
-
-**Wiring.** Both harness modules mount `tools/unslop-hook/lists.json`, `unslop-check.js` and
-the harness's own entry (pi `extension.ts`, Claude Code `claude-hook.js`) read-only at their
-own paths, and the bundle manifest lists the three in `sources` with their digests. Pi loads
-`extension.ts` as the second entry of `MOSAIC_EXTENSIONS`, after the gate extension. Claude
-Code's `settings.json` gains a Stop hook and a UserPromptSubmit hook, each
-`timeout -k 2 10 '<node>' '<dir>claude-hook.js' stop|prompt; exit 0`, hook timeout 20, no
-matcher. Neither can block a reply or a prompt.
-
-**claude-hook.js** (new). `stop` checks each assistant message with text since the turn's
-prompt and logs `checked` or `flagged`. `prompt` checks the last reply and, when it has tells,
-prints the extension's notice, word for word, as `additionalContext`, once per reply (it reads
-the log for an earlier `notice_injected` with the same entry id). A broken lists.json logs
-`broken_lists`; any other fault logs `hook_failed`; the exit is always 0.
-
-**The operator channel.** The runner sets `MOSAIC_UNSLOP_LOG` to `<run>/unslop.jsonl` after the
-module's variables, so a module can't point it elsewhere. After the landing turn and after each message turn it reads what the
-log gained (whole lines only, from an offset). The next RESULT it sends ends with a note. The
-whole note, both parts and the blank line before them, is at most 600 characters (r2):
-
- `[unslop: N reply|replies of this session flagged since the last note: <details>. The session gets a correction notice on its next turn.]`
- `[unslop: the check is broken, so this session's replies go unchecked: <reason>]`, once a run.
-
-That RESULT is what `mosaic talk` and `mosaic follow` print. A turn that sends no reply (an
-incoming RESULT, the landing turn) keeps its note for the next one. `note()` doesn't change
-state and `sent()` runs only after `message.send` succeeds, so a failed send keeps the note.
-`clip()` caps the body at 32000 characters plus its 33-character cut line before the note, so the
-sum is at most 32633, under the bus limit of 32768. The broken reason is cut at 300 where the
-runner takes it, from the log or from its own read failure, so the broken part is at most 371
-characters and the flagged part is cut to what is left.
-
-**Counts.** `unslopCounts(path)` reads the log after the session ended:
-`{checked, flagged, patterns: {<source>: n}, notices, broken}`. A missing log gives zeros.
-Findings now carry `source`, the entry's pattern id (`ms-unslop:7`), so `patterns` is per id.
-
-**The stack copy (r2).** `scripts/stack-copy.sh` `COPY_PATHS` gains `tools/unslop-hook`. Both
-modules join their files under `REPO`, and a session launched from a pinned copy has
-`REPO = copies/<sha>`. Without it every managed session from a copy past this row would fail at
-bundle build with ENOENT (Dewey P1, comment 29440).
-
-## Round 2
-
-Round 1 (candidate 8ec03b45a, manifest e68c6bce5ec4) got changes from Filbert (29439) and Dewey
-(29440). Round 2 carries:
-
- F1 (both): a note with both parts wasn't bounded. A 300-character reason, a long flagged part
-  and a clipped answer came to 32934 (Filbert) or 33004 (Dewey), over 32768, and the broker
-  refused the send. `note()` now gives the flagged part only the room the broken part leaves, and
-  `fresh()` cuts every reason at 300, the runner's own read-failure reason included. Tests: the
-  runner test with an answer of 40000 characters, a 400-character `hook_failed` reason and 30
-  flagged replies (note ≤ 600, body ≤ 32768, cut line at 32000), and a unit check that both
-  parts come to exactly 600 and that a read failure on a 250-character path is cut.
- F2 (Filbert; Dewey's M3): no test failed a send through `main()`. The new runner test has the
-  broker refuse the first RESULT. The note then rides the next RESULT. One correction to the
-  F1 consequence as written: the broker marks a received message delivered, so the refused
-  message isn't received again in that run. It stays unread and its sender gets no reply; the
-  turn doesn't rerun.
- P1 (Dewey): `COPY_PATHS` gains `tools/unslop-hook`. The copy fixtures in
-  `stack-copy.test.mjs` and `pinned-copy.test.mjs` copy `tools/unslop-hook` too, and the
-  pinned-copy top-level list gains `tools`. A new `stack-copy.test.mjs` test makes a copy, loads
-  both harness modules from it, and checks that the adapter, the six unslop paths and the mounts
-  are under the copy and exist.
- N1 (Filbert): the two session-test comments say `<dir>/unslop.jsonl`.
- N2 (Filbert), doc-only follow-up: the brief's `<run>/session/unslop.jsonl` (:463) and "print
-  mode notifies nobody" (:477) are stale. The brief is Jason's text for this row; the deviation
-  below records the path.
- Dewey's notes, no change: the Claude Code Stop timing (finding 3 below) gets a look in the
-  landing session; `patterns` keys per entry source, which is the brief's "per pattern".
-
-r2 mutants, each killed by its intended test (`mutants-r2.log`):
-
-| Mutant | Killed by |
-|---|---|
-| K1 the r1 `note()` cut | the clipped-answer runner test (the send is refused and it times out) and the unit check |
-| K2 `fresh()` doesn't cut the reason | the unit check |
-| K3 `sent()` before `message.send` | the refused-send runner test |
-| K4 `COPY_PATHS` without `tools/unslop-hook` | the copy test |
-
-## Ship list against the brief
-
-| Brief item | Where |
-|---|---|
-| A reply with a tell gets a correction notice on the next turn, both harnesses | `pi-session.test.mjs`, `claude-session.test.mjs`, row 66 four-turn tests: notices per request `[0, 1, 1, 2]`, notice text matched in the second request |
-| A clean reply gets none | same tests: turn 2 is clean and turn 3's request carries no new notice |
-| Broken lists.json fails closed: no clean verdict, operator told once, session alive | the row 66 broken-lists tests per harness: checked 0, flagged 0, first note broken, second note empty, the session answers both turns |
-| Counts readable after the session ends | `unslopCounts` on each session's log: `{checked: 4, flagged: 2, notices: 2, broken: null}`, patterns non-empty |
-| Interface 1 and the export list unchanged | no harness module export added or removed; the runner gains `unslopLog`, `unslopCounts`, `unslopNotes` |
-
-## Findings made while building
-
-1. **extension.ts read the wrong reply.** Pi 0.85.1 `getBranch()` returns entries root first
-   (`session-manager.js:958-967` reverses the leaf-to-root walk). `before_agent_start` took the
-   first assistant entry it met, which was the session's first reply, every turn. In the
-   four-turn test the old code gave notices `[0, 1, 2]` over three turns (turn 3 re-noticed
-   turn 1); walking from the end gives `[0, 1, 1]`. Fixed in `extension.ts`; this also affects
-   the fleet copy under `~/.mosaic/tools`, which I didn't touch.
-2. **claude-hook replies() merged replies.** Grouping by `message.id` across the transcript
-   merged two replies that shared an id (the test API answers `msg_mock` for all). It now groups
-   adjacent assistant lines only, keyed by the first line's uuid. Before the fix turn 4 got no
-   notice (`[0, 1, 1, 1]`).
-3. **Claude Code Stop timing.** On the first turn of a new session the transcript didn't yet
-   hold the reply when Stop ran, so the hook checked `last_assistant_message` with an empty
-   `entryId`. On resumed turns the reply was in the transcript. The verdict is the same either
-   way; only the entry id differs.
-4. The finding detail format is `banned word "delve" x1`.
-
-## Deviations
-
- **The log path is `<run>/unslop.jsonl`, not the brief's `<run>/session/unslop.jsonl`.** A
-  thread run's session directory is the thread's store, and
-  `packages/cli/tests/thread-launch.test.mjs:179` pins that a thread run keeps no per-run
-  `session/`. My first build made `<run>/session` for the log and failed that test in the gate
-  (452/453). The brief's other line, "`unslop.jsonl` in the run directory", still holds, and each
-  run keeps its own log.
-
- **`packages/seat/tests/sandbox.test.mjs`** isn't an owned file. Its pin
-  `binds(args).length === list.length - 1` broke because the modules now mount three more files.
-  It is now `- 4`, and the test asserts the three unslop read-only binds by name.
- **`scripts/stack-copy.sh`** and the two copy tests aren't owned files. The copy change is P1
-  above. PB3 of the Part B window (`repin-partB-proof.md`) holds `scripts/stack-copy.sh` still
-  until B7, so this row lands after the Part B window has run.
- `MOSAIC_EXTENSIONS` is set through the pi module's `env`, not in the runner.
- `unslop-check.js` gained the `source` field on findings (needed for per-pattern counts).
-
-## Limits
-
- The log is in the run directory, which the session can write. A session could forge or erase
-  its own counts. They are the session's report, not host evidence.
- The pi extension's dedupe is in memory: after a restart, or when a turn's final message is
-  tool-only, the same earlier reply can get a second notice.
- `hook_failed`, `skipped_broken` and `broken_lists` all count as broken for the operator note.
- No blocking (Q84 option B), no list changes, no skill changes: out of scope by the brief.
-
-## Gate
-
-Recorded with the candidate in the review request: test-unslop-check, the harness, plugins,
-seat and cli suites, and every `scripts/test-*.sh`. At landing Sage runs one managed session per
-harness and attaches the notice, the correction and the counts.
@@ -1,51 +0,0 @@
-// Sage, 2026-10-20: row 192 (Q175 phase 1, #1690) landed. One comment on P19 412, per mos-0882 (every
-// landing or decision gets a Vikunja comment). Sage's own key (bot user 13); the sync key reads back. Comments only:
-// no task edits, labels, assignees or bucket moves. Checks the task's title before posting. Prints no secret.
-// Usage: node comment-412-r192-landed.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
-const PROJECT = 19;
-const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
-const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
-const POSTS = [
-  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
-    "Row 192 (Q175 phase 1, Gitea #1690) landed and pushed. Landing commit 4429a104f (Launchpad's launchpad/row192 53bb59462..37582e820, manifest round 2, 18 paths; Webby approved). Patch-id 4a486902614d matches the reviewed diff. Queue revs 2429-2430 (landing note and done) are in 305857c8f, range 32b54ac3b..305857c8f on refactor. #1690 is closed.",
-    "Sage gate on 088087ac9: package suites 2758 pass 0 fail, scripts/test-*.sh 429 pass 0 fail, mutants 22 of 23 killed (#23, the second origin check, ruled equivalent). The Console now verifies SSO itself under --sso as an OIDC relying party on oauth4webapi 3.8.8, pinned exactly. mosaic-config.mjs load is now async, so in-flight rows that call it rebase and await it (row 190 round 3 is doing this).",
-    "Not live. The live stack still runs copies/490e2771d3d0. The new dependency needs npm ci in a new stack copy, so the live re-pin is a window with Mos (mos-1099 item 3); Sage sends Mos the plan. Row 200 (phase 2) follows.",
-  ] },
-];
-const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
-async function api(method, path, body, auth) {
-  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
-  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
-  return { status: r.status, json };
-}
-const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
-const rec = { at: new Date().toISOString(), comments: [], problems: [] };
-const save = () => {
-  const out = JSON.stringify(rec, null, 1) + "\n";
-  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
-  writeFileSync(OUT, out);
-};
-for (const P of POSTS) {
-  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
-  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
-}
-writeFileSync(OUT, "", { flag: "wx" });
-for (const P of POSTS) {
-  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
-  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
-  rec.comments.push(e);
-  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
-  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
-  const found = list(back.json).find((x) => x.id === c.json.id);
-  Object.assign(e, { readBack: back.status, found: Boolean(found) });
-  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
-  save();
-}
-save();
-process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
-if (rec.problems.length) process.exit(2);
@@ -1,66 +0,0 @@
-// Sage, 2026-10-20: W11 of the re-pin window 490e2771d to 4429a104f (STATE.md in commit 99a406ed3) on P19 386, 412
-// and 393, and the row 190 landing (00d4cc1f6, #1688) on P19 414, per mos-0882. Sage's own key (bot user 13); the
-// sync key reads back. Comments only: no task edits. Checks each task's title before posting. Prints no secret.
-// Usage: node comment-w11-r190-2026-10-20.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
-const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
-if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
-if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
-const PROJECT = 19;
-const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
-const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
-const STATE = "agents/sage/work/window-repin-4429a104f/STATE.md in commit 99a406ed3 (pushed), sha256 a4d0a7b12f431f15";
-const POSTS = [
-  { id: 386, title: /^Q173 test system: tester writes/, body: [
-    "Q173 re-pin window, 490e2771d to 4429a104f (row 192), done. STATE report: " + STATE + ".",
-    "Activation 20261020T220206Z-4429a104f6d6 with --pm, exit 0, every gate check including pm_launched. Store stays on 3i, migration none. Backup ~/.mosaic-dev/backups/stack/20261020T220206Z-4429a104f6d6 (SHA256SUMS b61d6484), rollback set beside it; rollback would go to 490e2771d. Business file unchanged (sha256 1e49bdf0). Console flags unchanged: no --send, no --sso, --tester-port 7333.",
-    "W0 to W10 passed, nothing rolled back. W10 stopped once on two browser checks; both were checks written before row 192 (the hidden #sign-out link, and a chat check that read only the first project list). Mos passed them (mos-1135) and the corrected checks are in the plan. Matrix line g is 6575 bytes, not 6454, because row 192 grows index.html by 121 bytes; Mos passed it (mos-1137).",
-    "S1 to S2 store deltas include task_snapshots +7 and task_comment_cursors +5. The writer is the bus's Vikunja poll (packages/tasks/src/adapter.mjs tick, sync.mjs recordTask), source 'poll', not the window. Nobody acted as Jason: no --by jason, no pi, no Save, no mosaic name, bus.tester untouched.",
-  ] },
-  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
-    "Row 192 (Q175 phase 1) is live in copy 4429a104f since activation 20261020T220206Z (Q173 window with Mos). The sign-in code is in the copy but dormant: the Console runs without --sso, and the proof pair stays unset. The new oauth4webapi 3.8.8 dependency came in through npm ci in the new copy and imports cleanly from it.",
-    "STATE report: " + STATE + ". The webui journal since activation shows one 'Proxy: proxy proof off' line and no 'Sign-in:' line, as expected without --sso.",
-  ] },
-  { id: 393, title: /^dragon-lin: seven legacy user units in failed state/, body: [
-    "Current failure times read during the Q173 re-pin window W11 (systemctl --user show, CDT with UTC): mosaic-standup-pm.service failed 2026-10-19 19:00:28 CDT (10-20 00:00:28Z), exit 1. mosaic-install-drift.service failed 2026-10-20 00:12:54 CDT (05:12:54Z), exit 9. [email protected] failed 2026-10-20 13:16:12 CDT (18:16:12Z), exit 4.",
-    "The marker's journal at 18:16:12Z says its tmux send to jarvis failed ('tmux target not found', socket mosaic-fleet), so that page never arrived; the record is in ~/.local/state/mosaic-unit-failures/20261020.jsonl. mosaic-reconcile.service itself last ran OK at 17:16:27 CDT (22:16:27Z), so the marker is stale until reset.",
-    "All three predate the re-pin at 22:02Z and come from the legacy ~/.mosaic and jarvis-brain setup. The window changed none of them. Disabling or resetting any still needs Jason or ops-01's charter. Details: " + STATE + ", section 'Failed user units'.",
-  ] },
-  { id: 414, title: /^MVP platform: the Given list for Cases 1 and 2/, body: [
-    "Row 190 (several Mosaic Stack instances on one host, MVP T1.1, Gitea #1688) landed and pushed: 00d4cc1f6 on refactor (99a406ed3..00d4cc1f6). Squash of Darkwing's darkwing/row190-r3 176a6bf4b..df65a3d4c, 25 paths, manifest cc0ea9e8, Filbert approved round 3; patch-id matches the branch diff.",
-    "Sage gate on d0bbc5c1c with the patch: 15 package suites 2664 pass 0 fail, 10 scripts/test-*.sh suites 429 pass 0 fail. Mutants 20 of 20 killed. Not live: the stack runs copy 4429a104f until a re-pin. Row 230 (C2-13a) now carries row 190's @CONFIG_ENV@ and @SESSION_ENV@ tokens (gosalyn-0058 item 4).",
-  ] },
-];
-const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
-async function api(method, path, body, auth) {
-  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
-  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
-  return { status: r.status, json };
-}
-const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
-const rec = { at: new Date().toISOString(), comments: [], problems: [] };
-const save = () => {
-  const out = JSON.stringify(rec, null, 1) + "\n";
-  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
-  writeFileSync(OUT, out);
-};
-for (const P of POSTS) {
-  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
-  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
-}
-writeFileSync(OUT, "", { flag: "wx" });
-for (const P of POSTS) {
-  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
-  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
-  rec.comments.push(e);
-  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
-  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
-  const found = list(back.json).find((x) => x.id === c.json.id);
-  Object.assign(e, { readBack: back.status, found: Boolean(found) });
-  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
-  save();
-}
-save();
-process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
-if (rec.problems.length) process.exit(2);
@@ -1,13 +0,0 @@
-{
- "at": "2026-10-20T21:35:49.240Z",
- "comments": [
-  {
-   "task": 412,
-   "status": 201,
-   "id": 395,
-   "readBack": 200,
-   "found": true
-  }
- ],
- "problems": []
-}
@@ -1,34 +0,0 @@
-{
- "at": "2026-10-20T22:51:44.218Z",
- "comments": [
-  {
-   "task": 386,
-   "status": 201,
-   "id": 406,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 412,
-   "status": 201,
-   "id": 407,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 393,
-   "status": 201,
-   "id": 408,
-   "readBack": 200,
-   "found": true
-  },
-  {
-   "task": 414,
-   "status": 201,
-   "id": 409,
-   "readBack": 200,
-   "found": true
-  }
- ],
- "problems": []
-}
@@ -1,125 +0,0 @@
-# Re-pin 490e2771d to 4429a104f (row 192, Q175 phase 1), with npm ci in the new copy
-
-Sage, 2026-10-20, draft 1, for mos-1099 item 3 under DECISIONS Q173. Mos checks this file at its commit before
-P0. Any change to this file or to NEW after the check means Mos checks again (mos-0849/0850).
-
-This is a smaller window than `repin-rows-177-185.md` (draft 2, which Mos checked in mos-0929). Where a step is
-the same, this file names that file's step and says what differs. The 7332 matrix, the snapshot, the W9 list and
-the rollback compare are reused unchanged.
-
-## Who, and what nobody does
-
- Sage operates, as the tester. Darkwing holds the gate lane for row 190 round 3 tonight, so I take the
-  operator seat. Mos verifies each step's output before the next one and runs `rehearse` (P3), which reads the
-  live config and a live backup (`docs/TOOLS.md` `rehearse`: Jason or Mos runs it).
- Jason has no step. Q173 covers a re-pin of this test system with a backup first and a STATE report after.
-  Nothing is pruned.
- Nobody acts as Jason: no `--by jason`, no human shell or tmux pane, every bus read and write carries
-  `--tester`, and no request carries `jason.woltje`. `bus.tester` stays as it is; if it isn't `true`, stop at P1.
- No pi (mos-0865 D2, P19 #383). No Save in the human Console, no `mosaic name`.
- Outside reach doesn't change. The Console keeps its current flags. `--sso` stays off: row 192's sign-in code is
-  dormant without the flag, and `cli.mjs:57` refuses `--sso` with the preview flags the pointer carries anyway.
-  The proof pair stays unset. The tunnel still forwards 7332 only (P4 and W10 check it).
-
-## Names
-
- OLD, live: `490e2771d3d057ab76991e2c7859cd251857e64c`, activation `20261020T192956Z-490e2771d3d0`, pointer
-  `pm: true`, schema 3i, Console `--port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username
-  --allow-user jason.woltje --tester-port 7333` (no `--send`, read from `stack-release.sh status` between 21:36Z and 21:39Z).
- NEW: `4429a104f6d65ccf165f6c83b5d1dce3147dfde0`, row 192's landing, 103 commits past OLD (`git rev-list --count 490e2771d..4429a104f`).
-  The 106 that `status` showed is OLD to HEAD 305857c8f, so it also counts the three record commits below.
-  The commits after it (5b8def2f1 plans, 176a6bf4b sessions, 305857c8f queue) are records and don't move NEW. If
-  another code row lands before W0 (row 190 is the likely one), NEW stays here unless Mos rules otherwise.
- REPO: the canonical checkout. `activate` runs REPO's `webui-service.sh`, so the four service scripts are held
-  at NEW for the window (P5).
- `P=/mnt/storage/scratch/sage-pin-de352dfaf` (`business-check.mjs`, `console-check.sh`, checked against
-  `agents/sage/work/window-plan/repin-de352dfaf/SCRIPTS.sha256`).
- `WIN=agents/sage/work/window-repin-4429a104f/`, where every transcript goes.
- `SNAP=$WIN/snapshot.mjs`, a copy of `agents/darkwing/work/window-rows-177-185/snapshot.mjs`, sha256
-  `639fd28a2674aaa03ce824e3394b4052f21cdef7d6fa49bae61a9927ed341e67` (mos-0899). I check the sha before S1, S2
-  and any D3.
