agents: row 195 Case 1 install design r6 (#1693 ): Duckworth r5 B1 (confirm's result lines carry the activation's op, from, to and the rollback set's BACKUP, so from_log reads .53's log; sequence 7), B2 (MIGRATING recorded after backup_store and before migrate-schema.mjs, as TAKEN today; sequence 8), N1 marker step makes $RS, N2 gate --since, N3 apparmor.d word grep baseline, N4 item 4 under systemd-run with NoNewPrivileges, N5 plan --expect-from OLD

agents: row 195 Case 1 install design r5 (#1693 ): Duckworth r4 B1 (one result line per activation, FAILED file and --cause, marker written first, refusals log no activation, real-sequence tests), B2 per mos-1098/mos-1101 (case1-pins.sh and case1-hostcheck.sh, seven-item drift stop with apt hook and boot unit, ops-01 owner, bwrap closed on drift), N1-N4; Console on 127.0.0.1:732 with CAP_NET_BIND_SERVICE, tester 7333 as P10; chains on row 190 r3 and row 230 (C2-13a), node under /opt, four factory profile items for Gosalyn
agents: row 195 Case 1 install design r4 (#1693 ): Duckworth B1 (root holds only the go's values and the unit files; confirm and revert find the one open activation, AWAITING-UNITS; rollback --to checked against from_log previous; A2 failure path; root step log), B2 (confirm runs gate with --timeout; .53 runs the PM; external PM check reads launches list with ActiveEnterTimestamp, no journal; pm-on refuses), N1-N5; mos-1096 bwrap-userns-restrict from the pinned deb, dpkg-statoverride root:mosaic 0750, P9 accepted by Mos; gosalyn-0046 two units and args file; managed settings for DISABLE_AUTOUPDATER; sage-1481 C2-13a
2026-10-20 16:53:53 -05:00 · 2026-10-20 16:46:21 -05:00 · 2026-10-20 16:08:53 -05:00 · 2026-10-20 15:56:54 -05:00 · 2026-10-20 15:38:55 -05:00 · 2026-10-20 15:34:55 -05:00
87 changed files with 14647 additions and 39 deletions
@@ -16,6 +16,17 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Rocko | General development, investigation, testing, and review | T3 session (Codex, gpt-6.1-sol, thread d99326cc, lead decision 122; Claude thread b84bb264 retired 2026-10-12); launcher Claude Code, Sonnet model | `agents/rocko/launch.sh` |
 | Filbert | General development, investigation, testing, and review | T3 session (Claude, Opus 5.5, thread 048f3c63, non-sandbox reviews only, lead decisions 130 and 134; Codex threads f712d8af and 50342f6a retired 2026-10-13, Claude thread 9cb9731e retired 2026-10-12); launcher Pi, `openai-codex/gpt-6-astra:low`, not to be used under R26 until it changes (lead decision 69) | `agents/filbert/launch.sh` |
 | Researcher | Source-grounded technical research and evidence | T3 session (Claude, Sonnet 5.5, thread 9bac0794, rows 97 and 98, lead decision 124); Haiku rows (71, 80, 84, 88, later 96) run as subagents Sage dispatches with model haiku, effort high and a worktree (lead decision 129); Haiku thread c98aaf4a retired 2026-10-13 unused; launcher Pi, configured Mosaic model | `agents/researcher/launch.sh` |
+| Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
+| Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
+| Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
+| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
+| Herb | Builder, a second gate lane (#1695) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
+| Bushroot | Builder, retire the control board writer on 7331 (#1696) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1008 | none, T3 only |
+| Megavolt | Builder, MVP T1 item 6 (agent credentials and git identity, #1697) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
+| Quackerjack | Builder, federation R5 and R2 (#414) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1023 | none, T3 only |
+| Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
+| Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
+| Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |

 Each script supports `--check` and `--fresh`. Normal launches resume the agent's
@@ -0,0 +1,8 @@
+# Bushroot
+
+Builder seat, Claude Haiku 5.5, started by Sage under mos-1008 item 2 (a low-level model under Q177) for the row
+that retires the control board writer on 7331 (#1696).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `bushroot/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,872 @@
+# Row 195 design: the Case 1 install on 10.1.1.53 (r6)
+
+Darkwing, 2026-10-20. Brief: `docs/plans/2026-10-20_hub-own-uid.md`, blob 45be7f09afc1 (f24f2cd40,
+sage-1439). Gitea #1693. Reviewer Duckworth, gate owner Sage. Chained on row 190's candidate (round 3,
+df65a3d4c on `darkwing/row190-r3`, rebased on row 192; the config canon) and on row 230's candidate
+(C2-13a, #1732, Gosalyn: `scripts/case2-unit.sh` and `case2-precheck.sh`), Q177, sage-1499. Row 230's
+brief is `docs/plans/2026-10-20_case2-rows.md` "C2-13a" at 5b8def2f1, from Gosalyn's design r11
+(eac92d956 on `gosalyn/case2-design`, approved webby-0038). It has no candidate yet, so I read that
+brief as the interface and expect a rebase. Section 2 lists what Case 1 needs from it that the brief
+doesn't give.