-
-## What NEW carries over OLD
-
-The path-limited log over `packages`, `scripts`, `roles`, `contracts`, `adapters`, `skills` and the package files:
-
-| Row | Commit | Live effect |
-|---|---|---|
-| 186 | 269134d8d | Tool only: the activate plan's backup line says what the run will do. |
-| 187 | 9a71e4e80 | Tool: activate sets, carries and drops the proof pair. The pointer has no pair, so nothing changes. |
-| 188 | 8fc0ee216 | Tool: proof file checks on a carried pair. No pair, no effect. |
-| 163 | 8ecc7a239 | Tool: `rehearse`, which P3 uses, and `bus start --no-launch`. CLI `cli.mjs` and `launcher.mjs` gain the `--no-launch` path; the default start is unchanged. |
-| 189 | ace27dc5e | Tool: `activate --no-send`. Live already runs without `--send`; the pointer carries that. |
-| 192 | 4429a104f | Console `--sso` (off here), `scripts/mosaic-config.mjs` load becomes async, `webui-service.sh` renders `--sso` only when given, and a new dependency, oauth4webapi 3.8.8. `cli.mjs` imports `sso.mjs` at the top, so the Console won't start from a copy without that module. |
-
-No schema step: `SCHEMA_VERSION` (`packages/bus/src/store.mjs:17`) is 3i at OLD and NEW, and no migration was
-added. `--plan` must say `migration: none`. No roles, skills, contracts, adapters or plug-in kinds changed. So: no
-harness set, no skill carry, no `pm-on`. One `activate --pm`.
-
-## npm ci in the new copy
-
-mos-1099 asks for npm ci in the new copy. `stack-copy.sh copy` already does it: it extracts the archive to a temp
-dir, refuses without `package.json` and `package-lock.json` (:55), runs `npm ci --no-audit --no-fund` there and
-writes no copy if it fails (:56). W0 checks the result: `node_modules/oauth4webapi/package.json` in the copy reads
-3.8.8, and `node --input-type=module -e "await import('oauth4webapi')"` from the copy exits 0. The live copy is
-163M; `/home` has 30G free (94% used), enough for one more.
-
-## Backups
-
-| Before | Backup | Taken by |
-|---|---|---|
-| W5 | the stopped store, `$DATA/backups/stack/<W5 activation id>/` with SHA256SUMS, DATA_ROOT, SCHEMA 3i, STAMP | `stack-release.sh` (row 185: every activate) |
-| W5 | the rollback set (units, wrapper, pointer) | `stack-release.sh` |
-| W9 | the business file, `cp -p` to `~/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-<stamp>` with its sha256, as evidence nothing wrote it | Sage, in W0b |
-
-## Before the window (nothing stopped)
-
-| # | Who | Step |
-|---|-----|------|
-| P0 | Mos | The `$P` sha check, as in the 177-185 plan P0. |
-| P1 | Sage | The business file, read only, the same values as the 177-185 plan P1. I report its sha256 now rather than assume the 06:15Z value. `business-check.mjs` for OLD now and for NEW after W0: LOAD_OK both. |
-| W0 | Sage | `cd $REPO && scripts/stack-copy.sh copy $NEW`, in a gap between gate-lane runs, since npm ci is heavy. Then the two npm checks above, and `diff <(git -C $REPO show $NEW:package-lock.json) $COPIES/$NEW/package-lock.json` empty. W0 writes only under `copies/` and changes nothing live, so it moves before P2 and P3, which need the copy. |
-| P2 | Sage | `console-check.sh $NEW` against a stub Console of NEW on a scratch port, once without and once with `--tester-port` on a second scratch port. CONSOLE_PASS both. |
-| P3 | Mos | `scripts/stack-release.sh rehearse $NEW mosaic-stack --backup 20261020T192956Z-490e2771d3d0 --port <scratch>`. It must pass every gate check but the PM's. It stops no unit and writes no pointer. Transcript in `$WIN/p3/`. Correction (mos-1107): `rehearse` starts NEW's Console with only `--port` and `--business`, not the pointer's flags. So Mos also starts NEW's Console by hand with the pointer's flags on two scratch ports and reads healthz and `/api/config` on both, then stops it (`$WIN/p3/flags-check.txt`, `flags-console.log`). |
-| P4 | Sage | The tunnel read, as in the 177-185 plan P4. |
-| P5 | Sage | `git -C $REPO diff --quiet $NEW HEAD -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh` and an empty `git status --porcelain` on the same four. Row 190 round 3 touches `webui-service.sh`; if it lands before W5, P5 fails and the window waits for Mos's ruling. |
-| P6 | Sage | The 7332 matrix (a)-(g) on OLD, as in the 177-185 plan, saved as `$WIN/matrix-old.txt`. |
-
-## The window
-
-| # | Who | Step |
-|---|-----|------|
-| W0b | Sage | The business file copy. |
-| W1 | Sage | Idle check (`mosaic agents --business mosaic-stack --tester`, `mosaic launches list`), the start stamp from `date -u`, then S1 `node $SNAP --store "$DATA/bus/bus.sqlite" --held`. |
-| W2 | Sage | `stack-release.sh status mosaic-stack`: pointer on OLD, `pm: true`, 3i, last line ok, unit flags match. |
-| W3 | Sage | `stack-release.sh activate $NEW mosaic-stack --pm --plan`. Must show from OLD to NEW, `migration: none`, the backup line, and the Console line with OLD's flags exactly: no `--send`, no `--sso`, no proof pair, `--tester-port 7333`. Any other difference stops here. |
-| W4 | Sage | The unit reads, as in the 177-185 plan W4. |
-| W5 | Sage, on Mos's go | `stack-release.sh activate $NEW mosaic-stack --pm`. Exit 0, `result ok`, every gate check including `pm_launched`. Record the activation id, the backup path and STAMP, and the backup SHA256SUMS sha256. Then `status`. |
-| W9 | Sage, after Mos verifies W5 | The 177-185 plan's W9 list unchanged, the chief turn and the one `assistant` thread turn included (mos-0929 Q3), plus two lines: the webui journal since the W5 stamp (with `UTC`) has one `Proxy: proxy proof off` and no `Sign-in:` line, and `ls -l /proc/<Console pid>/cwd` names the NEW copy. |
-| W10 | Sage | The browser check on 127.0.0.1:7333 and the matrix again as `$WIN/matrix-new.txt`, identical to `matrix-old.txt`. Then P4 again. Corrections after the window (mos-1135, mos-1137): the matrix line for a file the pin changes isn't "identical". Line (g) serves `index.html`, which row 192 grows by 121 bytes (6470 to 6591), so (g) is 200 non-json at 6575 bytes, not 6454. The two browser checks come from the 177-185 window, before row 192 and before a second thread project. "Only tester forms" now allows `#sign-out` while it is `hidden` and `/api/config` has no `sso: true`. "Chat lists the W9 thread" now reads every `.chat-projects section.panel` list (chat.js:93 renders one per project), not the first. |
-| W11 | Sage | STATE report in `$WIN/STATE.md`, posted on P19 386 and P19 412 and on Gitea #1690. |
-
-## Stop conditions and rollback
-
-The same as the 177-185 plan. Two failures in one window: stop and report (mos-0823).
-
-Rollback: `stack-release.sh rollback mosaic-stack --plan`, then the real run. The previous distinct copy in the
-log is 490e2771d, both are 3i, so no `--restore` and no data loss. OLD takes the same Console flags. The R1 and
-R1post compares are as in the 177-185 plan. A restore past W5 follows that plan's D3 steps, with Mos deciding.
-
-Keep every copy. Prune nothing.
-
-## Questions for the plan check
-
- Q1: NEW is row 192 alone, not bundled with row 190. Row 190 (several instances) changes `stack-release.sh`
-  and `webui-service.sh` and deserves its own window. I recommend running this one first.
- Q2: Sage operates instead of Darkwing, who is on the row 190 gate. OK?
- Q3: W0 before P2 and P3. It writes a copy only. OK?
-
-## What Sage ran for this plan
-
-Read only, 2026-10-20 between 21:36Z and 21:39Z (clock read 21:39:50Z at the commit): `stack-release.sh status mosaic-stack` (pointer, last five log
-lines, unit flags match, 106 commits of drift), `git rev-list --count`, `SCHEMA_VERSION` at both ends, the
-path-limited log, `git diff --stat` on the service scripts, CLI and config loader, `stack-copy.sh:23-56`,
-`webui/src/cli.mjs:15-120`, `docs/TOOLS.md` on `rehearse`, `du -sh` of the live copy and `df -h /home`. Nothing
-live was changed.
@@ -1,3 +0,0 @@
-chief  rbb708846b605  claude-code  since 2026-10-20T19:29:59.053Z
-pm  rc36b17ef3788  claude-code  since 2026-10-20T20:20:56.278Z
-# exit 0
@@ -1,256 +0,0 @@
-{
-  "settings loaded": {
-    "pass": true
-  },
-  "settings": {
-    "banner": "Tester Console. Changes are recorded as tester, never as the human.",
-    "h1": "Settings",
-    "forms": [
-      "sign-out",
-      "conv-form",
-      "routes-form",
-      "instance-add-form",
-      "instance-change-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form"
-    ],
-    "convFormHidden": true,
-    "panels": [
-      "Routing",
-      "Role instances",
-      "Seat names"
-    ],
-    "instancesTable": true,
-    "nameForms": 6,
-    "routesForm": true,
-    "routesSubmitEnabled": true,
-    "forbidden": [],
-    "tokenLimitsPanel": false
-  },
-  "tester banner": {
-    "pass": true,
-    "detail": "Tester Console. Changes are recorded as tester, never as the human."
-  },
-  "instance, routes and name editors present": {
-    "pass": true
-  },
-  "only tester forms (conv-form is index.html:21, global and hidden)": {
-    "pass": false,
-    "detail": [
-      "sign-out",
-      "conv-form",
-      "routes-form",
-      "instance-add-form",
-      "instance-change-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form",
-      "tester-name-form"
-    ]
-  },
-  "no launch settings, assistant, limit reset or send": {
-    "pass": true,
-    "detail": []
-  },
-  "no Token limits panel (plan W10 item 2, amended)": {
-    "pass": true
-  },
-  "board": {
-    "busViewHidden": true,
-    "banner": true,
-    "headings": [
-      "Waiting on you –",
-      "All sessions –"
-    ],
-    "unavailable": false,
-    "length": 179,
-    "forms": [
-      "sign-out",
-      "conv-form"
-    ]
-  },
-  "board reads": {
-    "pass": true,
-    "detail": {
-      "busViewHidden": true,
-      "banner": true,
-      "headings": [
-        "Waiting on you –",
-        "All sessions –"
-      ],
-      "unavailable": false,
-      "length": 179,
-      "forms": [
-        "sign-out",
-        "conv-form"
-      ]
-    }
-  },
-  "chat": {
-    "hash": "#/chat",
-    "banner": true,
-    "threads": [
-      {
-        "href": "#/chat/threads/d0ba7a66-aa3f-4918-9518-94132bce6b28",
-        "name": "w9",
-        "instance": "assistant"
-      }
-    ],
-    "conversationOpen": false,
-    "forms": [
-      "sign-out",
-      "conv-form",
-      "chat-project-form"
-    ]
-  },
-  "chat lists the W9 thread": {
-    "pass": false,
-    "detail": [
-      {
-        "href": "#/chat/threads/d0ba7a66-aa3f-4918-9518-94132bce6b28",
-        "name": "w9",
-        "instance": "assistant"
-      }
-    ]
-  },
-  "W9 thread page not opened": {
-    "pass": true,
-    "detail": "#/chat"
-  },
-  "tester banner on chat": {
-    "pass": true
-  },
-  "requests": [
-    {
-      "method": "GET",
-      "url": "/api/config",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/config",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/messages",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus-status",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/messages",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/settings",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/usage",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/settings",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/usage",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/names",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/names",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/instances",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/instances",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/routes",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/routes",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/limits",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/limits",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/inbox",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/agents",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/messages",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/chat/projects",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/chat/threads",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/business",
-      "refused": false
-    }
-  ],
-  "no write through the listener": {
-    "pass": true,
-    "detail": []
-  },
-  "no request to the W9 thread messages or open": {
-    "pass": true,
-    "detail": []
-  }
-}
-W10 browser: FAIL
-# exit 1
@@ -1,200 +0,0 @@
-{
-  "config": {
-    "sso": null
-  },
-  "forms": [
-    {
-      "id": "sign-out",
-      "hidden": true,
-      "action": "/auth/logout",
-      "method": "post"
-    },
-    {
-      "id": "conv-form",
-      "hidden": true,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "routes-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "instance-add-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "instance-change-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    },
-    {
-      "id": "tester-name-form",
-      "hidden": false,
-      "action": null,
-      "method": null
-    }
-  ],
-  "chat": {
-    "hash": "#/chat",
-    "open": false,
-    "projects": [
-      {
-        "project": "window-20261020-0801",
-        "threads": [
-          "#/chat/threads/d0ba7a66-aa3f-4918-9518-94132bce6b28"
-        ]
-      },
-      {
-        "project": "window-20261020-2205",
-        "threads": [
-          "#/chat/threads/446201de-e8b5-4df3-9356-d0d5422cc899"
-        ]
-      }
-    ]
-  },
-  "requests": [
-    {
-      "method": "GET",
-      "url": "/api/config",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/config",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/messages",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus-status",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/messages",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/settings",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/usage",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/settings",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/usage",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/names",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/names",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/instances",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/instances",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/routes",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/routes",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/limits",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/bus/limits",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/config",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/chat/projects",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/chat/threads",
-      "refused": false
-    },
-    {
-      "method": "GET",
-      "url": "/api/business",
-      "refused": false
-    }
-  ]
-}
-sign-out hidden true, sso null; W9 thread listed true; thread page open false; writes 0
-# exit 0
@@ -1,8 +0,0 @@
-a 200 ok=true
-b 401 error="sign-in required"
-c 401 error="sign-in required"
-d 403 error="proxy Host refused"
-e 403 error="tester listener required"
-f 403 error="proxy header refused"
-g 200 non-json 6575 bytes
-# exit 0
@@ -1,7 +0,0 @@
-# P4 2026-10-20T22:31:29Z
-DropInPaths=
-ExecStart={ path=/home/jwoltje/.local/bin/chisel ; argv[]=/home/jwoltje/.local/bin/chisel client --fingerprint ce+ISFvMAhuoCRDuc7riIf+hYz87TLHk/C9C/H8QsUg= --keepalive 25s --max-retry-interval 10s http://10.1.1.227:8080 R:0.0.0.0:7332:127.0.0.1:7332 ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }
-# exit 0
-# R: specs (1): R:0.0.0.0:7332:127.0.0.1:7332 
-P4 PASS: one R: spec R:0.0.0.0:7332:127.0.0.1:7332, DropInPaths empty
-# exit 0
@@ -1,6 +0,0 @@
-ActiveState=active
-DropInPaths=
-MainPID=2950923
-ExecStart={ path=/home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0/scripts/mosaic ; argv[]=/home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0/scripts/mosaic bus start mosaic-stack --pm ; ignore_errors=no ; start_time=[Tue 2026-10-20 17:02:08 CDT] ; stop_time=[n/a] ; pid=2950923 ; code=(null) ; status=0/0 }
-WorkingDirectory=/home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-# exit 0
@@ -1,12 +0,0 @@
-● jarvis-curation-gate.service                            loaded failed failed Jarvis curation-gate liveness check (wake the agent if staged pulls sit uncurated)
-● jarvis-retro-check.service                              loaded failed failed Jarvis weekly retrospective ARTIFACT check (did Sunday's tick produce a retro?)
-● jarvis-retro.service                                    loaded failed failed Jarvis weekly retrospective tick
-● mosaic-install-drift.service                            loaded failed failed Assert the installed Mosaic binaries still match the committed source (drift, not failure)
-● mosaic-standup-pm.service                               loaded failed failed Coordinator standup trigger (evening)
-● [email protected] loaded failed failed Escalate failed Mosaic unit jarvis-curation-gate.service to the local agent seat
-● [email protected]   loaded failed failed Escalate failed Mosaic unit jarvis-retro-check.service to the local agent seat
-● [email protected]         loaded failed failed Escalate failed Mosaic unit jarvis-retro.service to the local agent seat
-● [email protected] loaded failed failed Escalate failed Mosaic unit mosaic-install-drift.service to the local agent seat
-● [email protected]     loaded failed failed Escalate failed Mosaic unit mosaic-reconcile.service to the local agent seat
-● setspark-tmp-guard.service                              loaded failed failed SetSpark: /tmp and scratch guard
-# exit 0
@@ -1,5 +0,0 @@
-ActiveState=active
-SubState=running
-ActiveEnterTimestamp=Tue 2026-10-13 08:40:19 CDT
-MainPID=1317
-# exit 0
@@ -1,6 +0,0 @@
-ActiveState=active
-DropInPaths=
-MainPID=2950925
-ExecStart={ path=/usr/bin/node ; argv[]=/usr/bin/node /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0/packages/webui/src/cli.mjs serve --checkout /mnt/storage/src/mosaic-stack --port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-port 7333 ; ignore_errors=no ; start_time=[Tue 2026-10-20 17:02:08 CDT] ; stop_time=[n/a] ; pid=2950925 ; code=(null) ; status=0/0 }
-WorkingDirectory=/home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-# exit 0
@@ -1,2 +0,0 @@
-chief  r097436c91816  claude-code  since 2026-10-20T22:02:08.951Z
-# exit 0
@@ -1,7 +0,0 @@
-PASS markdown-preview.js is served and equals the copy's
-PASS /api/config on loopback: send=false edit=false
-PASS project.files through the Console: head=ae0b17c9586e51da7bc1b7e548c6acf913a55665 files=2 spec=true error=none
-PASS project.file spec/north-star.md through the Console: commit=ae0b17c9586e51da7bc1b7e548c6acf913a55665 length=99 error=none
-PASS loopback save refused: HTTP 403 error=read-only sent=false
-CONSOLE_PASS
-# exit 0
@@ -1,19 +0,0 @@
-[
-  {
-    "business": "mosaic-stack",
-    "instance": "chief",
-    "run": "r097436c91816",
-    "launchedBy": "jason",
-    "harness": "claude-code",
-    "model": "claude-opus-5-5",
-    "provider": "anthropic",
-    "modelKey": "opus",
-    "pid": 2951160,
-    "startTime": "63491912",
-    "runnerPid": 2951161,
-    "runnerStartTime": "63491912",
-    "runDir": "/home/jwoltje/.mosaic-dev/launches/mosaic-stack/r097436c91816",
-    "startedAt": "2026-10-20T22:02:08.941Z",
-    "live": true
-  }
-]
@@ -1,2 +0,0 @@
-r097436c91816  mosaic-stack/chief  claude-code claude-opus-5-5  by jason  since 2026-10-20T22:02:08.941Z  running
-# exit 0
@@ -1,2 +0,0 @@
-[]
-# exit 0
@@ -1,2 +0,0 @@
-created project window-20261020-2205  id 77e7b45f-8c34-49a3-b2fa-9cf565177c30
-# exit 0
@@ -1 +0,0 @@
-1792533965
@@ -1,21 +0,0 @@
-pointer: /home/jwoltje/.mosaic-dev/state/stack-active.json
-  {"copy":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","business":"mosaic-stack","pm":true,"claude":"/home/jwoltje/.local/bin/claude","console":["--port","7332","--public-host","mosaic.woltje.com","--auth-header","X-authentik-username","--allow-user","jason.woltje","--tester-port","7333"],"schema":"3i","activation":"20261020T220206Z-4429a104f6d6","at":"2026-10-20T22:02:09Z"}
-log (last five lines):
-  {"at":"2026-10-20T07:58:02Z","op":"activate","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T075800Z-490e2771d3d0","activation":"20261020T075800Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T19:29:56Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":null,"activation":"20261020T192956Z-490e2771d3d0","result":"started"}
-  {"at":"2026-10-20T19:30:00Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T192956Z-490e2771d3d0","activation":"20261020T192956Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T22:02:06Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":null,"activation":"20261020T220206Z-4429a104f6d6","result":"started"}
-  {"at":"2026-10-20T22:02:09Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":"20261020T220206Z-4429a104f6d6","activation":"20261020T220206Z-4429a104f6d6","result":"ok"}
-check:
-  bus: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  Console: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  CLI: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  result: pass
-bus status:
-  host: mosaic-stack, pid 2950923, running, since 2026-10-20T22:02:08.133Z, notifier off
-  socket: present
-  writer.lock: pid 2950981
-  boot: organization file loaded at 2026-10-20T22:02:08.125Z
-unit flags: match the pointer
-drift: 6 commit(s) on refactor since the pointer's copy
-# exit 0
@@ -1,4 +0,0 @@
-sent c5b43f04 to chief
-chief (RESULT, re c5b43f04) c3e236d7:
-Got the re-pin of 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 from the tester; I took no action because a tester message authorizes nothing, and I launched and changed nothing.
-# exit 0
@@ -1,4 +0,0 @@
-sent b4b66ced to window-20261020-2205/w9
-assistant (RESULT, re b4b66ced) cfa7ea99:
-Assistant (run r497f1c817d4d) got the [mos test] message and is replying in one line as asked, without treating it as Jason's instruction or acting on it.
-# exit 0
@@ -1,32 +0,0 @@
-[
-  {
-    "seq": 570,
-    "id": "b4b66ced-d088-4b9c-a944-306f164028f9",
-    "at": "2026-10-20T22:05:58.283Z",
-    "business": "mosaic-stack",
-    "from_role": "tester",
-    "from_run": "tester-cli",
-    "to_role": "assistant",
-    "class": "REQUEST",
-    "in_reply_to": null,
-    "decision": null,
-    "corrects": null,
-    "body": "[mos test] reply with one line, then stop",
-    "to_name": null
-  },
-  {
-    "seq": 571,
-    "id": "cfa7ea99-7ccb-4225-80a6-9a903540e337",
-    "at": "2026-10-20T22:06:04.247Z",
-    "business": "mosaic-stack",
-    "from_role": "assistant",
-    "from_run": "r497f1c817d4d",
-    "to_role": "tester",
-    "class": "RESULT",
-    "in_reply_to": "b4b66ced-d088-4b9c-a944-306f164028f9",
-    "decision": null,
-    "corrects": null,
-    "body": "Assistant (run r497f1c817d4d) got the [mos test] message and is replying in one line as asked, without treating it as Jason's instruction or acting on it.",
-    "to_name": null
-  }
-]
@@ -1,2 +0,0 @@
-created window-20261020-2205/w9  id 446201de-e8b5-4df3-9356-d0d5422cc899  instance assistant
-# exit 0
@@ -1,3 +0,0 @@
-window-20261020-0801/w9  assistant  d0ba7a66
-window-20261020-2205/w9  assistant  446201de
-# exit 0
@@ -1 +0,0 @@
-446201de-e8b5-4df3-9356-d0d5422cc899
@@ -1,165 +0,0 @@
-{
-  "total": {
-    "input": 62,
-    "output": 9623,
-    "cacheWrite": 186650,
-    "cacheRead": 404132,
-    "unknownTurns": 1
-  },
-  "byRun": [
-    {
-      "run": "r8fba7e598156",
-      "input": 0,
-      "output": 0,
-      "cacheWrite": 0,
-      "cacheRead": 0,
-      "unknownTurns": 1
-    },
-    {
-      "run": "r4a96e2142e4d",
-      "input": 2,
-      "output": 52,
-      "cacheWrite": 11750,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc78c9700c8e9",
-      "input": 14,
-      "output": 1519,
-      "cacheWrite": 18187,
-      "cacheRead": 89559,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r293f33bcbc63",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 18595,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r34520a581318",
-      "input": 6,
-      "output": 323,
-      "cacheWrite": 26349,
-      "cacheRead": 14307,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r7e99838f9f93",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 9858,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc964611b2092",
-      "input": 4,
-      "output": 120,
-      "cacheWrite": 26138,
-      "cacheRead": 23870,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rbb708846b605",
-      "input": 12,
-      "output": 2089,
-      "cacheWrite": 17285,
-      "cacheRead": 73823,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc36b17ef3788",
-      "input": 16,
-      "output": 5221,
-      "cacheWrite": 36717,
-      "cacheRead": 202573,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r097436c91816",
-      "input": 2,
-      "output": 131,
-      "cacheWrite": 11915,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r497f1c817d4d",
-      "input": 2,
-      "output": 80,
-      "cacheWrite": 9856,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    }
-  ],
-  "byInstance": [
-    {
-      "instance": "chief",
-      "input": 36,
-      "output": 4114,
-      "cacheWrite": 85486,
-      "cacheRead": 177689,
-      "unknownTurns": 1
-    },
-    {
-      "instance": "coder",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 18595,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "instance": "assistant",
-      "input": 4,
-      "output": 124,
-      "cacheWrite": 19714,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "instance": "pm",
-      "input": 20,
-      "output": 5341,
-      "cacheWrite": 62855,
-      "cacheRead": 226443,
-      "unknownTurns": 0
-    }
-  ],
-  "byProvider": [
-    {
-      "provider": "anthropic",
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ],
-  "byModel": [
-    {
-      "provider": "anthropic",
-      "model": "claude-opus-5-5",
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ],
-  "byAccount": [
-    {
-      "account": null,
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ]
-}
-# exit 0
@@ -1,2 +0,0 @@
-r097436c91816  mosaic-stack/chief  claude-code claude-opus-5-5  by jason  since 2026-10-20T22:02:08.941Z  running
-# exit 0
@@ -1,19 +0,0 @@
-[
-  {
-    "business": "mosaic-stack",
-    "instance": "chief",
-    "run": "r097436c91816",
-    "launchedBy": "jason",
-    "harness": "claude-code",
-    "model": "claude-opus-5-5",
-    "provider": "anthropic",
-    "modelKey": "opus",
-    "pid": 2951160,
-    "startTime": "63491912",
-    "runnerPid": 2951161,
-    "runnerStartTime": "63491912",
-    "runDir": "/home/jwoltje/.mosaic-dev/launches/mosaic-stack/r097436c91816",
-    "startedAt": "2026-10-20T22:02:08.941Z",
-    "live": true
-  }
-]
@@ -1,153 +0,0 @@
-{
-  "schema": "3i",
-  "tables": {
-    "decision_events": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "28dd95056663dd5eb7442a3d815b73a4a3cd311a0e854fd82dc54f7dc3e6ef26"
-    },
-    "decisions": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "fef1058660b0d128ef21089dda5e0fba7f71763d8325148fe521de0d3f57e4ad"
-    },
-    "deliveries": {
-      "rows": 1726,
-      "maxSeq": 1726,
-      "sha256": "8667571f4a05ce3621b04cf2dc5eb0311bac3d3aff1858584c78445c5c4c2fb4"
-    },
-    "events": {
-      "rows": 1525,
-      "maxSeq": 1525,
-      "sha256": "e51827e31f2fa5a9a50993e5a10f37f1dee383b7d673f793006bd2ba1e9a5573"
-    },
-    "instance_names": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "message_threads": {
-      "rows": 2,
-      "maxSeq": null
-    },
-    "messages": {
-      "rows": 567,
-      "maxSeq": 567
-    },
-    "meta": {
-      "rows": 3,
-      "maxSeq": null,
-      "sha256": "89fec56e7293d19e0b2f6cd8c0ef745ebf99e4115abeaea7fbdbc98a261332d9"
-    },
-    "projects": {
-      "rows": 1,
-      "maxSeq": 1,
-      "sha256": "a3945f7462895e0e302029c542d384a6d33e559da900e6461d78bbcd7cc28b16"
-    },
-    "role_claims": {
-      "rows": 98,
-      "maxSeq": 98,
-      "sha256": "ac6694fd0b365469f7486ae1f31486cd52b31be7bc0399938b7361f22454362e"
-    },
-    "task_comment_cursors": {
-      "rows": 215,
-      "maxSeq": 215,
-      "sha256": "7f80df8efb90b502a9530a7ed5068d59be59b2eb318aa4e64ce6bf481762a5e9"
-    },
-    "task_snapshots": {
-      "rows": 401,
-      "maxSeq": 401,
-      "sha256": "cced8c7f90ecaa60eee3010d987013d8c0301563cb888860fd91b8c5a02f0a00"
-    },
-    "thread_claims": {
-      "rows": 2,
-      "maxSeq": 2,
-      "sha256": "6046c7088779aa2f6e9b3fd2c7520404b1678a4fcae71c2b9157a008bba22a5f"
-    },
-    "thread_opens": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "threads": {
-      "rows": 1,
-      "maxSeq": 1,
-      "sha256": "3043721efd386f23dfdaad4acf41e0d553ff6182f0068c2133a615141bcf772a"
-    },
-    "usage_records": {
-      "rows": 30,
-      "maxSeq": 30,
-      "sha256": "7ecbc0606273043b017d778bb23880377bfe367f788d234289b7c132caa588f2",
-      "byRun": [
-        {
-          "business": "mosaic-stack",
-          "run": "r8fba7e598156",
-          "input": "0",
-          "output": "0",
-          "unknownTurns": 1
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r4a96e2142e4d",
-          "input": "2",
-          "output": "52",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc78c9700c8e9",
-          "input": "14",
-          "output": "1519",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r293f33bcbc63",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r34520a581318",
-          "input": "6",
-          "output": "323",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r7e99838f9f93",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc964611b2092",
-          "input": "4",
-          "output": "120",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rbb708846b605",
-          "input": "12",
-          "output": "2089",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc36b17ef3788",
-          "input": "16",
-          "output": "5221",
-          "unknownTurns": 0
-        }
-      ]
-    }
-  },
-  "untimed": [
-    "message_threads",
-    "meta",
-    "task_comment_cursors"
-  ]
-}
@@ -1,167 +0,0 @@
-{
-  "schema": "3i",
-  "tables": {
-    "decision_events": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "28dd95056663dd5eb7442a3d815b73a4a3cd311a0e854fd82dc54f7dc3e6ef26"
-    },
-    "decisions": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "fef1058660b0d128ef21089dda5e0fba7f71763d8325148fe521de0d3f57e4ad"
-    },
-    "deliveries": {
-      "rows": 1740,
-      "maxSeq": 1740,
-      "sha256": "554ce5b377ffacc72bfde11c99c920cd5d30337c8bfa217275d0073b587e2169"
-    },
-    "events": {
-      "rows": 1543,
-      "maxSeq": 1543,
-      "sha256": "0151673193d0286ce8f3b234d7d21fa2b0f43f2ceec55644cccaa5cbd77603dd"
-    },
-    "instance_names": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "message_threads": {
-      "rows": 4,
-      "maxSeq": null
-    },
-    "messages": {
-      "rows": 571,
-      "maxSeq": 571
-    },
-    "meta": {
-      "rows": 3,
-      "maxSeq": null,
-      "sha256": "89fec56e7293d19e0b2f6cd8c0ef745ebf99e4115abeaea7fbdbc98a261332d9"
-    },
-    "projects": {
-      "rows": 2,
-      "maxSeq": 2,
-      "sha256": "3435f574ab94bc2fcc65fb8605251f30d4e9e63baf38e6fdf3c39c126531aa63"
-    },
-    "role_claims": {
-      "rows": 101,
-      "maxSeq": 101,
-      "sha256": "fb47114defbb8a57dd148a06fbaf61b30f791a81f14b1510b8c32690506b4308"
-    },
-    "task_comment_cursors": {
-      "rows": 220,
-      "maxSeq": 220,
-      "sha256": "df03c84094999299499de01107ddd08636df6156f5c9ccd2ff6e8c43e459f7e4"
-    },
-    "task_snapshots": {
-      "rows": 408,
-      "maxSeq": 408,
-      "sha256": "e2243a89388afba07e8d096b4961deeb2d17c656cdcace54b46eac7001393814"
-    },
-    "thread_claims": {
-      "rows": 4,
-      "maxSeq": 4,
-      "sha256": "088b8236570d8afe03364b85803fdc5034cce2cef6ed7b16f8b99bf6366524ad"
-    },
-    "thread_opens": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "threads": {
-      "rows": 2,
-      "maxSeq": 2,
-      "sha256": "819fd24c64e279d0debad5ab5dbbe533d8e6f26de58277c69510b9cbbaadbc3a"
-    },
-    "usage_records": {
-      "rows": 34,
-      "maxSeq": 34,
-      "sha256": "de614f3d62c9b3819757c5659bee40085cb86cc873b7bfe381b13e254ddb7cad",
-      "byRun": [
-        {
-          "business": "mosaic-stack",
-          "run": "r8fba7e598156",
-          "input": "0",
-          "output": "0",
-          "unknownTurns": 1
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r4a96e2142e4d",
-          "input": "2",
-          "output": "52",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc78c9700c8e9",
-          "input": "14",
-          "output": "1519",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r293f33bcbc63",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r34520a581318",
-          "input": "6",
-          "output": "323",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r7e99838f9f93",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc964611b2092",
-          "input": "4",
-          "output": "120",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rbb708846b605",
-          "input": "12",
-          "output": "2089",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc36b17ef3788",
-          "input": "16",
-          "output": "5221",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r097436c91816",
-          "input": "2",
-          "output": "131",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r497f1c817d4d",
-          "input": "2",
-          "output": "80",
-          "unknownTurns": 0
-        }
-      ]
-    }
-  },
-  "untimed": [
-    "message_threads",
-    "meta",
-    "task_comment_cursors"
-  ]
-}
@@ -1,193 +0,0 @@
-# Re-pin window 490e2771d to 4429a104f (row 192, Q175 phase 1), STATE report (W11)
-
-Operator and tester: Sage. Plan: `agents/sage/work/window-plan/repin-4429a104f.md` at f41729178, sha256
-e1272d1a391e00fb1291d47da9973c0ba342d65fcd42f583ea007e883c1f32b9 (checked before W0b, W9). The plan file in
-this commit carries three corrections made after the window. They are listed at the end, so its sha256 differs
-now. Tool blob 3b068b1546d4 (`scripts/stack-release.sh`). OLD 490e2771d3d057ab76991e2c7859cd251857e64c, NEW
-4429a104f6d65ccf165f6c83b5d1dce3147dfde0. Every stamp below comes from `date -u` or from the transcript `W.txt`
-in this directory. Mos's gos: mos-1113 (W5), mos-1114 (W9 to W11), mos-1128 (W9b accepted), mos-1135 (W10
-browser part), mos-1137 (line g, post W11).
-
-## Outcome
-
-NEW is live for mosaic-stack with its PM, and the store stays on 3i. Row 192's sign-in code is in the copy but
-dormant, because the Console runs without `--sso`. W0 to W10 passed, and nothing was rolled back. W10 stopped
-once on two failed browser checks. I diagnosed both read-only as checks written before row 192, not faults in
-NEW, and Mos passed them (mos-1135). Matrix line (g) isn't byte-identical, for a known cause, and Mos passed it
-(mos-1137). Nobody acted as Jason. There was no `--by jason`, no pi, no Save and no `mosaic name`, and
-`bus.tester` was not touched.
-
-## Stamps and activation
-
-| Step | Start (UTC) | Result |
-| --- | --- | --- |
-| P1 values, business-check OLD | file written 21:43:13Z | values as planned, LOAD_OK (`p1.txt`) |
-| W0 copy NEW with npm ci, business-check NEW | 21:45:57Z | copied, lockfile diff empty, LOAD_OK (`w0.txt`) |
-| P2 console-check on a stub of NEW | 21:46:09Z | CONSOLE_PASS without and with `--tester-port` (`p2.txt`) |
-| P3 rehearsal (Mos) | 21:52:31Z to 21:52:34Z | REHEARSAL_PASS, rc 0 (`p3/`) |
-| P3 flags check (Mos) | 21:53:52Z to 21:53:56Z | NEW Console with the pointer flags on 7341/7342: healthz 200 both, then gone, 0 listeners |
-| P4, P5, P6 | 22:00:17Z | P4 PASS, P5 PASS (HEAD 4385b9ec1), `matrix-old.txt` |
-| W0b business file copy | 22:00:49Z | sha256 1e49bdf0 |
-| W1 idle check, S1 | 22:00:49.758Z | chief idle; S1 a7649760 |
-| W2 status | 22:00:49.819Z | pointer OLD, pm true, 3i, unit flags match |
-| W3 plan | 22:00:50.068Z | exit 0 (`W3-plan.txt` 45de68d4) |
-| W4 unit read | 22:00:50.238Z | OLD units, no drop-ins, bus `--pm`, no quote or backslash |
-| W5 activate (mos-1113) | 22:02:06.776Z, end 22:02:09.556Z | exit 0, gate passed, activate ok |
-| W5 status | 22:02:13.885Z | pointer NEW, pm true, 3i, unit flags match |
-| W9 checks and turns (mos-1114) | 22:05:51Z to 22:06:06Z | pass |
-| W9b run end and S2 | 22:21:05.171Z, S2 22:21:07Z | ended by the launcher (thread-idle); S2 1a444f5a |
-| W10 browser (stop), diagnosis | 22:29:14Z, 22:30:02Z | 10 of 12, then both failures traced to the checks |
-| W10 matrix, P4 (mos-1135) | 22:31:29Z | a-f identical, g +121 bytes; P4 PASS |
-| W11 reads | 22:44:33Z to 22:44:34Z | units, tunnel, business file, failed units |
-
-Activation id 20261020T220206Z-4429a104f6d6. Pointer `at` 2026-10-20T22:02:09Z.
-
-## Backups and hashes
-
- Store backup: `~/.mosaic-dev/backups/stack/20261020T220206Z-4429a104f6d6`, SHA256SUMS sha256
-  b61d64843c9e2a153842606353450838da9cb778c8f3b9c27cc9366dd72ec0c9.
- Rollback set: `~/.mosaic-dev/state/stack-rollback/20261020T220206Z-4429a104f6d6`. Rollback goes to 490e2771d.
- Business file: 1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93 at P1, at W0b and again at
-  W11. The W0b copy is `~/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-20261020T220049Z` with the
-  same hash. Nothing in the window wrote it. `backups.txt` holds the W0b and W5 lines.
-
-## Pointer before and after
-
-Before (W2): copy 490e2771d3d0, pm true, schema 3i, activation 20261020T192956Z-490e2771d3d0. Console flags
-`--port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje
--tester-port 7333`.
-
-After (W5, W9 and W11): copy 4429a104f6d6, pm true, schema 3i, activation 20261020T220206Z-4429a104f6d6. The
-Console flags are the same, with no `--send`, no `--sso` and no proof pair. Bus pid 2950923 and Console pid
-2950925, both since 22:02:08Z. Status shows drift of 6 commits on refactor since the pointer's copy (records).
-
-## Unit ExecStart lines (no Environment values)
-
-W11, after. Both units active, DropInPaths empty, WorkingDirectory the NEW copy:
-
-```
-bus:   ~/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0/scripts/mosaic bus start mosaic-stack --pm   (MainPID 2950923)
-webui: /usr/bin/node ~/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0/packages/webui/src/cli.mjs serve --checkout /mnt/storage/src/mosaic-stack --port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-port 7333   (MainPID 2950925)
-```
-
-W4 read the same two lines on OLD's copy (W.txt 329-344). The bus Environment has 2 assignments with no quote or
-backslash. The values are not recorded. The Console's cwd is the NEW copy (W9). The webui journal since W5 has one
-"Proxy: proxy proof off" line and no "Sign-in:" line.
-
-Tunnel: `mosaic-preview-tunnel.service` active, running, MainPID 1317, since 2026-10-13 08:40:19 CDT. The window
-didn't touch it. P4 before and after shows one R: spec, `R:0.0.0.0:7332:127.0.0.1:7332`.
-
-## S1, S2 and the store
-
-S1 (`S1.json`, sha256 a7649760c3439705c8b5f3af26d0c21aea1081c1eb295fd02aef3a642064194b) is W1's held read at
-22:00:49Z. S2 (`agents/sage/work/window-repin-4429a104f/S2.json`, sha256
-1a444f5ac0049bc78e397b6928e1008cfe8cbc30989bbf2042b4ed27f56a4173) is the held read after the assistant run
-ended, at 22:21:07Z. Both are 3i. SNAP (`snapshot.mjs`, 639fd28a) was checked before each.
-
-| Table | S1 rows | S2 rows | S2 vs S1 |
-| --- | --- | --- | --- |
-| decisions, decision_events | 21, 21 | 21, 21 | same sha256 |
-| meta, instance_names, thread_opens | 3, 0, 0 | 3, 0, 0 | same sha256 |
-| deliveries | 1726 | 1740 | +14 |
-| events | 1525 | 1543 | +18 |
-| role_claims | 98 | 101 | +3 |
-| messages | 567 | 571 | +4 (counts only) |
-| message_threads | 2 | 4 | +2 (counts only) |
-| usage_records | 30 | 34 | +4 |
-| projects, threads, thread_claims | 1, 1, 2 | 2, 2, 4 | +1, +1, +2 |
-| task_snapshots | 401 | 408 | +7 |
-| task_comment_cursors | 215 | 220 | +5 |
-
-For every grown table with a seq, maxSeq grew by exactly the row delta.
-
-The task_snapshots and task_comment_cursors rows (mos-1128 item 2). The writer is the bus's own Vikunja poll, not
-an agent. `packages/bus/src/process.mjs:104` loads the tasks adapter. Its timer runs `tick` every `pollSeconds`
-(`packages/tasks/src/adapter.mjs:192-197`), and `sync.mjs:169` calls `broker.recordTask` with no cap
-(`packages/bus/src/broker.mjs:1123`). That writes `source 'poll'` with role and run null (`broker.mjs:1159-1174`)
-and the comment cursors (`:1131-1138`). The adapter logs only on an error (`adapter.mjs:115`), so the bus journal
-has no line for a good tick. That's why there's no sync line between 22:05Z and 22:22Z. The rows, read
-read-only after the window:
-
- task_snapshots 402-404 at 22:05:08Z: P19 436, 435 and 434, all updated 22:04:55-56Z. 405-406 at 22:12:38Z: 438
-  and 437. 407 at 22:17:08Z: 438 again. 408 at 22:19:08Z: 431. All have `source poll`, `via cursor`, role null
-  and run null. These are tracker edits made by seats during the window, which the poll picked up.
- task_comment_cursors 216-220: tasks 424, 432, 438, 431 and 436, last comments 397 to 401. These are the
-  comments seats posted on P19 in the same minutes (398 is Mos's comment on #432).
-
-Rows after S2 (task_snapshots 409 at 22:33Z, cursors 221-223) are the same poll and are outside the window.
-
-## W9 output
-
- Status, console-check (CONSOLE_PASS), the journal counts, the Console cwd and one running chief from this
-  start (r097436c91816) all passed.
- `talk chief --tester` (c5b43f04): the chief replied that a tester message authorizes nothing and it took no
-  action.
- Project `window-20261020-2205`, thread 446201de-e8b5-4df3-9356-d0d5422cc899. `talk --thread` (b4b66ced) got one
-  assistant reply from run r497f1c817d4d. `thread read` shows the tester REQUEST and the assistant RESULT.