+
+Changes from r5 (Duckworth's REVIEW-r4.md at 62200362b on `duckworth/reviews`, duckworth-0054). This
+round changes only B1's and B2's lines, their section 7 cases and the notes:
+
+- B1. The result line `confirm` writes said op `confirm`, because `log_line` (:58) writes `$OP` and
+  `OP="$1"` (:1493). `from_log` (:169) reads only `adopt`, `activate` and `rollback`, so it would have
+  skipped every .53 activation: after adopt C0 and re-pins to C1 and C2, `from_log previous` returns
+  C0. Now A5's `ok` line and R4's line carry the op, from and to of the activation's `started` line,
+  and the backup that A3 records in the rollback set. Real sequence 7 and a mutant that writes op
+  `confirm`. Section 4.
+- B2. r5 recorded the migration after the migrate, while today's run sets TAKEN before
+  `migrate-schema.mjs` (:1004-1005). A migrate that changed the store and then exited 1 would have
+  left no record, so R2 would skip the restore and R4 would gate OLD on a half-migrated store. A3 now
+  writes `MIGRATING` after `backup_store` returns and before the migrate. Real sequence 8 and a mutant
+  that records after the migrate. Section 4.
+- N1. The marker step makes `$RS` with capture's exclusive `mkdir` (:416), and capture under
+  `--units external` makes none. N2. `gate` takes `--since T`, root's clock before its A2f start, as
+  its start floor. N3. Section 0 now has a read-only grep of `/etc/apparmor.d` for the word `bwrap`,
+  and item 3 matches the word against a list of exactly one file. N4. Item 4 runs under
+  `systemd-run` with the units' `NoNewPrivileges=yes`, as 2a' does. N5. A1's plan takes
+  `--expect-from OLD` and refuses `pointer-differs`.
+- Not in this round: claude's path. gosalyn-0058 proposes that `--claude`, like `--node`, takes only a
+  root-owned path outside the home, and `/srv/mosaic/.local/bin/claude` fails that. I asked Sage to
+  rule and recommended moving claude under `/opt/mosaic-stack`. That change gets its own round.
+
+Changes from r4 (Duckworth's REVIEW-r3.md at 9f4d5556b on `duckworth/reviews`; mos-1098; mos-1101;
+gosalyn-0049):
+
+- B1. An activation now has exactly one result line, written at the end. A5's gate failure and A3's
+  failure after its capture write no log line. Each writes a `FAILED` file next to `AWAITING-UNITS` and
+  exits 1, so the activation stays open for R2 and R4, and R4 writes the result. A3 writes
+  `AWAITING-UNITS` right after `started`. Refusals by `confirm`, `revert` and `gate` log no activation
+  id, so a refused `confirm` can't close one either. There are real-sequence tests on one log, and
+  mutants that put back r4's interim line, r4's marker order and a refusal that names the activation.
+  Section 4 and section 7.
+- B2. The bwrap profile has an owner and a stop. `scripts/case1-hostcheck.sh` checks the profile file
+  against the pin in `scripts/case1-pins.sh`, the two loaded profiles, the live label of a process
+  bwrap runs, the statoverride and mode, that no other profile names bwrap, two sysctls and the port
+  floor. It has three callers:
+  1. A1 of every re-pin refuses `profile-drift`.
+  2. A root apt hook runs it after every package run, unattended ones included.
+  3. A boot unit runs it before the bus starts.