- `threads`, `names` (empty) and `usage` read fine. The human-thread probe was skipped: S1's one thread is the
-  177-185 window's tester thread d0ba7a66, so no human thread exists.
- W9b: the launcher logged launch at 22:06:00.766Z, thread-idle at 22:21:05.149Z and end at 22:21:05.171Z
-  (reason stopped, exit 0). Nobody stopped it by hand.
-
-## W10
-
-The browser check (`w10-browser.mjs`, dda57ccf) ran against 127.0.0.1:7333 with fetch and XHR limited to GET and
-HEAD. It made no writes and sent no W9 thread request. 10 of 12 checks passed. The two that failed:
-
-1. "Only tester forms": `#sign-out` was in the list. It is row 192's form at `packages/webui/src/public/index.html:12`,
-   `hidden`. `app.js:479` shows it only when `/api/config` has `sso: true`. The live config has no `sso`
-   key, and the form stayed hidden.
-2. "Chat lists the W9 thread": the check read only the first `ul.chat-thread-list`. `chat.js:93` renders one list
-   per project, and W9 made the second project. The diagnosis (`w10-diag.mjs`, 42d0844b) read every panel and
-   found 446201de listed.
-
-Both checks come from the 177-185 window (Darkwing's `window-rows-177-185/w10-browser.mjs`), written before row
-192 and before a second thread project existed. Corrected, they now read:
-
- Only tester forms, allowing `#sign-out` when it is `hidden` and `/api/config` has no `sso: true`.
- The W9 thread is in some `.chat-projects section.panel` thread list, not only the first.
-
-Both corrections are in the plan's W10 line, for the next window that copies this one.
-
-The matrix (`matrix-new.txt` against `matrix-old.txt`). Lines a to f are byte-identical. Line g is 200 non-json
-both times, but 6454 bytes on OLD and 6575 on NEW. `index.html` is 6470 bytes at 490e2771d and 6591 at 4429a104f,
-+121, and the only hunk is the line 12 form. The served page grew by the same 121. The plan's W10 line now says a
-line for a file the pin changes isn't "identical", with this case as its example. P4 again at 22:31:29Z: PASS.
-
-## Failed user units (mos-1128 item 3)
-
-All three predate the re-pin at 22:02Z and come from the legacy `~/.mosaic` and jarvis-brain setup, not the
-stack. P19 #393, "dragon-lin: seven legacy user units in failed state", covers all three (filed by Mos on
-10-20 at about 01:42Z). It has no comments yet. The current failure times are later than the ones #393 lists,
-so I added a comment with them. Times are from `systemctl --user show` (CDT) with UTC alongside.
-
-| Unit | Runs | Failed | #393 |
-| --- | --- | --- | --- |
-| mosaic-standup-pm.service | `~/.mosaic/tools/coordinator/standup_trigger.py pm` | 2026-10-19 19:00:28 CDT (10-20 00:00:28Z), exit 1 | listed |
-| mosaic-install-drift.service | `~/src/jarvis-brain/scripts/alerting/mosaic-install-drift` | 2026-10-20 00:12:54 CDT (05:12:54Z), exit 9 | listed, with an older time |
-| mosaic-unit-failed@mosaic-reconcile.service | `~/.local/bin/mosaic-unit-failed mosaic-reconcile.service` | 2026-10-20 13:16:12 CDT (18:16:12Z), exit 4 | listed, with an older time |
-
-The marker's journal at 18:16:12Z says the escalation's tmux send to jarvis failed ("tmux target not found",
-socket mosaic-fleet), so the page wasn't delivered. The record is on disk in
-`~/.local/state/mosaic-unit-failures/20261020.jsonl`. `mosaic-reconcile.service` failed at that time (exit 7)
-but last ran OK at 17:16:27 CDT (22:16:27Z). The marker stays failed until something resets it. The journal no
-longer has lines for the other two units. The window changed none of these units, and touching them is
-outside it (`~/.mosaic` is off limits, and #393 needs Jason or ops-01's charter to disable any). W11's list also
-shows `setspark-tmp-guard.service` failed. It belongs to another project, and I've left it.
-
-## Corrections to the plan, made after the window
-
- NEW is 103 commits past OLD (`git rev-list --count 490e2771d..4429a104f`), not 106. The 106 in `status` was OLD
-  to HEAD 305857c8f, so it also counted the three record commits.
- P3: `rehearse` starts NEW's Console with only `--port` and `--business`, not the pointer's flags. Mos's
-  separate flags check covers that (`p3/flags-check.txt`, `p3/flags-console.log`). The line was wrong as
-  written (mos-1107).
- W10: the matrix line g size change and the two corrected browser checks, as above.
-
-## Files
-
-`W.txt` (transcript), `S1.json`, `S2.json`, `matrix-old.txt`, `matrix-new.txt`, `backups.txt`, `W3-plan.txt`,
-`W5.txt`, `W5-status.txt`, `w0.txt`, `p1.txt`, `p2.txt`, `p3/` (Mos's rehearsal and flags check), `p456.sh`,
-`w9.sh`, `w9b.sh`, `w9.out`, `w9b.out`, `w10-browser.mjs`, `w10-diag.mjs` with their outputs (the three
-screenshots stay on disk in this directory, uncommitted, since the push check refuses binaries),
-and the `.w9*`, `.w10*` and `.w11*` reads. The store snapshot tool is `snapshot.mjs` (639fd28a).
@@ -1,116 +0,0 @@
-plan: activate for mosaic-stack
-from: 490e2771d3d057ab76991e2c7859cd251857e64c
-to: 4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-store schema: 3i (read from the store the running bus holds)
-target schema: 3i
-migration: none; the store is at the target's version
-backup: the run backs up the stopped store to /home/jwoltje/.mosaic-dev/backups/stack/<activation>/ before any migration
-commits: the run adds 103 (newest first, at most 200):
-  4429a104f webui: Q175 phase 1, the Console verifies SSO itself under --sso, OIDC RP with oauth4webapi 3.8.8 (row 192, #1690)
-  32b54ac3b plans: Case 2 row briefs from Gosalyn's 51006710a (webby-0034 N1/N2 and webby-0035: row A README :711 one line per variable, C2-13 owns README :713 and says the precheck prints only variable names)
-  6025ddd9c plans: Case 2 row briefs from Gosalyn's a2d94b2c2 (Webby r9 notes, webby-0032: row A README line on claude-session.env and the dist/providers/data/zai.json path, C2-13 XDG_DATA_HOME precheck and last-assignment-wins key file parse)
-  ecbfd6deb plans: Case 2 row briefs from Gosalyn's 29e85196b (design r9 for mos-1090: row A out of scope points at design 10 step 2d, C2-13 precheck checks the hub key file by name and mode, claude marker check only for claude-code harness, EnvironmentFile= fixed in case2-unit.sh)
-  0498c0613 agents: Gosalyn seat dir, README from gosalyn/case2-design, so Case 2 rows can name the seat as owner (#416)
-  49d1f3a23 plans: Case 2 slice row briefs plus rows A and B, from Gosalyn's f325657c7 on gosalyn/case2-design (#416, design r8, C2-13 copy id and profile asks for row 195, C2-20 count-only note, row A ZAI_API_KEY per mos-1086/mos-1089, row B #428 after 10-27)
-  628e2ca5c sessions: Filbert row 190 manifest round 1 CHANGES (base drift on row 189)
-  088087ac9 queue: revs 2248-2361+. Sage: rows 210 (#424 host access, Gizmoduck) and 211 (#426 force-push guard, Rocko) added and briefed; row 195 re-briefed to the Case 1 install on .53; review requests for 200 r1/r2 and 202; plus earlier Sage revs. Other seats' revs: Launchpad 2254, 2283-2284, 2286, 2311-2313, 2328-2329, 2344, 2347-2348 (rows 192/200); Honker 2255; Morgana 2257, 2320, 2326-2327 (row 204); Gander 2262; Herb 2265; Dewey 2268; Bushroot 2273; Megavolt 2276; Webby 2303, 2316, 2339, 2355 (row 192/200 verdicts); Gizmoduck 2304, 2318-2319 and the row 210 claim (rows 201/210); Quackerjack 2317, 2341-2342 (row 202); Duckworth 2323, 2335, 2353 (rows 201/204/202 verdicts); Darkwing 2354, 2357 (row 190 in-review)
-  a0fbefd48 plans: pre-push force-push hook and failing busy check brief (Vikunja #426, mos-1078, mos-1083; owner Rocko, reviewer Dewey)
-  f24f2cd40 plans: row 195 brief becomes the Case 1 install on 10.1.1.53 (Q181 hosts, Q182/Q183 recorded acceptance, Q185 existing account, chained on rows 190 and C2-13; ops-01 root steps under #423 step 1; sage-1439)
-  9ba31b5b3 agents: Honker's PRD 1.7 draft r2 on refactor for the prd.approve raise (11cb0423b, sha256 e896746df595d1b5155130ca163fbf63b0dc38a87a8dd154af77f1a6d1328647, Duckworth approved duckworth-0039, Vikunja #420)
-  9db578ff5 plans: agent host access with sudo through the credential store brief (#1707, Vikunja #424, Q183/Q184, chained on row 199)
-  8eb9ddd12 plans: FED R8 brief to r4.11 (b93f098f0, recorded acceptance, Duckworth N1/N2, #416 date), R5 context source (sage-1419), 193a makes covers level required (duckworth-0033 N1)
-  ae3c36f24 agents: Gizmoduck seat dir and roster row (FED R1 owner, #414)
-  a2af7ab49 plans: FED R1, R5, R2 and R8 briefs (#414, r4.9 a1daa3c07) and row 193a-d build briefs (#1691); Quackerjack seat dir and roster row
-  aa1bd209e gate-lane: row 189 gate timing table for row 197 (Herb)
-  ace27dc5e row 189 (#1687): stack-release.sh activate --no-send drops the Console's --send (Sage; Dewey approve 29485; Sage gate passed)
-  a4a42dbac plans: stack-release --sso brief (#1698, Launchpad, reviewer Webby, row 192 F3; chained on 192)
-  a31f1a0f8 plans: row 198 brief records Mos's call, in-process board reads behind the Console's auth (mos-1019)
-  992650232 plans: agent credentials and git identity brief (MVP T1 item 6, #1697, Megavolt, reviewer Duckworth); Megavolt seat dir
-  a7661ada0 plans: row 195 acceptance script takes Gizmoduck's gate item list; B8 issuer and TLS front end (mos-1011)
-  f871cb309 plans: retire the control board writer on 7331 brief (#1696, Bushroot, reviewer Webby, mos-1008 item 2); Bushroot seat dir
-  0bbd23c61 plans: row 195 brief adds the identity provider check and flags any new model account for Jason (mos-1008)
-  0217b71c8 plans: row 195 brief rewritten as the hub on its own host, host left to Jason (#1693, mos-0998, mos-1005)
-  c6f528a32 plans: second gate lane brief (#1695, Herb, reviewer Webby, mos-0977 item 6); Herb seat dir; gate template and busy check copies for the row
-  96f243faf plans: human boundary row brief (P19 333, #1694, Gander, reviewer Duckworth, mos-0989); Gander seat dir; seat READMEs name the credentials row, not row 195 (now 190b)
-  c86269935 sessions: Filbert row 190 design review r3, approved
-  48ebee0ff plans: row 190 brief scopes isolation to addressing on one uid, points to row 190b (Filbert N7, mos-0986)
-  66bdd84b8 sessions: Filbert row 190 design review r2, changes requested
-  6966164f0 plans: row 190b brief, Melanie's hub under its own Linux user (#1693, Darkwing, reviewer Duckworth), mos-0986
-  53bb59462 sage: common start for MVP T1 builder seats (mos-0974, mos-0977, mos-0981)
-  5e01c3683 agents: seat dirs and roster rows for Launchpad, Morgana, Honker (Sage's T1 builders) and Webby, Duckworth (Mos's reviewers); row 193 brief takes Mos's B1 starting rule (mos-0985)
-  9f56d2098 plans: rows 192 and 194 review by Webby, not Filbert or Dewey (mos-0981)
-  0599b119f plans: MVP T1 briefs, SSO phase 1 (#1690, Launchpad), human users (#1691, Morgana), agent lifecycle (#1692, Honker), mos-0974/0977
-  b416d2ede sage: Q175 SSO design, Mos C1 condition (mos-0977): straggler check before Jason step 4 in the phase 2 window
-  5fc73a729 revs 2237-2247: row 189 added, briefed, started, in-review round 1 (Dewey, comment 29457); rows 190 (Darkwing) and 191 (Rocko) added and briefed for MVP T1 (mos-0974); darkwing-190-start (rev 2245, Darkwing's) and rocko-191-start (rev 2244, made for Rocko)
-  99772421a sage: row 189 candidate manifest for Dewey's review (d6116771f)
-  da230ca48 plans: MVP T1 briefs, several instances per host (#1688, Darkwing) and the kill switch (#1689, Rocko), mos-0974
-  4f2d1be68 sessions: Filbert Q175 SSO design D1/D2 ack
-  d55d86bb0 sage: Q175 SSO design r3 fix, Filbert r3 D1 (loader checks slot shape only) and D2 (slot from config dir, scratch Console dataRoot and unreachable issuer)
-  c56ccf916 sessions: Filbert Q175 SSO design review r3, approve with D1
-  817e8f51b sage: Q175 SSO design r3 for #412, Filbert r2 C1 (shared loader, config.json inside the phase 2 window, rollback order, test 25) and C2 (401 signed-out page, test 24), notes and Q-E
-  5d019d876 sessions: Filbert Q175 SSO design review r2, changes
-  59475fc5a sage: row 163 landing record, P19 comments 372/373 on 337/412, and P19 #413 filed for the --no-send row
-  1a268249e sage: Q175 SSO design r2 for #412, Filbert r1 B1-B6, rulings Q-B/Q-C/Q-D, config in config.json (mos-0973)
-  def2e7932 plans: brief for stack-release activate --no-send (Q175 interim, mos-0972/0973, #1687, P19 413)
-  c30b36fff sessions: Filbert Q175 SSO design review r1, changes
-  9ae8c73ac queue: revs 2235-2236: row 163 Sage landing note (8ecc7a239, patch-id b8d5f8a37c24, gate passed on eaa0f2666) and done
-  8ecc7a239 row 163 (#1660): stack-release.sh rehearse, the D2 rehearsal on a scratch root from a backup, and bus start --no-launch (Sage; Filbert approve 29447; Sage gate passed)
-  7f57419b3 sage: Q175 SSO design for #412, OIDC relying party on oauth4webapi 3.8.8, for Filbert review (mos-0970, mos-0971)
-  4ca8d6e94 sage: row 42 run log, S7 reachability pass (51cebff7 answered by cff1e9ad after a chief launch, mos-0969)
-  22e5e825b sage: row 42 run log, plain mosaic on a pinned host supersedes the 10-12 full-path line (mos-0968)
-  e6dea74b2 sessions: Sage row 163 r2 approval intake; P19 337 comment 368 script and record
-  cd2b377bb queue: rev 2234: row 163 r2 approve from Filbert (op filbert-163-r2, comment 29447, candidate c6f4f4c12596)
-  ceccb0ef2 sessions: Filbert row 163 r2 review, approve
-  10ab8ea62 sessions: Sage row 163 r2 in-review; P19 337 comment 367 script and record
-  c539995cf queue: revs 2231-2233: row 163 r2 in-review from Sage (ops sage-163-r2-start, sage-163-inreview-2, .outcome; request comment 29446, reviewer Filbert, manifest c6f4f4c12596)
-  92cc6011c queue: rev 2230: row 163 r1 changes from Filbert (op filbert-163-r1, comment 29445, candidate 430212299beb)
-  7af166574 sage: row 163 r2 packet (candidate 2c090eefd on code 2a5f3a3a0, base 4f02486d5: diff, manifest c6f4f4c12596, gate passed, mutants K34-K41 killed)
-  2244e8baf sessions: Filbert row 163 r1 review, changes
-  bde0fdec9 sessions: Sage row 163 r1 in-review; P19 337 comment 366 script and record
-  def677bc7 queue: revs 2228-2229: row 163 r1 in-review from Sage (ops sage-163-inreview-1, .outcome; request comment 29444, reviewer Filbert, manifest 430212299beb)
-  51f67f1f8 sage: row 163 packet (candidate 4be3f6aec on 580500699: diff, manifest 430212299beb, gate passed, mutants K1-K33 killed after four survivors got tests)
-  5b298bd00 sessions: Dewey row 66 r1 (changes) and r2 (approve) reviews
-  565bc32c2 queue: revs 2223-2227: row 66 r2 round from Sage (2223-2225, ops sage-r66-r2-start, sage-r66-inreview-2); r2 verdicts from Filbert (2226, op filbert-66-r2, approve) and Dewey (2227, op dewey-66-r2, approve)
-  5140aa9e8 sessions: Filbert row 66 r2 review, approve
-  973cb5a87 queue: revs 2220-2222: row 163 Sage start (2220); row 66 r1 verdicts from Filbert (2221, op filbert-66-r1) and Dewey (2222, op dewey-66-r1)
-  b82ec9353 sage: row 66 r2 packet (candidate 0f4a57956: diff, manifest cee63e06fdea, gate, mutants K1-K4 killed, singles rerun)
-  3560c450a sessions: Filbert row 66 r1 review, changes
-  4f02486d5 sage: row 66 r1 packet (candidate 8ec03b45a: diff, manifest e68c6bce5ec4, gate r2), row 42 run log (trigger (a), mos-0960), SESSIONS line
-  263ea8a9a queue: revs 2215-2219: row 66 Sage start (2215), in-review round 1 on candidate manifest e68c6bce5ec4 (8ec03b45a) and request comment 29437 (2216-2217); row 163 brief re-pinned to b1500d96ad27 (6020bb43a) and briefed (2218-2219)
-  6020bb43a plans: D2 brief owner is sage (row 163, #1660), and D2 lands after the Part B window (mos-0958, mos-0959)
-  5487ed39d sage: row 188 landing record: P19 411 (N1) and comments 361-363 script and record, 409/410 description restore after a partial done update, SESSIONS line
-  31e328958 queue: revs 2209-2214: row 188 Darkwing start, in-review and request 29432 (2209-2211); Filbert approve 29433 (2212); Sage landing note (8fc0ee216, patch-id c9a56b167c07, stack-release.sh blob 2586a2a37cd2, gate passed) and done (2213-2214)
-  8fc0ee216 row 188 (#1686, P19 409, 410): stack-release T54, the proof file checks on a carried pair and a proof file inside the repository (Darkwing; Filbert approve 29433; Sage gate passed)
-  23a609c5c sessions: Filbert row 188 r1 review, approve
-  b9c1c9fe2 sage: Part B draft 2 A2 passed (mos-0958), row 188 launched, Vikunja comments 358-360 script and record, SESSIONS line
-  525990ecb queue: revs 2207-2208: row 188 add and briefed (Sage), #1686, P19 409/410, gates Part B (mos-0956)
-  148a9503d sage: Part B window file draft 2 for mos-0957 (F1: B6 and B-R1 name the stop's endLaunch rows, PB5 counts per step; F2: PB6, PB7 and B-R1 matrices run (a)-(h)); Q2 answered, Q1 to Jason's list
-  240f21650 brief: stack-release tests for a carried proof pair and a proof file inside the repository (P19 409, 410, #1686, mos-0956)
-  742e98976 sage: Part B window file, the read window's end stamp from the clock (10:29Z, not 10:40Z)
-  288ab1b5a sage: Part B window file for Mos's A2 check (live-copy B3 and B-R1, Q1 on J2 order), SESSIONS lines for Darkwing (row 187, 10:25:22Z) and Sage
-  a843ae284 sage: row 187 landing, P19 407-410 filed and P19 385 comment 357, #1685 closed (comment 29425), SESSIONS line
-  652d6f3a8 queue: revs 2201-2206: row 187 Darkwing start, in-review and request comment 29423 (2201-2203); Filbert approve comment 29424 (2204); landing note (9a71e4e80, patch-id 6b57c47bc661, gate passed) and done (Sage 2205-2206)
-  9a71e4e80 row 187 (#1685): activate sets, carries and drops the Console's proof pair
-  d17328a55 sessions: Filbert row 187 r1 review, approve
-  f81ebfbae sage: row 186 follow-ups filed as P19 405 and 406, P19 404 closed (mos-0955)
-  9760d4967 sage: row 186 landing, P19 404 comment 354 and SESSIONS line, with Darkwing's row 186 SESSIONS line (09:13:21Z)
-  16a936c79 queue: revs 2198-2200: row 186 Filbert approve comment 29419 (2198); landing note (269134d8d, patch-id c97b9f6e25cd, gate passed) and done (Sage 2199-2200)
-  269134d8d row 186 (#1684): the activate plan's backup line says what the run will do
-  3c5da3a91 sessions: Filbert row 186 r1 review, approve
-  b367f5730 sage: rows 186-187 Vikunja comments (P19 404 351, P19 385 352-353) and SESSIONS line (mos-0954)
-  5a768d82c queue: row 187 added and briefed (Part B A0, #1685), with Darkwing's row 186 start (rev 2193)
-  6de3c86be plans: brief for row 187, activate carries the row 178 proof pair (mos-0928 Part B A0, #1685)
-  1d7fd75e2 queue: row 186 added and briefed (P19 404, #1684)
-  f5c72a5c3 plans: brief for row 186, the activate plan's backup line (P19 404, #1684)
-  b724b7b0b sessions: Sage Part A window line, with Darkwing's 06:53:53Z and 08:28:01Z lines
-  e24a13ad8 sage: Vikunja scripts and read-back records 2026-10-13 to 10-20 (decision 110, mos-0882)
-  21aa1cab0 darkwing: re-pin window rows 177-185 packet, STATE.md (sha256 b586f11c9b6f1329), W.txt (edd4622c5c45ef3f), S1/S2/S2b/B snapshots, matrices, W10 browser check and P3 rehearsals (#1683; P19 386)
-  9ddd8a92c plans: repin-rows-177-185 draft 4, R1 snapshot after the plain rollback (mos-0943)
-  e7637b99c plans: repin-rows-177-185 draft 3, R1post expects one tester action.refused per refused read (mos-0935, mos-0942)
-  2ea05700b plans: mos-0928 plan draft 2, NEW is the row 185 landing 490e2771d
-  010666074 queue: revs 2185-2190: row 185 start and in-review on bf87dbba with request comment 29403 (Darkwing 2185-2187); Filbert approve comment 29404 (2188); landing note (490e2771d, patch-id 774cd23186d5, gate passed) and done (Sage 2189-2190)
-bus: scripts/bus-service.sh install --copy 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 --copies /home/jwoltje/.local/share/mosaic-stack/copies --pm --claude /home/jwoltje/.local/bin/claude
-proof: off
-send: off
-Console: scripts/webui-service.sh install --copy 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 --copies /home/jwoltje/.local/share/mosaic-stack/copies --port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-port 7333
-CLI: scripts/stack-copy.sh wrapper 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 --copies /home/jwoltje/.local/share/mosaic-stack/copies --bin /home/jwoltje/.npm-global/bin
@@ -1,21 +0,0 @@
-pointer: /home/jwoltje/.mosaic-dev/state/stack-active.json
-  {"copy":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","business":"mosaic-stack","pm":true,"claude":"/home/jwoltje/.local/bin/claude","console":["--port","7332","--public-host","mosaic.woltje.com","--auth-header","X-authentik-username","--allow-user","jason.woltje","--tester-port","7333"],"schema":"3i","activation":"20261020T220206Z-4429a104f6d6","at":"2026-10-20T22:02:09Z"}
-log (last five lines):
-  {"at":"2026-10-20T07:58:02Z","op":"activate","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T075800Z-490e2771d3d0","activation":"20261020T075800Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T19:29:56Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":null,"activation":"20261020T192956Z-490e2771d3d0","result":"started"}
-  {"at":"2026-10-20T19:30:00Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T192956Z-490e2771d3d0","activation":"20261020T192956Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T22:02:06Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":null,"activation":"20261020T220206Z-4429a104f6d6","result":"started"}
-  {"at":"2026-10-20T22:02:09Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":"20261020T220206Z-4429a104f6d6","activation":"20261020T220206Z-4429a104f6d6","result":"ok"}
-check:
-  bus: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  Console: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  CLI: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  result: pass
-bus status:
-  host: mosaic-stack, pid 2950923, running, since 2026-10-20T22:02:08.133Z, notifier off
-  socket: present
-  writer.lock: pid 2950981
-  boot: organization file loaded at 2026-10-20T22:02:08.125Z
-unit flags: match the pointer
-drift: 6 commit(s) on refactor since the pointer's copy
-# exit 0
@@ -1,8 +0,0 @@
-stack-release: captured the rollback set: /home/jwoltje/.mosaic-dev/state/stack-rollback/20261020T220206Z-4429a104f6d6
-stack-release: stopped both units
-stack-release: stopped store schema: 3i
-stack-release: backup: /home/jwoltje/.mosaic-dev/backups/stack/20261020T220206Z-4429a104f6d6
-stack-release: installed 4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-stack-release: gate passed on 4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-stack-release: activate ok: 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 is live for mosaic-stack
-# exit 0
@@ -1,2 +0,0 @@
-W0b 2026-10-20T22:00:49Z business file copy /home/jwoltje/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-20261020T220049Z sha256 1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93 (source /home/jwoltje/.config/mosaic-dev/businesses/mosaic-stack.json sha256 1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93)
-W5 2026-10-20T22:02:13Z activation 20261020T220206Z-4429a104f6d6 backup /home/jwoltje/.mosaic-dev/backups/stack/20261020T220206Z-4429a104f6d6 SHA256SUMS sha256 b61d64843c9e2a153842606353450838da9cb778c8f3b9c27cc9366dd72ec0c9
@@ -1,7 +0,0 @@
-a 200 ok=true
-b 401 error="sign-in required"
-c 401 error="sign-in required"
-d 403 error="proxy Host refused"
-e 403 error="tester listener required"
-f 403 error="proxy header refused"
-g 200 non-json 6575 bytes
@@ -1,8 +0,0 @@
-# P6 2026-10-20T22:00:17Z
-a 200 ok=true
-b 401 error="sign-in required"
-c 401 error="sign-in required"
-d 403 error="proxy Host refused"
-e 403 error="tester listener required"
-f 403 error="proxy header refused"
-g 200 non-json 6454 bytes
@@ -1,4 +0,0 @@
-copy 490e2771d: roles 6, projects 1, arbiters 2
-HOLDS chief instance.name yes
-HOLDS pm instance.name no
-LOAD_OK
@@ -1,19 +0,0 @@
-{
- "bus.tester": true,
- "plugins": {
-  "usage-source": [
-   "transcript"
-  ],
-  "channel": [
-   "cli",
-   "webui"
-  ],
-  "harness": [
-   "claude-code"
-  ]
- },
- "launch.by": "chief",
- "launch.instances has assistant": true,
- "roles with pi harness": [],
- "sha256": "1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93"
-}
@@ -1,35 +0,0 @@
-start 2026-10-20T21:46:09Z
-business-check.mjs: OK
-console-check.sh: OK
-1ba3c7efbc84a1d7eb8ee0068d32b7917f4e75cdc4066703944cea4c20db5b93  /mnt/storage/scratch/sage-pin-de352dfaf/fixture/console-stub.mjs
-a4500094e7c7a6dc21797eaf2d696f9814f272ece945c2735b79e4593f9c9503  /mnt/storage/scratch/sage-p2-4429/console-stub-tester.mjs
-== run 1: pinned stub, no tester listener
-stub pid 2495939 port 39561
-PASS markdown-preview.js is served and equals the copy's
-PASS /api/config on loopback: send=false edit=false
-PASS project.files through the Console: head=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa files=2 spec=true error=none
-PASS project.file spec/north-star.md through the Console: commit=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa length=4 error=none
-PASS loopback save refused: HTTP 403 error=read-only sent=false
-CONSOLE_PASS
-PORT 39561
-CALLS []
-run 1 console-check rc=0
-== run 2: main listener plus a tester listener on a second port
-stub pid 2496085 port 35213 tester port 35945
-PASS markdown-preview.js is served and equals the copy's
-PASS /api/config on loopback: send=false edit=false
-PASS project.files through the Console: head=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa files=2 spec=true error=none
-PASS project.file spec/north-star.md through the Console: commit=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa length=4 error=none
-PASS loopback save refused: HTTP 403 error=read-only sent=false
-CONSOLE_PASS
-PASS main refuses x-mosaic-tester: HTTP 403 "tester listener required"
-PASS tester /api/config: HTTP 200 "tester":true
-PASS tester /api/config send and edit off: HTTP 200 "send":false,"edit":false
-PASS tester refuses the main auth header: HTTP 403 "proxy header refused"
-PASS tester refuses project-file save: HTTP 403 
-PORT 35213
-TPORT 35945
-CALLS []
-TESTER_PASS
-run 2 console-check rc=0 tester rc=0
-end 2026-10-20T21:46:10Z
@@ -1 +0,0 @@
-2026-10-20T21:52:34Z
@@ -1,10 +0,0 @@
-flags-check start 2026-10-20T21:53:52Z
-pid 2729699 alive: yes
-127.0.0.1:7341
-127.0.0.1:7342
-main /healthz: 200
-tester /healthz: 200
-main /api/config: {"board":"http://127.0.0.1:7331","send":false,"edit":false}
-pid 2729699 after TERM: gone
-listeners after: 0
-flags-check end 2026-10-20T21:53:56Z
@@ -1,7 +0,0 @@
-Mosaic Console: http://127.0.0.1:7341/
-Board: http://127.0.0.1:7331
-Bus: mosaic-stack
-Preview: https://mosaic.woltje.com/ through the proxy, signed-in user from x-authentik-username, read-only
-Proxy: proxy proof off
-Tester Console: http://127.0.0.1:7342/ (binds the tester)
-Ctrl-C stops this server.
@@ -1 +0,0 @@
-rc=0
@@ -1,20 +0,0 @@
-PASS copy: 4429a104f6d65ccf165f6c83b5d1dce3147dfde0, schema 3i
-PASS port: 127.0.0.1:7341 is free
-PASS backup: /home/jwoltje/.mosaic-dev/backups/stack/20261020T192956Z-490e2771d3d0 matches its SHA256SUMS
-PASS scratch-root: /home/jwoltje/.mosaic-dev/rehearsals/20261020T215231Z-4429a104f6d6/data from the backup, config and business file under /home/jwoltje/.mosaic-dev/rehearsals/20261020T215231Z-4429a104f6d6/config, business.diff beside them
-PASS data-root-live: /home/jwoltje/.mosaic-dev/rehearsals/20261020T215231Z-4429a104f6d6/data is not the live data root
-PASS sessions-live: no running session named in the data root
-PASS data-root-scratch
-PASS notify-off: binding null, so no Discord bridge
-PASS tracker-configured: bootConfig sets no trackers
-PASS credential-ref-live: 9 reference(s), each a placeholder
-PASS migration: not needed: the backup is already 3i
-PASS gate: host-up, bus-status, console-up, healthz and copy-match on 4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-PASS no-session: no sessions.json and no launches under /home/jwoltje/.mosaic-dev/rehearsals/20261020T215231Z-4429a104f6d6/data
-PASS console-stopped: pid 2675437
-PASS host-stopped: pid 2675436
-PASS host-released-store
-PASS backup-unchanged
-PASS live-config-unchanged
-REHEARSAL_PASS
-rehearsal directory: /home/jwoltje/.mosaic-dev/rehearsals/20261020T215231Z-4429a104f6d6
@@ -1 +0,0 @@
-2026-10-20T21:52:31Z
@@ -1,7 +0,0 @@
-# P4 2026-10-20T22:00:17Z
-DropInPaths=
-ExecStart={ path=/home/jwoltje/.local/bin/chisel ; argv[]=/home/jwoltje/.local/bin/chisel client --fingerprint ce+ISFvMAhuoCRDuc7riIf+hYz87TLHk/C9C/H8QsUg= --keepalive 25s --max-retry-interval 10s http://10.1.1.227:8080 R:0.0.0.0:7332:127.0.0.1:7332 ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }
-# exit 0
-# R: specs (1): R:0.0.0.0:7332:127.0.0.1:7332 
-P4 PASS: one R: spec R:0.0.0.0:7332:127.0.0.1:7332, DropInPaths empty
-rc 0
@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-# P4-P6 of agents/sage/work/window-plan/repin-4429a104f.md (f41729178), adapted from Darkwing's window-rows-177-185/p456.sh, read only.
-# P4 the tunnel unit, P5 the four REPO scripts against NEW, P6 the 7332 matrix on OLD (matrix-old.txt).
-# usage: p456.sh p4|p5|p6
-set -uo pipefail
-REPO=/mnt/storage/src/mosaic-stack
-WIN=$REPO/agents/sage/work/window-repin-4429a104f
-NEW=4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-FILES=(scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh)
-# The plan's <32 letters>: a fixed dummy, not a secret. matrix-new.txt uses the same value.
-PROOF=abcdefghijklmnopqrstuvwxyzabcdef
-
-p4() {
-  echo "# P4 $(date -u +%FT%TZ)"
-  local out; out="$(systemctl --user show mosaic-preview-tunnel.service -p ExecStart -p DropInPaths)"; local rc=$?
-  printf '%s\n' "$out"; echo "# exit $rc"
-  local specs; specs="$(grep -oE 'R:[^ ;]+' <<<"$out")"
-  local n; n="$(grep -c . <<<"$specs")"
-  echo "# R: specs ($n): $(tr '\n' ' ' <<<"$specs")"
-  local drop; drop="$(sed -n 's/^DropInPaths=//p' <<<"$out")"
-  if [[ $rc -eq 0 && $n -eq 1 && "$specs" == "R:0.0.0.0:7332:127.0.0.1:7332" && -z "$drop" ]]; then
-    echo "P4 PASS: one R: spec R:0.0.0.0:7332:127.0.0.1:7332, DropInPaths empty"
-  else
-    echo "P4 FAIL"; return 3
-  fi
-}
-
-p5() {
-  echo "# P5 $(date -u +%FT%TZ); HEAD $(git -C $REPO rev-parse HEAD)"
-  git -C $REPO diff --quiet $NEW HEAD -- "${FILES[@]}"; local d=$?
-  echo "# git diff --quiet $NEW HEAD -- ${FILES[*]}: exit $d"
-  local st; st="$(git -C $REPO status --porcelain -- "${FILES[@]}")"; local s=$?
-  echo "# git status --porcelain (exit $s): [${st}]"
-  for f in "${FILES[@]}"; do echo "# $f HEAD blob $(git -C $REPO rev-parse HEAD:$f) NEW blob $(git -C $REPO rev-parse $NEW:$f)"; done
-  if [[ $d -eq 0 && $s -eq 0 && -z "$st" ]]; then echo "P5 PASS"; else echo "P5 FAIL"; return 3; fi
-}
-
-# one matrix line: label, then curl arguments; prints "<label> <code> <error or ok field>"
-req() {
-  local label="$1"; shift
-  local body; body="$(mktemp -p "${TMPDIR:-/tmp}")"
-  local code; code="$(curl -s -m 10 -o "$body" -w '%{http_code}' "$@")"
-  local field; field="$(node -e '
-    let s = require("fs").readFileSync(process.argv[1], "utf8"), j;
-    try { j = JSON.parse(s); } catch { console.log("non-json " + s.length + " bytes"); process.exit(0); }
-    console.log(j.error !== undefined ? "error=" + JSON.stringify(j.error) : "ok=" + JSON.stringify(j.ok));
-  ' "$body")"
-  rm -f "$body"
-  echo "$label $code $field"
-}
-
-p6() {
-  req a http://127.0.0.1:7332/healthz
-  req b -H 'Host: mosaic.woltje.com' http://127.0.0.1:7332/
-  req c -H 'Host: mosaic.woltje.com' -H "X-Mosaic-Proof: $PROOF" http://127.0.0.1:7332/
-  req d -H 'X-authentik-username: tester-probe' http://127.0.0.1:7332/
-  req e -H 'x-mosaic-tester: 1' http://127.0.0.1:7332/
-  req f -H 'X-authentik-username: tester-probe' http://127.0.0.1:7333/
-  req g -H "X-Mosaic-Proof: $PROOF" http://127.0.0.1:7333/
-}
-
-case "${1:-}" in
-  p4) p4 ;;
-  p5) p5 ;;
-  p6) p6 ;;
-  *) echo "usage: p456.sh p4|p5|p6" >&2; exit 2 ;;
-esac
@@ -1,9 +0,0 @@
-# P5 2026-10-20T22:00:17Z; HEAD 4385b9ec183a2da4136ccd639d2a6b041eb9c68f
-# git diff --quiet 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 HEAD -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh: exit 0
-# git status --porcelain (exit 0): []
-# scripts/stack-release.sh HEAD blob 3b068b1546d4020cffde5d73929d9130afe91911 NEW blob 3b068b1546d4020cffde5d73929d9130afe91911
-# scripts/webui-service.sh HEAD blob 0a32547c54ac233e75a21f4817ae230855dbc088 NEW blob 0a32547c54ac233e75a21f4817ae230855dbc088
-# scripts/bus-service.sh HEAD blob f71250204dfeceb51beeea5941ebbf3a33ce4b92 NEW blob f71250204dfeceb51beeea5941ebbf3a33ce4b92
-# scripts/stack-copy.sh HEAD blob 24bbb02a6aa8d7857da7be3b6815105a9fef629f NEW blob 24bbb02a6aa8d7857da7be3b6815105a9fef629f
-P5 PASS
-rc 0
@@ -1,235 +0,0 @@
-// Merged window B+C, S1, S2 and D3 (repin-merged-bc.md "S1 and S2"): a read-only snapshot of every
-// table in a bus store, so the 3h to 3i migration and a restore can be checked without the bus.
-// OLD's broker doesn't take --tester on usage, names or threads.
-//
-// usage: node snapshot.mjs --store /abs/bus.sqlite (--held | --stopped) [--after STAMP] [--backup /abs/bus.sqlite]
-//   --held     the running bus holds the store: a plain readOnly open, which adds no file to a WAL
-//              store that already has -wal and -shm (as stack-release.sh does for a held store).
-//              Refuses store-not-held when either is absent
-//   --stopped  the bus is stopped: refuses store-unclean when -wal or -shm is present, else opens
-//              with immutable=1 and readOnly, which creates no file and leaves the store's mtime
-//              and sha256 alone
-//   --after    also counts each timed table's rows with `at` after STAMP (mos-0838 D3, before a
-//              --restore). STAMP is a backup's STAMP file, in now_ms form (stack-release.sh:43,
-//              2026-10-20T00:11:14.123Z). The count is a text compare, as the tool's own heldcount
-//              does, so every `at` in every timed table must have that form: a table with any
-//              other value refuses at-format and names the table (sage-1125)
-//   --backup   also compares every table with a stack-release backup's bus.sqlite, which opens as
-//              --stopped opens a store: immutable=1 and readOnly, refusing backup-unclean when -wal
-//              or -shm is present, so nothing writes into the backup set
-//
-// It prints one JSON object: the schema version, then for every table in sqlite_master (type
-// table, less sqlite_*) the row count, the max seq and a sha256 of the rows (in seq order, else in
-// column order). `untimed` names the tables with no `at` column. For usage_records it adds per-run
-// input and output sums, counted as `mosaic usage` counts them (usage.mjs turnRecords). messages
-// and message_threads hold bodies and names, so they print counts only, no sha256 (sage-1125). It
-// prints counts, hashes and table and meta key names only: no message body, no instance, project
-// or thread name, no credential and no file content. It reads no config: the store path is always
-// given.
-//
-// With --backup, each table gets `vsBackup` and `stopTables` names every table other than events
-// whose rows differ from the backup's (sage-1123): a row with `at` after STAMP, a row past the
-// backup's max seq, a changed row at or below it, a changed untimed table, or a table only one
-// side has. meta counts only when a key other than schema_version and schema_digest changed (the
-// 3h to 3i migration sets those two). Events are left to the tool's own --events N.
-import { DatabaseSync } from 'node:sqlite';
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync } from 'node:fs';
-import { isAbsolute } from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-// usage_records is hashed on these columns in this order, never SELECT * (mos-0888 F1), as
-// 3h-3i.sql:9 copies it. Every other table is hashed on its own columns in name order, so a
-// rebuild that reorders columns keeps the hash. usage_records with any other column set refuses.
-const USAGE_COLUMNS = ['seq', 'at', 'business', 'run', 'instance', 'provider', 'model', 'account', 'turn', 'source',
-  'phase', 'status', 'code', 'cursor', 'input', 'output', 'cache_write', 'cache_read'];
-const COUNTS_ONLY = new Set(['messages', 'message_threads']);
-const SCHEMA_KEYS = ['schema_digest', 'schema_version'];
-const STAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-
-function refuse(code, detail) {
-  process.stderr.write(`snapshot: ${code}: ${detail}\n`);
-  process.exit(1);
-}
-
-function args(argv) {
-  const o = {};
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--store' || a === '--after' || a === '--backup') {
-      if (i + 1 >= argv.length) refuse('usage', `${a} needs a value`);
-      o[a.slice(2)] = argv[++i];
-    } else if (a === '--held' || a === '--stopped') {
-      if (o.mode) refuse('usage', 'give one of --held and --stopped');
-      o.mode = a.slice(2);
-    } else refuse('usage', `unknown argument ${a}`);
-  }
-  if (!o.store || !o.mode) refuse('usage', 'node snapshot.mjs --store /abs/bus.sqlite (--held | --stopped) [--after STAMP] [--backup /abs/bus.sqlite]');
-  if (!isAbsolute(o.store)) refuse('usage', '--store must be an absolute path');
-  if (o.backup !== undefined && !isAbsolute(o.backup)) refuse('usage', '--backup must be an absolute path');
-  if (o.after !== undefined && !(STAMP.test(o.after) && Number.isFinite(Date.parse(o.after))))
-    refuse('usage', '--after must be a STAMP like 2026-10-20T00:11:14.123Z');
-  return o;
-}
-
-function file(path, code) {
-  if (!existsSync(path) || !lstatSync(path).isFile()) refuse(code, `${path} is not a file`);
-}
-
-function immutable(path, code) {
-  for (const f of [path + '-wal', path + '-shm'])
-    if (existsSync(f)) refuse(code, `${f} is present; an immutable read would skip the WAL`);
-  return new DatabaseSync(pathToFileURL(path).href + '?immutable=1', { readOnly: true });
-}
-
-function open({ store, mode }) {
-  file(store, 'store-missing');
-  if (mode === 'stopped') return immutable(store, 'store-unclean');
-  // A plain readOnly open of a WAL store with no -wal and -shm creates them, so a store that
-  // nothing holds refuses here instead of gaining two files.