+
+  On drift, callers 2 and 3 unload the profile and close `/usr/bin/bwrap` to `mosaic`, so every role
+  session refuses to start. They write `DRIFT` and log it, and only root clears it. ops-01 owns the host
+  side under a Mos go: it reads the log in each STATE report and, before each re-pin window, compares
+  the upstream profile to the pin. A changed upstream profile becomes a new pin, which is its own review
+  round. Section 1 has the details. The facts behind it are in section 0: unattended-upgrades runs daily
+  on .53 with the security pocket, and the pinned bubblewrap is in that pocket.
+- N1 and mos-1098 point 2. P9 has a seventh item: no `mosaic-bwrap` profile is loaded, and no profile
+  other than Ubuntu's attaches to `/usr/bin/bwrap`. r4 never installed `mosaic-bwrap`. F5 now compares
+  exact strings. P9 reads `accepted mos-1096` only while all seven items hold.
+- N2: a role session gets no capabilities, so a nested bwrap fails. Section 1. N3: A3 refuses "before
+  it logs `started`". N4: the stale-start rule and its fixtures handle `ActiveEnterTimestamp`'s whole
+  seconds.
+- The port squat (mos-1101 item 5, gosalyn-0049). It applies: role sessions share the host's network
+  namespace (`packages/seat/src/sandbox.mjs:67` unshares no net), so while the Console is down a
+  session can bind its loopback port. The Console moves to 127.0.0.1:732 with
+  `CAP_NET_BIND_SERVICE` on its unit (row 230's line), so no session can take it. The tester port stays
+  7333, because serve refuses a tester port below 1024. That residue is P10, accepted under Mos's
+  reading. Case 1 can't meet the preview trio or the proof pair, because .53 has no proxy. Section 2
+  names the factory serve set for row 230.
+- Jason's Q9 (Vikunja #429) is still open. If install and upgrade become product commands, these
+  steps become that installer's configuration and row 195 rebases on its row (sage-1491). Section 6.
+
+## 0. What I checked on the host
+
+Read only, as `localadmin` over ssh, 2026-10-20 between 20:40Z and 21:00Z, and again at 21:27Z for the
+last seven rows (the brief allows this):
+
+| Item | 10.1.1.53 today | Needed |
+|---|---|---|
+| OS | Ubuntu 24.04.5, kernel 6.8.0-124, x86_64, 12 cores, 94 GiB, 217 GiB free on `/` | fits |
+| `mosaic` user, group, `/srv/mosaic` | absent | step 2a creates them |
+| node | `/usr/local/bin/node` v22.22.2, root-owned | 24 or later (every `packages/*/package.json` engines line); dragon-lin runs 26.8.1 |
+| bwrap | absent, no statoverride; apt candidate `bubblewrap 0.9.0-1ubuntu0.3` | every role session runs under `/usr/bin/bwrap` (`packages/seat/src/sandbox.mjs:43`) |
+| user namespaces | `kernel.apparmor_restrict_unprivileged_userns = 1`, apparmor 4.0.1, no bwrap profile loaded | bwrap needs a user namespace, which this setting refuses unless a profile allows it |
+| `apparmor-profiles` | not installed; candidate `4.0.1really4.0.1-0ubuntu0.24.04.9`, whose `/usr/share/apparmor/extra-profiles/bwrap-userns-restrict` has sha256 `11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9` (read from the deb on dragon-lin) | section 1 |
+| `fs.protected_hardlinks`, `fs.protected_symlinks` | 1, 1 | mos-1096 item 2 |
+| journald | `SplitMode=uid` (the default) | section 4, B2 |
+| `useradd` | `USERGROUPS_ENAB yes` | 2a passes `--user-group` anyway |
+| claude | not on localadmin's PATH | the factory's harness; dragon-lin runs 2.1.304 |
+| ports 7330-7333 | free (no listener) | tester |
+| `localadmin` | NOPASSWD sudo (#423 step 1, applied 20:05:47Z, mos-1066, mos-1077) | the root steps run through it |
+| `jarvis` | groups sudo, docker, lxd, adm | #423 step 4 removes all four (section 5, P5) |
+| unattended-upgrades | on: `APT::Periodic::Unattended-Upgrade "1"`, `apt-daily-upgrade.timer` enabled. Allowed origins `${distro_id}:${distro_codename}`, `-security`, ESM apps-security and ESM infra-security. No `Package-Blacklist` | B2: packages change daily without a window |