-  for (const f of [store + '-wal', store + '-shm'])
-    if (!existsSync(f)) refuse('store-not-held', `${f} is absent; use --stopped for a store the bus doesn't hold`);
-  return new DatabaseSync(store, { readOnly: true });
-}
-
-const q = (name) => `"${name.replaceAll('"', '""')}"`;
-const value = (v) => (typeof v === 'bigint' ? String(v) : v instanceof Uint8Array ? { hex: Buffer.from(v).toString('hex') } : v);
-
-// The same records `mosaic usage` counts: per (run, turn, source) the latest row, an end row
-// winning; a turn is known only when that row is an end row with status known.
-function byRun(rows) {
-  const turns = new Map();
-  for (const row of rows) {
-    const key = JSON.stringify([row.business, row.run, row.turn, row.source]);
-    if (row.phase === 'end' || !turns.has(key)) turns.set(key, row);
-  }
-  const runs = new Map();
-  for (const row of turns.values()) {
-    const key = JSON.stringify([row.business, row.run]);
-    if (!runs.has(key)) runs.set(key, { business: row.business, run: row.run, input: 0n, output: 0n, unknown: new Set() });
-    const r = runs.get(key);
-    if (row.phase === 'end' && row.status === 'known') {
-      r.input += BigInt(row.input);
-      r.output += BigInt(row.output);
-    } else r.unknown.add(row.turn);
-  }
-  return [...runs.values()].map(({ unknown, input, output, ...r }) => ({
-    ...r, input: String(input), output: String(output), unknownTurns: unknown.size,
-  }));
-}
-
-// meta is compared by key: the names of the keys whose value differs, never the values.
-function metaKeys(db) {
-  return new Map(db.prepare('SELECT key, value FROM meta').all().map((r) => [String(r.key), String(r.value)]));
-}
-
-// One table: rows, max seq and sha256; rows after `after`; with `priorMax` (the backup's max
-// seq) a second hash of the rows at or below it and the count of rows above it. The hashes stay
-// inside: a COUNTS_ONLY table's `t` gets none.
-function read(db, table, { after, priorMax } = {}) {
-  const cols = db.prepare('SELECT name FROM pragma_table_info(?)').all(table).map((c) => c.name);
-  if (!cols.length) refuse('table-missing', table);
-  let hashed = [...cols].sort();
-  if (table === 'usage_records') {
-    if (JSON.stringify(hashed) !== JSON.stringify([...USAGE_COLUMNS].sort()))
-      refuse('columns-changed', `usage_records has columns ${hashed.join(',')}`);
-    hashed = USAGE_COLUMNS;
-  }
-  const seq = cols.includes('seq');
-  const at = cols.includes('at');
-  const stmt = db.prepare(`SELECT ${hashed.map(q).join(',')} FROM ${q(table)} ORDER BY ${seq ? 'seq' : hashed.map(q).join(',')}`);
-  stmt.setReadBigInts(true);
-  const full = createHash('sha256');
-  const prior = createHash('sha256');
-  const limit = priorMax === undefined ? undefined : BigInt(priorMax ?? 0);
-  let rows = 0;
-  let rowsAfter = 0;
-  let badAt = 0;
-  let newRows = 0;
-  const kept = [];
-  for (const row of stmt.iterate()) {
-    rows++;
-    const line = JSON.stringify(hashed.map((c) => value(row[c]))) + '\n';
-    full.update(line);
-    if (seq && limit !== undefined) {
-      if (row.seq <= limit) prior.update(line);
-      else newRows++;
-    }
-    if (after !== undefined && at) {
-      if (typeof row.at !== 'string' || !STAMP.test(row.at)) badAt++;
-      else if (row.at > after) rowsAfter++;
-    }
-    if (table === 'usage_records') kept.push(row);
-  }
-  if (badAt) refuse('at-format', `${table} has ${badAt} row(s) whose at is not in the STAMP form, so a text compare with --after would miscount`);
-  const sha256 = full.digest('hex');
-  const t = { rows, maxSeq: seq ? (db.prepare(`SELECT max(seq) AS m FROM ${q(table)}`).get().m ?? null) : null };
-  if (!COUNTS_ONLY.has(table)) t.sha256 = sha256;
-  if (after !== undefined && at) t.rowsAfter = rowsAfter;
-  if (table === 'usage_records') t.byRun = byRun(kept);
-  return { t, sha256, cols: hashed, seq, at, newRows, priorSha: seq && limit !== undefined ? prior.digest('hex') : null };
-}
-
-// Tables only: no index, view or trigger, and none of SQLite's own sqlite_* tables.
-const tablesOf = (db) => db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite\\_%' ESCAPE '\\' ORDER BY name")
-  .all().map((r) => r.name);
-
-const o = args(process.argv.slice(2));
-if (o.backup !== undefined) file(o.backup, 'backup-missing');
-const db = open(o);
-const bdb = o.backup === undefined ? null : immutable(o.backup, 'backup-unclean');
-const out = {};
-try {
-  db.exec('BEGIN');
-  out.schema = db.prepare("SELECT value FROM meta WHERE key='schema_version'").get()?.value ?? null;
-  const names = tablesOf(db);
-  const base = new Map();
-  if (bdb) {
-    out.backupSchema = bdb.prepare("SELECT value FROM meta WHERE key='schema_version'").get()?.value ?? null;
-    for (const name of tablesOf(bdb)) base.set(name, read(bdb, name));
-  }
-  out.tables = {};
-  out.untimed = [];
-  const stop = [];
-  for (const name of names) {
-    const b = base.get(name);
-    const r = read(db, name, { after: o.after, priorMax: b ? b.t.maxSeq : undefined });
-    if (!r.at) out.untimed.push(name);
-    if (bdb) {
-      const v = { backupRows: b ? b.t.rows : null };
-      let changed;
-      if (!b) changed = true;
-      else if (name === 'meta') {
-        const now = metaKeys(db);
-        const then = metaKeys(bdb);
-        v.keysChanged = [...new Set([...now.keys(), ...then.keys()])].filter((k) => now.get(k) !== then.get(k)).sort();
-        changed = v.keysChanged.some((k) => !SCHEMA_KEYS.includes(k));
-      } else if (r.seq) {
-        v.backupMaxSeq = b.t.maxSeq;
-        v.newRows = r.newRows;
-        v.priorSame = JSON.stringify(r.cols) === JSON.stringify(b.cols) && r.priorSha === b.sha256;
-        changed = r.newRows > 0 || !v.priorSame;
-      } else {
-        v.same = JSON.stringify(r.cols) === JSON.stringify(b.cols) && r.sha256 === b.sha256;
-        changed = !v.same;
-      }
-      if ((r.t.rowsAfter ?? 0) > 0) changed = true;
-      r.t.vsBackup = v;
-      if (changed && name !== 'events') stop.push(name);
-    }
-    out.tables[name] = r.t;
-  }
-  if (bdb) {
-    out.onlyInBackup = [...base.keys()].filter((n) => !names.includes(n));
-    out.stopTables = [...stop, ...out.onlyInBackup].sort();
-  }
-  if (o.after !== undefined) {
-    out.after = o.after;
-    out.eventsAfter = out.tables.events?.rowsAfter ?? null;
-  }
-} finally {
-  try { db.exec('ROLLBACK'); } catch {}
-  db.close();
-  bdb?.close();
-}
-process.stdout.write(JSON.stringify(out, null, 2) + '\n');
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-# Re-pin 4429a104f window step wrapper (copied from Darkwing's window-rows-177-185/w.sh): w.sh FILE TITLE CMD... runs CMD in REPO under a clean env (no ANTHROPIC_*, CLAUDE_*,
-# MOSAIC_* or pi variables), appends the title, command, output, exit code and date -u stamps to window/FILE,
-# prints the output, and exits with CMD's exit code.
-set -uo pipefail
-W=/mnt/storage/src/mosaic-stack/agents/sage/work/window-repin-4429a104f
-f="$W/$1"; title="$2"; shift 2
-E=(env -i HOME="$HOME" PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin" LANG=C.UTF-8
-  XDG_RUNTIME_DIR="$XDG_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=$XDG_RUNTIME_DIR/bus}")
-t0=$(date -u +%FT%T.%3NZ)
-{ echo; echo "## $title"; echo "# start $t0"; echo "# command: (cd \$REPO && <clean env> $*)"; } >> "$f"
-out=$(cd /mnt/storage/src/mosaic-stack && "${E[@]}" "$@" 2>&1); rc=$?
-printf '%s\n' "$out" >> "$f"
-echo "# exit $rc, end $(date -u +%FT%T.%3NZ)" >> "$f"
-printf '%s\n# exit %s\n' "$out" "$rc"
-exit $rc
@@ -1,9 +0,0 @@
-npm warn deprecated [email protected]: Use your platform's native DOMException instead
-
-added 128 packages in 2s
-npm warn install-scripts 3 packages had install scripts blocked because they are not covered by allowScripts:
-npm warn install-scripts   @google/[email protected] (preinstall: echo 'preinstall: no-op')
-npm warn install-scripts   [email protected] (postinstall: node install.js)
-npm warn install-scripts   [email protected] (postinstall: node scripts/postinstall)
-npm warn install-scripts
-npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.
@@ -1 +0,0 @@
-copied: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
@@ -1,16 +0,0 @@
-start 2026-10-20T21:45:57Z
-stack-copy rc=0
-copied: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-npm warn install-scripts   [email protected] (postinstall: node scripts/postinstall)
-npm warn install-scripts
-npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.
-oauth4webapi 3.8.8
-IMPORT_OK
-LOCK_MATCH
-163M	/home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-/dev/nvme1n1p5  458G  405G   30G  94% /home
-copy 4429a104f: roles 6, projects 1, arbiters 2
-HOLDS chief instance.name yes
-HOLDS pm instance.name no
-LOAD_OK
-end 2026-10-20T21:45:59Z
@@ -1,109 +0,0 @@
-// W10 of repin-4429a104f.md (e1272d1a), adapted from Darkwing's window-rows-177-185/w10-browser.mjs: the tester listener
-// on 127.0.0.1:7333 through the webui browser harness (packages/webui/tests/browser.mjs, same blob at HEAD and NEW). Reads only: before any page
-// script runs, fetch and XMLHttpRequest are wrapped so every call is logged and any method other than
-// GET or HEAD is refused in the page, and the script submits no form and clicks no button. The chat
-// check reads the #/chat list only and never opens the W9 thread page (the launcher reads lastOpen).
-import { browser } from '/mnt/storage/src/mosaic-stack/packages/webui/tests/browser.mjs';
-
-const OUT = '/mnt/storage/src/mosaic-stack/agents/sage/work/window-repin-4429a104f';
-const BASE = 'http://127.0.0.1:7333/';
-const W9_THREAD = '446201de-e8b5-4df3-9356-d0d5422cc899';
-const GUARD = `(() => {
-  const log = window.__w10 = [];
-  const ok = m => m === 'GET' || m === 'HEAD';
-  const f = window.fetch;
-  window.fetch = (input, init = {}) => {
-    const method = String(init.method || (input instanceof Request ? input.method : 'GET')).toUpperCase();
-    const url = String(input instanceof Request ? input.url : input);
-    log.push({ method, url, refused: !ok(method) });
-    return ok(method) ? f(input, init) : Promise.reject(new TypeError('w10 refused ' + method));
-  };
-  const open = XMLHttpRequest.prototype.open, send = XMLHttpRequest.prototype.send;
-  XMLHttpRequest.prototype.open = function (method, url, ...rest) { this.__m = String(method).toUpperCase(); this.__u = String(url); return open.call(this, method, url, ...rest); };
-  XMLHttpRequest.prototype.send = function (...a) { log.push({ method: this.__m, url: this.__u, xhr: true, refused: !ok(this.__m) }); if (!ok(this.__m)) throw new TypeError('w10 refused ' + this.__m); return send.apply(this, a); };
-})();`;
-
-const b = await browser({ machine: false });
-const result = {};
-let failed = false;
-const check = (name, pass, detail) => { result[name] = { pass, ...(detail === undefined ? {} : { detail }) }; if (!pass) failed = true; };
-try {
-  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: GUARD });
-  await b.viewport(1280, 1600);
-  const wait = expr => b.evaluate(`(async()=>{for(let n=0;n<300;n++){if(${expr})return true;await new Promise(r=>setTimeout(r,50));}return false;})()`);
-
-  await b.navigate(BASE + '#/settings');
-  const ready = await wait('!!document.querySelector("#tester-banner") && !!document.querySelector("#routes-form") && !!document.querySelector(".tester-name-form")');
-  check('settings loaded', ready);
-  const s = await b.evaluate(`(() => {
-    const q = x => document.querySelector(x);
-    return {
-      banner: q('#tester-banner')?.textContent.trim() ?? null,
-      h1: q('#bus-view h1')?.textContent.trim() ?? null,
-      forms: [...document.querySelectorAll('form')].map(f => f.id || f.className),
-      convFormHidden: q('#conv-form')?.hidden ?? null,
-      panels: [...document.querySelectorAll('#bus-view h2')].map(h => h.textContent.trim()),
-      instancesTable: !!q('#instances-table'),
-      nameForms: document.querySelectorAll('.tester-name-form').length,
-      routesForm: !!q('#routes-form'),
-      routesSubmitEnabled: q('#routes-form button[type=submit]')?.disabled === false,
-      forbidden: [...document.querySelectorAll('#launch-settings-form, .assistant-form, #token-limits-table [data-limit-reset], #send-section')].map(e => e.id || e.className || e.tagName),
-      tokenLimitsPanel: !!q('#token-limits-title') || !!q('#token-limits-table'),
-    };
-  })()`);
-  result.settings = s;
-  check('tester banner', /tester/i.test(s.banner ?? ''), s.banner);
-  check('instance, routes and name editors present', s.instancesTable && s.routesForm && s.nameForms > 0);
-  check('only tester forms (conv-form is index.html:21, global and hidden)', s.convFormHidden === true && s.forms.every(f => f === 'conv-form' || f === 'routes-form' || /tester-name-form/.test(f) || /^instance-(add|change)-form$/.test(f)), s.forms);
-  check('no launch settings, assistant, limit reset or send', s.forbidden.length === 0, s.forbidden);
-  check('no Token limits panel (plan W10 item 2, amended)', s.tokenLimitsPanel === false);
-  await b.screenshot(`${OUT}/w10-settings.png`);
-
-  await b.navigate(BASE + '#/');
-  // The Board is index.html:22 #board-view; bus.js hides #bus-view on it.
-  const board = await wait('document.querySelector("#bus-view")?.hidden === true && !!document.querySelector("#board-view #waiting-title")');
-  await new Promise(r => setTimeout(r, 1500));
-  const bd = await b.evaluate(`(() => { const v = document.querySelector('#board-view'); return {
-    busViewHidden: document.querySelector('#bus-view')?.hidden ?? null,
-    banner: !!document.querySelector('#tester-banner'),
-    headings: [...v.querySelectorAll('h2')].map(h => h.textContent.replace(/\\s+/g, ' ').trim()),
-    unavailable: /unavailable|refused|not authorized/i.test(v.textContent),
-    length: v.textContent.length,
-    forms: [...document.querySelectorAll('form')].map(f => f.id || f.className),
-  }; })()`);
-  result.board = bd;
-  check('board reads', board && bd.busViewHidden === true && !bd.unavailable && bd.headings.length > 0, bd);
-  await b.screenshot(`${OUT}/w10-board.png`);
-
-  await b.navigate(BASE + '#/chat');
-  // chat.js threads(): ul.chat-thread-list with <a href="#/chat/threads/<id>">. Read only; no link is followed.
-  const chatReady = await wait('!!document.querySelector("ul.chat-thread-list") || /No threads yet/.test(document.body.textContent)');
-  const c = await b.evaluate(`(() => {
-    const list = document.querySelector('ul.chat-thread-list');
-    return {
-      hash: location.hash,
-      banner: !!document.querySelector('#tester-banner'),
-      threads: list ? [...list.querySelectorAll('li')].map(li => ({ href: li.querySelector('a')?.getAttribute('href') ?? null, name: li.querySelector('a')?.textContent.trim() ?? null, instance: li.querySelector('.muted')?.textContent.trim() ?? null })) : [],
-      conversationOpen: !!document.querySelector('.chat-conversation'),
-      forms: [...document.querySelectorAll('form')].map(f => f.id || f.className),
-    };
-  })()`);
-  result.chat = c;
-  check('chat lists the W9 thread', chatReady && c.threads.some(t => t.href === '#/chat/threads/' + W9_THREAD), c.threads);
-  check('W9 thread page not opened', c.hash === '#/chat' && c.conversationOpen === false, c.hash);
-  check('tester banner on chat', c.banner);
-  await b.screenshot(`${OUT}/w10-chat.png`);
-
-  const log = await b.evaluate('window.__w10');
-  result.requests = log;
-  check('no write through the listener', log.every(r => !r.refused && (r.method === 'GET' || r.method === 'HEAD')), log.filter(r => r.refused));
-  check('no request to the W9 thread messages or open', !log.some(r => r.url.includes(W9_THREAD)), log.filter(r => r.url.includes(W9_THREAD)));
-} catch (e) {
-  failed = true;
-  result.error = String(e?.message ?? e);
-} finally {
-  await b.close();
-}
-console.log(JSON.stringify(result, null, 2));
-console.log(failed ? 'W10 browser: FAIL' : 'W10 browser: pass');
-process.exit(failed ? 1 : 0);
@@ -1,30 +0,0 @@
-// W10 diagnosis after the two failed checks of w10-browser.mjs (sign-out form listed; chat list missing the W9 thread).
-// Read only, with the same GET/HEAD guard as w10-browser.mjs. Records each form's hidden flag on Settings, the /api/config
-// sso value the page sees, and every ul.chat-thread-list on #/chat (chat.js:93 renders one per project). No screenshots.
-import { browser } from '/mnt/storage/src/mosaic-stack/packages/webui/tests/browser.mjs';
-import { readFileSync } from 'node:fs';
-const src = readFileSync(new URL('./w10-browser.mjs', import.meta.url), 'utf8');
-const GUARD = eval(src.slice(src.indexOf('const GUARD = ') + 14, src.indexOf('`;', src.indexOf('const GUARD = ')) + 1));
-const BASE = 'http://127.0.0.1:7333/';
-const W9_THREAD = '446201de-e8b5-4df3-9356-d0d5422cc899';
-const b = await browser({ machine: false });
-const out = {};
-try {
-  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: GUARD });
-  const wait = expr => b.evaluate(`(async()=>{for(let n=0;n<300;n++){if(${expr})return true;await new Promise(r=>setTimeout(r,50));}return false;})()`);
-  await b.navigate(BASE + '#/settings');
-  await wait('!!document.querySelector("#routes-form")');
-  out.config = await b.evaluate(`fetch('/api/config').then(r=>r.json()).then(j=>({sso:j.sso??null}))`);
-  out.forms = await b.evaluate(`[...document.querySelectorAll('form')].map(f=>({id:f.id||f.className,hidden:f.hidden,action:f.getAttribute('action'),method:f.getAttribute('method')}))`);
-  await b.navigate(BASE + '#/chat');
-  await wait('document.querySelectorAll("ul.chat-thread-list").length >= 1');
-  await new Promise(r => setTimeout(r, 1000));
-  out.chat = await b.evaluate(`({hash:location.hash,open:!!document.querySelector('.chat-conversation'),projects:[...document.querySelectorAll('.chat-projects section.panel')].map(s=>({project:s.querySelector('h2')?.textContent.trim(),threads:[...s.querySelectorAll('ul.chat-thread-list li a')].map(a=>a.getAttribute('href'))}))})`);
-  out.requests = await b.evaluate('window.__w10');
-} finally { await b.close(); }
-const signOut = out.forms.find(f => f.id === 'sign-out');
-const listed = out.chat.projects.some(p => p.threads.includes('#/chat/threads/' + W9_THREAD));
-const writes = out.requests.filter(r => r.refused || !['GET', 'HEAD'].includes(r.method));
-console.log(JSON.stringify(out, null, 2));
-console.log(`sign-out hidden ${signOut?.hidden}, sso ${out.config.sso}; W9 thread listed ${listed}; thread page open ${out.chat.open}; writes ${writes.length}`);
-process.exit(signOut?.hidden === true && listed && !out.chat.open && writes.length === 0 ? 0 : 1);
@@ -1,277 +0,0 @@
-# W9 go mos-1114, start 2026-10-20T22:05:51Z
-# plan e1272d1a, tool blob 3b068b1546d4, console-check.sh d068fe02, wrapper on NEW: checked
-pointer: /home/jwoltje/.mosaic-dev/state/stack-active.json
-  {"copy":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","business":"mosaic-stack","pm":true,"claude":"/home/jwoltje/.local/bin/claude","console":["--port","7332","--public-host","mosaic.woltje.com","--auth-header","X-authentik-username","--allow-user","jason.woltje","--tester-port","7333"],"schema":"3i","activation":"20261020T220206Z-4429a104f6d6","at":"2026-10-20T22:02:09Z"}
-log (last five lines):
-  {"at":"2026-10-20T07:58:02Z","op":"activate","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T075800Z-490e2771d3d0","activation":"20261020T075800Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T19:29:56Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":null,"activation":"20261020T192956Z-490e2771d3d0","result":"started"}
-  {"at":"2026-10-20T19:30:00Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T192956Z-490e2771d3d0","activation":"20261020T192956Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T22:02:06Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":null,"activation":"20261020T220206Z-4429a104f6d6","result":"started"}
-  {"at":"2026-10-20T22:02:09Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"4429a104f6d65ccf165f6c83b5d1dce3147dfde0","backup":"20261020T220206Z-4429a104f6d6","activation":"20261020T220206Z-4429a104f6d6","result":"ok"}
-check:
-  bus: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  Console: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  CLI: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-  result: pass
-bus status:
-  host: mosaic-stack, pid 2950923, running, since 2026-10-20T22:02:08.133Z, notifier off
-  socket: present
-  writer.lock: pid 2950981
-  boot: organization file loaded at 2026-10-20T22:02:08.125Z
-unit flags: match the pointer
-drift: 6 commit(s) on refactor since the pointer's copy
-# exit 0
-PASS markdown-preview.js is served and equals the copy's
-PASS /api/config on loopback: send=false edit=false
-PASS project.files through the Console: head=ae0b17c9586e51da7bc1b7e548c6acf913a55665 files=2 spec=true error=none
-PASS project.file spec/north-star.md through the Console: commit=ae0b17c9586e51da7bc1b7e548c6acf913a55665 length=99 error=none
-PASS loopback save refused: HTTP 403 error=read-only sent=false
-CONSOLE_PASS
-# exit 0
-# journal since W5: proxy proof off 1, Sign-in 0
-# Console pid 2950925 cwd /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-r097436c91816  mosaic-stack/chief  claude-code claude-opus-5-5  by jason  since 2026-10-20T22:02:08.941Z  running
-# exit 0
-[
-  {
-    "business": "mosaic-stack",
-    "instance": "chief",
-    "run": "r097436c91816",
-    "launchedBy": "jason",
-    "harness": "claude-code",
-    "model": "claude-opus-5-5",
-    "provider": "anthropic",
-    "modelKey": "opus",
-    "pid": 2951160,
-    "startTime": "63491912",
-    "runnerPid": 2951161,
-    "runnerStartTime": "63491912",
-    "runDir": "/home/jwoltje/.mosaic-dev/launches/mosaic-stack/r097436c91816",
-    "startedAt": "2026-10-20T22:02:08.941Z",
-    "live": true
-  }
-]
-# exit 0
-# one running chief from this start: run r097436c91816
-chief  r097436c91816  claude-code  since 2026-10-20T22:02:08.951Z
-# exit 0
-sent c5b43f04 to chief
-chief (RESULT, re c5b43f04) c3e236d7:
-Got the re-pin of 4429a104f6d65ccf165f6c83b5d1dce3147dfde0 from the tester; I took no action because a tester message authorizes nothing, and I launched and changed nothing.
-# exit 0
-created project window-20261020-2205  id 77e7b45f-8c34-49a3-b2fa-9cf565177c30
-# exit 0
-created window-20261020-2205/w9  id 446201de-e8b5-4df3-9356-d0d5422cc899  instance assistant
-# exit 0
-# project window-20261020-2205, thread 446201de-e8b5-4df3-9356-d0d5422cc899
-sent b4b66ced to window-20261020-2205/w9
-assistant (RESULT, re b4b66ced) cfa7ea99:
-Assistant (run r497f1c817d4d) got the [mos test] message and is replying in one line as asked, without treating it as Jason's instruction or acting on it.
-# exit 0
-# reply received 2026-10-20T22:06:05Z
-[
-  {
-    "seq": 570,
-    "id": "b4b66ced-d088-4b9c-a944-306f164028f9",
-    "at": "2026-10-20T22:05:58.283Z",
-    "business": "mosaic-stack",
-    "from_role": "tester",
-    "from_run": "tester-cli",
-    "to_role": "assistant",
-    "class": "REQUEST",
-    "in_reply_to": null,
-    "decision": null,
-    "corrects": null,
-    "body": "[mos test] reply with one line, then stop",
-    "to_name": null
-  },
-  {
-    "seq": 571,
-    "id": "cfa7ea99-7ccb-4225-80a6-9a903540e337",
-    "at": "2026-10-20T22:06:04.247Z",
-    "business": "mosaic-stack",
-    "from_role": "assistant",
-    "from_run": "r497f1c817d4d",
-    "to_role": "tester",
-    "class": "RESULT",
-    "in_reply_to": "b4b66ced-d088-4b9c-a944-306f164028f9",
-    "decision": null,
-    "corrects": null,
-    "body": "Assistant (run r497f1c817d4d) got the [mos test] message and is replying in one line as asked, without treating it as Jason's instruction or acting on it.",
-    "to_name": null
-  }
-]
-# exit 0
-# thread read: 2 messages: tester->assistant REQUEST, assistant->tester RESULT
-window-20261020-0801/w9  assistant  d0ba7a66
-window-20261020-2205/w9  assistant  446201de
-# exit 0
-[]
-# exit 0
-{
-  "total": {
-    "input": 62,
-    "output": 9623,
-    "cacheWrite": 186650,
-    "cacheRead": 404132,
-    "unknownTurns": 1
-  },
-  "byRun": [
-    {
-      "run": "r8fba7e598156",
-      "input": 0,
-      "output": 0,
-      "cacheWrite": 0,
-      "cacheRead": 0,
-      "unknownTurns": 1
-    },
-    {
-      "run": "r4a96e2142e4d",
-      "input": 2,
-      "output": 52,
-      "cacheWrite": 11750,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc78c9700c8e9",
-      "input": 14,
-      "output": 1519,
-      "cacheWrite": 18187,
-      "cacheRead": 89559,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r293f33bcbc63",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 18595,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r34520a581318",
-      "input": 6,
-      "output": 323,
-      "cacheWrite": 26349,
-      "cacheRead": 14307,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r7e99838f9f93",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 9858,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc964611b2092",
-      "input": 4,
-      "output": 120,
-      "cacheWrite": 26138,
-      "cacheRead": 23870,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rbb708846b605",
-      "input": 12,
-      "output": 2089,
-      "cacheWrite": 17285,
-      "cacheRead": 73823,
-      "unknownTurns": 0
-    },
-    {
-      "run": "rc36b17ef3788",
-      "input": 16,
-      "output": 5221,
-      "cacheWrite": 36717,
-      "cacheRead": 202573,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r097436c91816",
-      "input": 2,
-      "output": 131,
-      "cacheWrite": 11915,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "run": "r497f1c817d4d",
-      "input": 2,
-      "output": 80,
-      "cacheWrite": 9856,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    }
-  ],
-  "byInstance": [
-    {
-      "instance": "chief",
-      "input": 36,
-      "output": 4114,
-      "cacheWrite": 85486,
-      "cacheRead": 177689,
-      "unknownTurns": 1
-    },
-    {
-      "instance": "coder",
-      "input": 2,
-      "output": 44,
-      "cacheWrite": 18595,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "instance": "assistant",
-      "input": 4,
-      "output": 124,
-      "cacheWrite": 19714,
-      "cacheRead": 0,
-      "unknownTurns": 0
-    },
-    {
-      "instance": "pm",
-      "input": 20,
-      "output": 5341,
-      "cacheWrite": 62855,
-      "cacheRead": 226443,
-      "unknownTurns": 0
-    }
-  ],
-  "byProvider": [
-    {
-      "provider": "anthropic",
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ],
-  "byModel": [
-    {
-      "provider": "anthropic",
-      "model": "claude-opus-5-5",
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ],
-  "byAccount": [
-    {
-      "account": null,
-      "input": 62,
-      "output": 9623,
-      "cacheWrite": 186650,
-      "cacheRead": 404132,
-      "unknownTurns": 1
-    }
-  ]
-}
-# exit 0
-# human-thread probe: skipped. S1 has 1 threads row, and threads --tester lists the 177-185 window's tester thread d0ba7a66, so no human thread exists to read
-# W9 checks and turns end 2026-10-20T22:06:06Z; the assistant run wait and S2 are w9b.sh
@@ -1,93 +0,0 @@
-#!/usr/bin/env bash
-# Re-pin 4429a104f, W9 checks and the turns (repin-4429a104f.md at f41729178, sha256 e1272d1a; the W9 list of
-# repin-rows-177-185.md plus the journal Sign-in line and the Console cwd), on Mos's go mos-1114.
-# Adapted from Darkwing's window-rows-177-185/w9.sh. Every call goes through w.sh into W.txt; every bus call carries
-# --tester. A failed check stops the script. The wait for the assistant run and S2 are in w9b.sh, so the interim
-# report to Mos goes out between the two (report rule, waits over 5 minutes).
-# usage: w9.sh
-set -uo pipefail
-REPO=/mnt/storage/src/mosaic-stack
-WIN=$REPO/agents/sage/work/window-repin-4429a104f
-NEW=4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-W5_STAMP="2026-10-20 22:02:06 UTC"
-W5_MS=$(date -d "2026-10-20T22:02:06Z" +%s)000
-PLAN=$REPO/agents/sage/work/window-plan/repin-4429a104f.md
-PLAN_SHA=e1272d1a391e00fb1291d47da9973c0ba342d65fcd42f583ea007e883c1f32b9
-TOOL_BLOB=3b068b1546d4020cffde5d73929d9130afe91911
-CC=/mnt/storage/scratch/sage-pin-de352dfaf/console-check.sh
-CC_SHA=d068fe02da897b700110a162d13d9671fe5994f053c45aff99113fade737094c
-CONSOLE_PID=2950925
-PRIOR_TID=d0ba7a66-aa3f-4918-9518-94132bce6b28
-MOSAIC=$HOME/.npm-global/bin/mosaic
-C_NEW=(node "$HOME/.local/share/mosaic-stack/copies/$NEW/packages/cli/src/cli.mjs")
-BZ=(--business mosaic-stack)
-W=$WIN/W.txt
-note() { echo "# $*" >> "$W"; echo "# $*"; }
-stop() { note "STOP: $*"; exit 1; }
-sha() { sha256sum < "$1" | cut -c1-64; }
-step() { local f="$1"; shift; $WIN/w.sh W.txt "$@" > "$WIN/$f"; local rc=$?; cat "$WIN/$f"; return $rc; }
-
-note "W9 go mos-1114, start $(date -u +%FT%TZ)"
-[ "$(sha $PLAN)" = "$PLAN_SHA" ] || stop "the plan file is not e1272d1a"
-[ "$(git -C $REPO rev-parse HEAD:scripts/stack-release.sh)" = "$TOOL_BLOB" ] || stop "tool blob moved"
-[ "$(sha $CC)" = "$CC_SHA" ] || stop "console-check.sh is not d068fe02 (SCRIPTS.sha256)"
-grep -q "/copies/$NEW/scripts/mosaic" "$MOSAIC" || stop "the wrapper is not pinned to NEW"
-note "plan e1272d1a, tool blob 3b068b1546d4, console-check.sh d068fe02, wrapper on NEW: checked"
-
-# checks
-step .w9-status.txt "W9 status" scripts/stack-release.sh status mosaic-stack || stop "W9 status exit"
-grep -q "\"copy\":\"$NEW\"" $WIN/.w9-status.txt && grep -q '"pm":true' $WIN/.w9-status.txt && grep -q '"schema":"3i"' $WIN/.w9-status.txt || stop "W9 status: pointer not on NEW, pm true, 3i"
-grep -q 'unit flags: match the pointer' $WIN/.w9-status.txt || stop "W9 status: unit flags"
-step .w9-cc.txt "W9 console-check NEW ($CC, d068fe02)" bash $CC $NEW || stop "console-check exit"
-grep -qx CONSOLE_PASS $WIN/.w9-cc.txt || stop "console-check not CONSOLE_PASS"
-J=$(journalctl --user -u mosaic-webui.service --since "$W5_STAMP" --no-pager)
-N=$(printf '%s\n' "$J" | grep -c 'Proxy: proxy proof off'); S=$(printf '%s\n' "$J" | grep -c 'Sign-in:')
-{ echo; echo "## W9 webui journal since $W5_STAMP: 'Proxy: proxy proof off' and 'Sign-in:' counts"; echo "proxy proof off $N, Sign-in $S"; } >> "$W"
-note "journal since W5: proxy proof off $N, Sign-in $S"
-[ "$N" = 1 ] || stop "proxy proof off count is $N, not 1"
-[ "$S" = 0 ] || stop "Sign-in count is $S, not 0"
-systemctl --user show -p MainPID --value mosaic-webui.service | grep -qx "$CONSOLE_PID" || stop "Console MainPID is not $CONSOLE_PID"
-CWD=$(readlink /proc/$CONSOLE_PID/cwd)
-{ echo; echo "## W9 Console pid $CONSOLE_PID cwd"; ls -l /proc/$CONSOLE_PID/cwd | sed 's/^.* -> /-> /'; } >> "$W"
-note "Console pid $CONSOLE_PID cwd $CWD"
-[ "$CWD" = "$HOME/.local/share/mosaic-stack/copies/$NEW" ] || stop "Console cwd is not the NEW copy"
-step .w9-launches.txt "W9 launches list" $MOSAIC launches list || stop "launches list"
-step .w9-launches.json "W9 launches list --json" $MOSAIC launches list --json || stop "launches list --json"
-sed -i '$d' $WIN/.w9-launches.json
-CHIEF=$(node -e '
-const l=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")),since=Number(process.argv[2]);
-const c=l.filter(x=>x.business==="mosaic-stack"&&x.instance==="chief"&&x.live===true);
-if(c.length!==1||!(Date.parse(c[0].startedAt)>=since)){console.error(`running chiefs ${c.length}`);process.exit(1)}
-process.stdout.write(c[0].run)' $WIN/.w9-launches.json "$W5_MS") || stop "launches: not one running chief from this start"
-note "one running chief from this start: run $CHIEF"
-step .w9-agents.txt "W9 agents --tester" $MOSAIC agents "${BZ[@]}" --tester || stop "agents"
-grep -E '(^|[[:space:]])chief[[:space:]].*working' $WIN/.w9-agents.txt && stop "the chief is working"
-
-# turns
-step .w9-talk-chief.txt "W9 talk chief --tester" $MOSAIC talk chief "[mos test] re-pin $NEW: reply with one line, no staffing request" "${BZ[@]}" --tester || stop "talk chief"
-PROJ=window-$(date -u +%Y%m%d-%H%M)
-step .w9-project.txt "W9 project create $PROJ --tester" $MOSAIC project create $PROJ "${BZ[@]}" --tester || stop "project create"
-step .w9-thread.txt "W9 thread create $PROJ w9 --tester" $MOSAIC thread create $PROJ w9 "${BZ[@]}" --tester || stop "thread create"
-TID=$(sed -n "s/^created $PROJ\/w9  id \([0-9a-f-]*\)  instance .*$/\1/p" $WIN/.w9-thread.txt)
-[ -n "$TID" ] || stop "no thread id"
-note "project $PROJ, thread $TID"
-echo "$TID" > $WIN/.w9-tid.txt
-step .w9-talk-thread.txt "W9 talk --thread --wait 180 --tester" $MOSAIC talk --thread "$TID" "[mos test] reply with one line, then stop" --wait 180 "${BZ[@]}" --tester || stop "talk --thread"
-note "reply received $(date -u +%FT%TZ)"
-date -u +%s > $WIN/.w9-reply-at.txt
-step .w9-thread-read.json "W9 thread read --json --tester" $MOSAIC thread read "$TID" --json "${BZ[@]}" --tester || stop "thread read"
-sed -i '$d' $WIN/.w9-thread-read.json
-node -e '
-const t=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
-console.log(`# thread read: ${t.length} messages: ${t.map(m=>`${m.from_role}->${m.to_role} ${m.class}`).join(", ")}`);
-process.exit(t.length===2&&t[0].from_role==="tester"&&t[1].from_role==="assistant"?0:1)' $WIN/.w9-thread-read.json | tee -a "$W" || stop "thread read is not the tester message plus one assistant reply"
-step .w9-threads.txt "W9 threads --tester" $MOSAIC threads "${BZ[@]}" --tester || stop "threads"
-grep -q "$TID\|$PROJ" $WIN/.w9-threads.txt || stop "threads does not list the W9 thread"
-step .w9-names.json "W9 C_NEW names --tester --json" "${C_NEW[@]}" names "${BZ[@]}" --tester --json || stop "names"
-step .w9-usage.json "W9 usage --tester --json" $MOSAIC usage "${BZ[@]}" --tester --json || stop "usage"
-if grep -q "${PRIOR_TID:0:8}" $WIN/.w9-threads.txt; then
-  note "human-thread probe: skipped. S1 has 1 threads row, and threads --tester lists the 177-185 window's tester thread ${PRIOR_TID:0:8}, so no human thread exists to read"
-else
-  note "human-thread probe: S1's one thread is not in threads --tester; probe it by hand before S2"
-fi
-note "W9 checks and turns end $(date -u +%FT%TZ); the assistant run wait and S2 are w9b.sh"
@@ -1,185 +0,0 @@
-# W9b start 2026-10-20T22:06:27Z: waiting for the launcher to end r497f1c817d4d (thread 446201de-e8b5-4df3-9356-d0d5422cc899), no stop by hand
-# r497f1c817d4d not live in launches list --json by 2026-10-20T22:21:07Z (5 s poll)
-r097436c91816  mosaic-stack/chief  claude-code claude-opus-5-5  by jason  since 2026-10-20T22:02:08.941Z  running
-# exit 0
-
-## W9b launches log lines for r497f1c817d4d (at, event, instance, thread, run, reason, exitCode, signal only)
-at=2026-10-20T22:06:00.766Z event=launch instance=assistant thread=446201de-e8b5-4df3-9356-d0d5422cc899 run=r497f1c817d4d
-at=2026-10-20T22:21:05.149Z event=thread-idle instance=assistant thread=446201de-e8b5-4df3-9356-d0d5422cc899 run=r497f1c817d4d
-at=2026-10-20T22:21:05.171Z event=end instance=assistant thread=446201de-e8b5-4df3-9356-d0d5422cc899 run=r497f1c817d4d reason=stopped exitCode=0 signal=null
-
-## W9b bus and webui journal since 2026-10-20 22:05:00 UTC, lines naming r497f1c817d4d or thread-idle
-2026-10-20T17:21:05.171444-05:00 dragon-lin mosaic[2950923]: mosaic-bus: run r497f1c817d4d (assistant) ended: stopped
-(grep exit 0)
-# SNAP sha256 639fd28a checked before S2 2026-10-20T22:21:07Z
-{
-  "schema": "3i",
-  "tables": {
-    "decision_events": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "28dd95056663dd5eb7442a3d815b73a4a3cd311a0e854fd82dc54f7dc3e6ef26"
-    },
-    "decisions": {
-      "rows": 21,
-      "maxSeq": 21,
-      "sha256": "fef1058660b0d128ef21089dda5e0fba7f71763d8325148fe521de0d3f57e4ad"
-    },
-    "deliveries": {
-      "rows": 1740,
-      "maxSeq": 1740,
-      "sha256": "554ce5b377ffacc72bfde11c99c920cd5d30337c8bfa217275d0073b587e2169"
-    },
-    "events": {
-      "rows": 1543,
-      "maxSeq": 1543,
-      "sha256": "0151673193d0286ce8f3b234d7d21fa2b0f43f2ceec55644cccaa5cbd77603dd"
-    },
-    "instance_names": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "message_threads": {
-      "rows": 4,
-      "maxSeq": null
-    },
-    "messages": {
-      "rows": 571,
-      "maxSeq": 571
-    },
-    "meta": {
-      "rows": 3,
-      "maxSeq": null,
-      "sha256": "89fec56e7293d19e0b2f6cd8c0ef745ebf99e4115abeaea7fbdbc98a261332d9"
-    },
-    "projects": {
-      "rows": 2,
-      "maxSeq": 2,
-      "sha256": "3435f574ab94bc2fcc65fb8605251f30d4e9e63baf38e6fdf3c39c126531aa63"
-    },
-    "role_claims": {
-      "rows": 101,
-      "maxSeq": 101,
-      "sha256": "fb47114defbb8a57dd148a06fbaf61b30f791a81f14b1510b8c32690506b4308"
-    },
-    "task_comment_cursors": {
-      "rows": 220,
-      "maxSeq": 220,
-      "sha256": "df03c84094999299499de01107ddd08636df6156f5c9ccd2ff6e8c43e459f7e4"
-    },
-    "task_snapshots": {
-      "rows": 408,
-      "maxSeq": 408,
-      "sha256": "e2243a89388afba07e8d096b4961deeb2d17c656cdcace54b46eac7001393814"
-    },
-    "thread_claims": {
-      "rows": 4,
-      "maxSeq": 4,
-      "sha256": "088b8236570d8afe03364b85803fdc5034cce2cef6ed7b16f8b99bf6366524ad"
-    },
-    "thread_opens": {
-      "rows": 0,
-      "maxSeq": null,
-      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-    },
-    "threads": {
-      "rows": 2,
-      "maxSeq": 2,
-      "sha256": "819fd24c64e279d0debad5ab5dbbe533d8e6f26de58277c69510b9cbbaadbc3a"
-    },
-    "usage_records": {
-      "rows": 34,
-      "maxSeq": 34,
-      "sha256": "de614f3d62c9b3819757c5659bee40085cb86cc873b7bfe381b13e254ddb7cad",
-      "byRun": [
-        {
-          "business": "mosaic-stack",
-          "run": "r8fba7e598156",
-          "input": "0",
-          "output": "0",
-          "unknownTurns": 1
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r4a96e2142e4d",
-          "input": "2",
-          "output": "52",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc78c9700c8e9",
-          "input": "14",
-          "output": "1519",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r293f33bcbc63",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r34520a581318",
-          "input": "6",
-          "output": "323",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r7e99838f9f93",
-          "input": "2",
-          "output": "44",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc964611b2092",
-          "input": "4",
-          "output": "120",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rbb708846b605",
-          "input": "12",
-          "output": "2089",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "rc36b17ef3788",
-          "input": "16",
-          "output": "5221",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r097436c91816",
-          "input": "2",
-          "output": "131",
-          "unknownTurns": 0
-        },
-        {
-          "business": "mosaic-stack",
-          "run": "r497f1c817d4d",
-          "input": "2",
-          "output": "80",
-          "unknownTurns": 0
-        }
-      ]
-    }
-  },
-  "untimed": [
-    "message_threads",
-    "meta",
-    "task_comment_cursors"
-  ]
-}
-# exit 0
-# S2.json sha256 1a444f5ac0049bc78e397b6928e1008cfe8cbc30989bbf2042b4ed27f56a4173
-# W9b end 2026-10-20T22:21:07Z
-rc=0
@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-# Re-pin 4429a104f, W9 tail (adapted from Darkwing's window-rows-177-185/w9b.sh, under mos-0948's ruling for that window: the launcher
-# ends the assistant run at threadIdleSeconds 900 after the 22:06:05Z reply, about 22:21:05Z). Nothing is stopped by hand. Report if live at 22:27Z.