+| bubblewrap's pocket | `0.9.0-1ubuntu0.3` is in both `noble-updates` and `noble-security`, so its later security updates install unattended | B2 |
+| apparmor | installed `4.0.1really4.0.1-0ubuntu0.24.04.8`. The `.9` candidate is in `noble-updates` only, which unattended-upgrades doesn't take. `aa-status --json` works | B2 |
+| profiles that name bwrap | at 21:51:46Z `grep -rlw bwrap /etc/apparmor.d` and `grep -rlF /usr/bin/bwrap /etc/apparmor.d` both find nothing (exit 1). After 2a' the word grep lists only `bwrap-userns-restrict` | N1, P9 item 7, hostcheck item 3 |
+| `net.ipv4.ip_unprivileged_port_start` | 1024 | the port squat |
+| listeners below 1024 | 22 (sshd) and 53 (the resolver) only; 732 is free | the Console's port (section 1) |
+| other listeners | 4003, 6052, 6055, 8123, 8765, 14242, 18555, and on loopback 1933, 5905, 6085, 6379, 6380, 9119, 9225, 18554, 18789, 38147 | none in 7330-7333 |
+
+## 1. The install as inputs to the Case 2 scripts
+
+Instance. Row 190's canon with the default name, `dev`, as Case 2 uses it (Gosalyn design 9). `~` is
+`mosaic`'s home, `/srv/mosaic`, so:
+
+| Input | Value |
+|---|---|
+| user | `mosaic`, primary group `mosaic` with no other member |
+| home | `/srv/mosaic`, 0700, owner `mosaic` |
+| config dir | `/srv/mosaic/.config/mosaic-dev` |
+| data root | `/srv/mosaic/.mosaic-dev`, marker `instance.json` `{"instanceVersion":1,"name":"dev"}` |
+| business | `mosaic-stack`, file `<configDir>/businesses/mosaic-stack.json` (section 2) |
+| profile | `--profile factory` (row 230, C2-13b) |
+| roles | the factory set in section 2 |
+| human id | Jason's id, given in the window's go. Not `tester` (`broker.mjs:245`) |
+| model credential | `<configDir>/secrets/claude-session.env`, 0600 (row 190's `SESSION_ENV` for the default instance) |
+| token slot path | none for this row (section 2) |
+| Console port | 127.0.0.1:732, below the port floor, bound through the Console unit's `CAP_NET_BIND_SERVICE` (row 230). The port squat below says why |
+| tester port | 127.0.0.1:7333 (P10) |
+| board | none. UNITS has no board unit, and the Console gets no `--board` |
+| harness | claude at `/srv/mosaic/.local/bin/claude`, pinned through `MOSAIC_CLAUDE_BIN` (decision 91), which the bus unit's `@CLAUDE_ENV@` line sets (section 2) |
+| node | `/opt/mosaic-stack/node-<version>/bin/node`, a pinned 26.x release, `root:root`. Row 230 refuses a `--node` under the home or not owned by root |
+| PM | on: the bus unit's `@PM_FLAGS@` renders ` --pm` (section 2, section 4) |
+| source | `/srv/mosaic/src/mosaic-stack` (`mosaic`'s checkout, section 4) and `/root/mosaic-stack` (root's) |
+
+Why `dev` and not a named instance: one instance per OS user, and Case 2's rows already assume
+`/srv/mosaic/.config/mosaic-dev`. A second instance under `mosaic` on .53 would need a name, and row 190
+makes that a flag, not a move.
+
+Why node lives under `/opt/mosaic-stack`: changing `/usr/local/bin/node` would change what Hermes and
+anything else on the host runs, and Q181 keeps Hermes running. r4 put node under `/srv/mosaic`, but row
+230 requires a root-owned `--node` outside the home. Nothing else on the host puts `/opt/mosaic-stack`
+on its PATH.
+
+PATH for `mosaic`'s steps. `sudo -u mosaic -H` resets PATH to sudo's `secure_path`, which finds
+`/usr/local/bin/node`, v22. The precheck would then refuse, and `scripts/mosaic` would run v22 (it runs
+`exec node` from PATH, `scripts/mosaic:22-40`). So every `mosaic` step in the run sheet and in
+`case1-repin.sh` runs as `sudo -u mosaic -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin ...`, the
+list row 230 renders as the units' `@PATH@`. `case1-repin.sh` builds it from the `--node` in
+`case1-unit.args`.