-# usage: w9b.sh
-set -uo pipefail
-REPO=/mnt/storage/src/mosaic-stack
-WIN=/mnt/storage/src/mosaic-stack/agents/sage/work/window-repin-4429a104f
-RUN=r497f1c817d4d
-TID=446201de-e8b5-4df3-9356-d0d5422cc899
-DATA=/home/jwoltje/.mosaic-dev
-SNAP=$WIN/snapshot.mjs
-SNAP_SHA=639fd28a2674aaa03ce824e3394b4052f21cdef7d6fa49bae61a9927ed341e67
-PLAN=$REPO/agents/sage/work/window-plan/repin-4429a104f.md
-PLAN_SHA=e1272d1a391e00fb1291d47da9973c0ba342d65fcd42f583ea007e883c1f32b9
-TOOL_BLOB=3b068b1546d4020cffde5d73929d9130afe91911
-MOSAIC=$HOME/.npm-global/bin/mosaic
-DEADLINE=$(date -d "2026-10-20T22:27:00Z" +%s)
-MARK18=$(date -d "2026-10-20T22:22:00Z" +%s)
-W=$WIN/W.txt
-note() { echo "# $*" >> "$W"; echo "# $*"; }
-stop() { note "STOP: $*"; exit 1; }
-sha() { sha256sum < "$1" | cut -c1-64; }
-step() { local f="$1"; shift; $WIN/w.sh W.txt "$@" > "$WIN/$f"; local rc=$?; cat "$WIN/$f"; return $rc; }
-# launches log lines for the run: at, event, instance, thread, run, reason, exitCode, signal only
-runlog() { node -e '
-const keep=["at","event","instance","thread","run","reason","exitCode","signal"];
-for(const s of require("fs").readFileSync(process.argv[1],"utf8").trim().split("\n")){const o=JSON.parse(s);if(o.run!==process.argv[2])continue;
-console.log(keep.filter(k=>k in o).map(k=>`${k}=${o[k]}`).join(" "))}' "$DATA/launches/mosaic-stack.jsonl" "$RUN"; }
-
-note "W9b start $(date -u +%FT%TZ): waiting for the launcher to end $RUN (thread $TID), no stop by hand"
-[ "$(sha $PLAN)" = "$PLAN_SHA" ] || stop "the plan file is not e1272d1a"
-[ "$(git -C $REPO rev-parse HEAD:scripts/stack-release.sh)" = "$TOOL_BLOB" ] || stop "tool blob moved"
-END=; M18=
-while :; do
-  $MOSAIC launches list --json > $WIN/.w9b-poll.json 2>&1 || stop "launches poll"
-  LIVE=$(node -e 'const l=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));process.stdout.write(l.filter(x=>x.run===process.argv[2]&&x.live===true).map(x=>x.run).join(" "))' $WIN/.w9b-poll.json $RUN)
-  [ -z "$LIVE" ] && { END=$(date -u +%FT%TZ); break; }
-  NOW=$(date +%s)
-  if [ -z "$M18" ] && [ $NOW -ge $MARK18 ]; then M18=1; note "22:22Z mark $(date -u +%FT%TZ): $RUN still live; launches log lines for it:"; runlog | tee -a "$W"; fi
-  [ $NOW -ge $DEADLINE ] && break
-  sleep 5
-done
-if [ -z "$END" ]; then
-  note "STOP: $RUN still live at $(date -u +%FT%TZ) (22:27Z mark); a stop is Mos's call. S2 waits."
-  runlog | tee -a "$W"
-  exit 4
-fi
-note "$RUN not live in launches list --json by $END (5 s poll)"
-step .w9b-launches-after.txt "W9b launches list after the assistant run" $MOSAIC launches list
-{ echo; echo "## W9b launches log lines for $RUN (at, event, instance, thread, run, reason, exitCode, signal only)"; runlog; } | tee -a "$W"
-{ echo; echo "## W9b bus and webui journal since 2026-10-20 22:05:00 UTC, lines naming $RUN or thread-idle"; journalctl --user -u [email protected] -u mosaic-webui.service --since "2026-10-20 22:05:00 UTC" --no-pager -o short-iso-precise | grep -E "$RUN|thread-idle|threadIdle"; echo "(grep exit ${PIPESTATUS[1]})"; } | tee -a "$W"
-[ "$(sha $SNAP)" = "$SNAP_SHA" ] || stop "SNAP sha before S2"
-note "SNAP sha256 639fd28a checked before S2 $(date -u +%FT%TZ)"
-step S2.json "S2 snapshot --held" node $SNAP --store "$DATA/bus/bus.sqlite" --held || stop "S2"
-sed -i '$d' $WIN/S2.json
-note "S2.json sha256 $(sha $WIN/S2.json)"
-note "W9b end $(date -u +%FT%TZ)"
@@ -1,43 +0,0 @@
-# W0b-W4 start 2026-10-20T22:00:49Z
-# plan e1272d1a, tool blob 3b068b1546d4, P5 four scripts at NEW and clean, business-check.mjs eece4d46: checked 2026-10-20T22:00:49Z
-# W0 copy present, w0.txt LOAD_OK
-# W0b: /home/jwoltje/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-20261020T220049Z, sha256 1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93, recorded in backups.txt
-rbb708846b605  mosaic-stack/chief  claude-code claude-opus-5-5  by jason  since 2026-10-20T19:29:59.045Z  running
-rc36b17ef3788  mosaic-stack/pm  claude-code claude-opus-5-5  by chief  since 2026-10-20T20:20:56.252Z  running
-# exit 0
-# W1 start stamp 2026-10-20T22:00:49Z
-# SNAP sha256 639fd28a checked before S1
-# S1.json sha256 a7649760c3439705c8b5f3af26d0c21aea1081c1eb295fd02aef3a642064194b
-pointer: /home/jwoltje/.mosaic-dev/state/stack-active.json
-  {"copy":"490e2771d3d057ab76991e2c7859cd251857e64c","business":"mosaic-stack","pm":true,"claude":"/home/jwoltje/.local/bin/claude","console":["--port","7332","--public-host","mosaic.woltje.com","--auth-header","X-authentik-username","--allow-user","jason.woltje","--tester-port","7333"],"schema":"3i","activation":"20261020T192956Z-490e2771d3d0","at":"2026-10-20T19:30:00Z"}
-log (last five lines):
-  {"at":"2026-10-20T01:41:05Z","op":"pm-on","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","backup":null,"activation":"20261020T014103Z-89af38a83afa","result":"ok","pm":"on"}
-  {"at":"2026-10-20T07:58:00Z","op":"activate","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":null,"activation":"20261020T075800Z-490e2771d3d0","result":"started"}
-  {"at":"2026-10-20T07:58:02Z","op":"activate","from":"89af38a83afa22a8a4f0d368a0a4030ad15a0efa","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T075800Z-490e2771d3d0","activation":"20261020T075800Z-490e2771d3d0","result":"ok"}
-  {"at":"2026-10-20T19:29:56Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":null,"activation":"20261020T192956Z-490e2771d3d0","result":"started"}
-  {"at":"2026-10-20T19:30:00Z","op":"activate","from":"490e2771d3d057ab76991e2c7859cd251857e64c","to":"490e2771d3d057ab76991e2c7859cd251857e64c","backup":"20261020T192956Z-490e2771d3d0","activation":"20261020T192956Z-490e2771d3d0","result":"ok"}
-check:
-  bus: /home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c
-  Console: /home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c
-  CLI: /home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c
-  result: pass
-bus status:
-  host: mosaic-stack, pid 3229540, running, since 2026-10-20T19:29:57.662Z, notifier off
-  socket: present
-  writer.lock: pid 3229657
-  boot: organization file loaded at 2026-10-20T19:29:57.661Z
-unit flags: match the pointer
-drift: 109 commit(s) on refactor since the pointer's copy
-# exit 0
-# W3-plan.txt sha256 45de68d42b4cf88640fe0986d071dba4fa076b7db86ff4ed34de4bb6fa2915c6
-DropInPaths=
-ExecStart={ path=/home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c/scripts/mosaic ; argv[]=/home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c/scripts/mosaic bus start mosaic-stack --pm ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }
-WorkingDirectory=/home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c
-# exit 0
-DropInPaths=
-ExecStart={ path=/usr/bin/node ; argv[]=/usr/bin/node /home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c/packages/webui/src/cli.mjs serve --checkout /mnt/storage/src/mosaic-stack --port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-port 7333 ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }
-WorkingDirectory=/home/jwoltje/.local/share/mosaic-stack/copies/490e2771d3d057ab76991e2c7859cd251857e64c
-# exit 0
-# W4 checks: DropInPaths empty on both, both ExecStart name the OLD copy, bus has --pm, no quote or backslash in either ExecStart
-# W4 bus Environment: 2 assignments; quote or backslash: none (values not recorded)
-# W0b-W4 end 2026-10-20T22:00:50Z
@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-# Re-pin 4429a104f, W0b-W4 (repin-4429a104f.md at f41729178, sha256 e1272d1a...32b9; mos-1105, mos-1107 go). W0 ran before P2.
-# Adapted from Darkwing's window-rows-177-185/wsteps.sh.
-# Nothing is stopped. Each step goes through w.sh into W.txt; a failed check stops the script.
-# usage: wsteps.sh
-set -uo pipefail
-REPO=/mnt/storage/src/mosaic-stack
-WIN=$REPO/agents/sage/work/window-repin-4429a104f
-OLD=490e2771d3d057ab76991e2c7859cd251857e64c
-NEW=4429a104f6d65ccf165f6c83b5d1dce3147dfde0
-PLAN=$REPO/agents/sage/work/window-plan/repin-4429a104f.md
-PLAN_SHA=e1272d1a391e00fb1291d47da9973c0ba342d65fcd42f583ea007e883c1f32b9
-TOOL_BLOB=3b068b1546d4020cffde5d73929d9130afe91911
-BC=$REPO/agents/sage/work/window-plan/repin-de352dfaf/business-check.mjs
-BC_SHA=eece4d4671e1ce15ba81e1654c641925ac4988b343687b062897392285a8a1a7
-BIZ=$HOME/.config/mosaic-dev/businesses/mosaic-stack.json
-BIZ_SHA=1e49bdf05e62607972958f5b7298cfd600c7825812370e26d7c2a842f2af9b93
-DATA=/home/jwoltje/.mosaic-dev
-SNAP=$WIN/snapshot.mjs
-SNAP_SHA=639fd28a2674aaa03ce824e3394b4052f21cdef7d6fa49bae61a9927ed341e67
-MOSAIC=$HOME/.npm-global/bin/mosaic
-W=$WIN/W.txt
-note() { echo "# $*" >> "$W"; echo "# $*"; }
-stop() { note "STOP: $*"; exit 1; }
-sha() { sha256sum < "$1" | cut -c1-64; }
-
-note "W0b-W4 start $(date -u +%FT%TZ)"
-[ "$(git -C $REPO show f41729178:agents/sage/work/window-plan/repin-4429a104f.md | sha256sum | cut -c1-64)" = "$PLAN_SHA" ] || stop "plan at f41729178 is not e1272d1a"
-[ "$(sha $PLAN)" = "$PLAN_SHA" ] || stop "the plan file in REPO is not e1272d1a"
-[ "$(git -C $REPO rev-parse HEAD:scripts/stack-release.sh)" = "$TOOL_BLOB" ] || stop "tool blob moved"
-git -C $REPO diff --quiet $NEW HEAD -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh || stop "P5: the four scripts differ from NEW"
-[ -z "$(git -C $REPO status --porcelain -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh)" ] || stop "P5: the four scripts are dirty"
-[ "$(sha $BC)" = "$BC_SHA" ] || stop "business-check.mjs sha"
-note "plan e1272d1a, tool blob 3b068b1546d4, P5 four scripts at NEW and clean, business-check.mjs eece4d46: checked $(date -u +%FT%TZ)"
-
-# W0 ran at 21:45:57Z (w0.txt): the copy must still be there with LOAD_OK recorded.
-[ -f "$HOME/.local/share/mosaic-stack/copies/$NEW/scripts/mosaic" ] || stop "W0 copy missing"
-grep -qx LOAD_OK $WIN/w0.txt || stop "w0.txt has no LOAD_OK"
-note "W0 copy present, w0.txt LOAD_OK"
-
-# W0b
-[ "$(sha $BIZ)" = "$BIZ_SHA" ] || stop "business file sha256 is not P1's 1e49bdf0"
-STAMP=$(date -u +%Y%m%dT%H%M%SZ)
-COPY=$BIZ.pre-window-$STAMP
-[ ! -e "$COPY" ] || stop "$COPY exists"
-cp -p "$BIZ" "$COPY" || stop "W0b cp"
-[ "$(sha "$COPY")" = "$BIZ_SHA" ] || stop "W0b copy sha256"
-echo "W0b $(date -u +%FT%TZ) business file copy $COPY sha256 $(sha "$COPY") (source $BIZ sha256 $(sha "$BIZ"))" >> $WIN/backups.txt
-note "W0b: $COPY, sha256 $(sha "$COPY"), recorded in backups.txt"
-
-# W1
-$WIN/w.sh W.txt "W1 agents --tester" $MOSAIC agents --business mosaic-stack --tester > $WIN/.w1-agents.txt || stop "W1 agents"
-grep -E '(^|[[:space:]])chief[[:space:]].*working' $WIN/.w1-agents.txt && stop "W1: the chief is working"
-$WIN/w.sh W.txt "W1 launches list" $MOSAIC launches list || stop "W1 launches list"
-note "W1 start stamp $(date -u +%FT%TZ)"
-[ "$(sha $SNAP)" = "$SNAP_SHA" ] || stop "SNAP sha before S1"
-note "SNAP sha256 639fd28a checked before S1"
-$WIN/w.sh W.txt "S1 snapshot --held" node $SNAP --store "$DATA/bus/bus.sqlite" --held > $WIN/S1.json || stop "S1"
-sed -i '$d' $WIN/S1.json   # w.sh prints "# exit N" last; S1.json keeps the snapshot only
-note "S1.json sha256 $(sha $WIN/S1.json)"
-
-# W2
-$WIN/w.sh W.txt "W2 status" scripts/stack-release.sh status mosaic-stack || stop "W2 status"
-
-# W3
-$WIN/w.sh W.txt "W3 activate NEW --pm --plan" scripts/stack-release.sh activate $NEW mosaic-stack --pm --plan > $WIN/W3-plan.txt || stop "W3 plan exit"
-sed -i '$d' $WIN/W3-plan.txt
-note "W3-plan.txt sha256 $(sha $WIN/W3-plan.txt)"
-
-# W4
-$WIN/w.sh W.txt "W4 bus unit (Environment omitted from the transcript)" systemctl --user show [email protected] -p ExecStart -p WorkingDirectory -p DropInPaths || stop "W4 bus"
-$WIN/w.sh W.txt "W4 webui unit" systemctl --user show mosaic-webui.service -p ExecStart -p WorkingDirectory -p DropInPaths || stop "W4 webui"
-BUSL=$(systemctl --user show [email protected] -p ExecStart -p DropInPaths -p WorkingDirectory)
-WEBL=$(systemctl --user show mosaic-webui.service -p ExecStart -p DropInPaths -p WorkingDirectory)
-for u in BUSL WEBL; do v=${!u}; grep -qx 'DropInPaths=' <<< "$v" || stop "W4 $u DropInPaths not empty"; grep '^ExecStart=' <<< "$v" | grep -q "copies/$OLD/" || stop "W4 $u ExecStart does not name the OLD copy"; grep '^ExecStart=' <<< "$v" | grep -q "copies/$NEW" && stop "W4 $u ExecStart names NEW"; grep '^ExecStart=' <<< "$v" | grep -q "[\"'\\\\]" && stop "W4 $u ExecStart has a quote or backslash"; done
-grep '^ExecStart=' <<< "$BUSL" | grep -q -- ' --pm' || stop "W4 bus ExecStart has no --pm"
-note "W4 checks: DropInPaths empty on both, both ExecStart name the OLD copy, bus has --pm, no quote or backslash in either ExecStart"
-ENVL=$(systemctl --user show [email protected] -p Environment)
-note "W4 bus Environment: $(tr ' ' '\n' <<< "${ENVL#Environment=}" | grep -c =) assignments; quote or backslash: $(grep -q "[\"'\\\\]" <<< "$ENVL" && echo FOUND || echo none) (values not recorded)"
-note "W0b-W4 end $(date -u +%FT%TZ)"
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0981, thread 03086006). Reviews Case 2 designs and MVP T1 rows 192 and 194.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `webby/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `webby/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1361,9 +1361,3 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T18:34:53Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r2 (DESIGN.md blob 3eb718b5e131 at 1a268249e), static | changes: C1 config.json console key fails old loaders (mosaic-config.mjs:113 rejects unknown keys; key add inside phase 2 window, rollback removes it, loader test), C2 app.js signs out only on opaqueredirect so 401 never shows sign-in; notes on tests 15/7/9a, Q-B 200-HTML classification, scratch Console flags; Q-E keep iss/sub escaped and capped; verdict sent to Sage, no Gitea/queue record
 2026-10-20T18:40:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r3 (DESIGN.md blob a152fd58e18e at 817e8f51b), static | approve on condition D1 (slot file checks stay out of shared loader, shape-only there) as a line edit; D2 notes: slot root from configDir, scratch dataRoot, name discovery GETs for Mos; C1/C2 and notes verified; Mos C1 sequence confirm still open; no Gitea/queue record
 2026-10-20T18:41:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design D1/D2 check (DESIGN.md blob eba861f5d2bb at d55d86bb0), static git diff 817e8f51b..d55d86bb0 | ack: D1 and D2 match; design approved; Mos C1 sequence confirm still open; no Gitea/queue record
-2026-10-20T18:57:10Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r2 (#1688, DESIGN.md sha256 5493c9df3ec0) | CHANGES to Darkwing, cc Sage: B1 claim check on MOSAIC_CONFIG-only selection, B2 shared prefix drop-in dirs; N1-N7 notes; static read, no slot, no Gitea or queue record
-2026-10-20T19:00:04Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r3 (#1688, DESIGN.md sha256 98236a1aff98) | APPROVE to Darkwing, cc Sage: B1 and B2 closed with M13 and M14, N7 settled by Sage's 48ebee0ff; static read, no slot; manifest round gets a queue review record (sage-1337)
-2026-10-20T20:40:15Z | Filbert (Opus 5.5, 048f3c63) | row 190 (#1688) manifest round 1 review, candidate 8862feccc (static) | CHANGES: B1 base drift, row 189 ace27dc5e conflicts in stack-release.sh, rebase + full gate rerun; N1-N7 notes; Gitea 29634, queue rev 2362 (uncommitted, left for Sage)
-2026-10-20T21:29:20Z | Filbert (Opus 5.5, 048f3c63) | row 190 (#1688) manifest round 2 review, candidate 537a02392 (static) | CHANGES: B1 base drift, row 192 4429a104f conflicts in mosaic-config.mjs and webui-service.sh (async load); round 2 content fine; Gitea 29685, queue rev 2447 (uncommitted, left for Sage)
-2026-10-20T22:16:20Z | Filbert (Opus 5.5, 048f3c63) | row 190 (#1688) manifest round 3 review, candidate df65a3d4c on darkwing/row190-r3 | APPROVE, Gitea 29713, queue rev 2504 (left for Sage's queue-commit); static review, no slot used
-2026-10-20T22:53:10Z | Darkwing (Opus 5.5, 7525c8e4) | row 190 (#1688) rounds 1-3; row 195 (#1693) design r5-r6 | 190 landed by Sage as 00d4cc1f6 (patch-id matches 176a6bf4b..df65a3d4c, gate 2664/0 + 429/0, rev 2508 done, #1688 closed, not live). My r3 gate 2042/0 and mutants 20/20 in slot sage-1512; Filbert APPROVE 29713; sha sent to Rocko for row 191. 195 r6 b7239bb66 approved (duckworth-0055); build held for the Q187 installer (Vikunja #432)
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`copied: /home/jwoltje/.local/share/mosaic-stack/copies/4429a104f6d65ccf165f6c83b5d1dce3147dfde0`