+
+The units (row 230, design r11). Two system units, from the existing templates, in start order:
+`[email protected]` from `packages/cli/systemd/mosaic-bus.service.in`, then
+`mosaic-webui.service` from `packages/webui/systemd/mosaic-webui.service.in`. Root stops them in the
+reverse order. `@REPO@` is the copy dir, and `%h` becomes the literal home. Row 230 adds
+`ProtectSystem=strict`, `ReadWritePaths=/srv/mosaic`, `ProtectHome=yes` and `PrivateTmp=yes` to both, and
+`AmbientCapabilities=CAP_NET_BIND_SERVICE` with `CapabilityBoundingSet=CAP_NET_BIND_SERVICE` to the
+Console only. The Console unit has no `[Install]`, so root starts it by hand after a reboot until Jason
+rules (mos-1097). The install call is:
+
+```
+case2-unit.sh --profile factory --user mosaic --home /srv/mosaic --business mosaic-stack --copy ID \
+  --node /opt/mosaic-stack/node-<version>/bin/node --pm --claude /srv/mosaic/.local/bin/claude \
+  -- --port 732 --business mosaic-stack --tester-port 7333
+```
+
+`--pm` and `--claude` are the two inputs row 230's brief doesn't have yet (section 2). A re-install
+must pass the same `--node`, flags and serve flags, and only the copy id may change (row 230's
+re-install check). So 2c writes the whole argument list, without `--copy`, to
+`/etc/mosaic-stack/case1-unit.args`, `root:root` 0644, one argument per line. Every later
+`case2-unit.sh` call in section 4 reads that file and adds `--copy`. `mosaic` can't write it. Changing
+a serve flag is a re-install with its own go, not a re-pin.
+
+The port squat (mos-1101 item 5). Role sessions share the host's network namespace:
+`packages/seat/src/sandbox.mjs:67` unshares the user, PID and IPC namespaces and not the network. So
+while the Console is down, which A2 to A4 of every re-pin and any crash before `Restart=on-failure`
+brings it back both cause, a session can bind 127.0.0.1:7332. It would then receive Jason's `ssh -L`
+traffic, and it would answer the gate's `/healthz` (`stack-release.sh:485-487`) in the Console's place.
+At 732 that can't happen. The floor is 1024 (section 0), a session has no capabilities (below), and
+`mosaic`'s own processes outside the sandbox have none either. Only the Console unit holds
+`CAP_NET_BIND_SERVICE`. Its children, the human-cli and read scripts it spawns
+(`packages/webui/src/bus.mjs:31`, `reads.mjs:79`), inherit the ambient capability. No role session
+descends from the Console: sessions are children of the bus unit, which has no capability line. The
+gate needs no change, because `console_port` (`stack-release.sh:213-215`) reads the Console's `--port`
+from the pointer. Row 230's precheck refuses when the floor is at or below the Console's port, and
+`case1-hostcheck.sh` checks it after every package run (B2). The tester port can't go below 1024,
+because serve refuses that (`packages/webui/src/cli.mjs:33`), so P10 records it.
+
+Node download (N4). The run sheet pins one release, its tarball name and its sha256. As root, in a
+root-owned temp dir: fetch the tarball, `SHASUMS256.txt` and `SHASUMS256.txt.asc`; `gpg --verify` the
+`.asc` against the Node release keys listed in the nodejs/release-keys repository, imported into a
+keyring under `/etc/mosaic-stack/node-keys`; check that the tarball's line in the verified file is the
+pinned sha256; then `sha256sum -c` the tarball and unpack it to `/opt/mosaic-stack/node-<version>`,
+`root:root`, no file writable by group or other. Any mismatch stops the step. Rollback: `rm -r` that
+dir.
+
+Claude (N5). The run sheet pins the version, 2.1.304 unless the window's plan names a newer one. As
+`mosaic`: `npm install --prefix /srv/mosaic/.local @anthropic-ai/claude-code@<pin>`, with `@<pin>`
+exact. `/srv/mosaic/.local/bin/claude` is the path `MOSAIC_CLAUDE_BIN` names. The autoupdater stays off
+through `/etc/claude-code/managed-settings.json`, `root:root` 0644, holding
+`{"env":{"DISABLE_AUTOUPDATER":"1"}}`. Root writes it in 2a'. Why there:
+
+- `ENV_ALLOW` (`packages/seat/src/session.mjs:83-88`) doesn't pass `DISABLE_AUTOUPDATER`, so a unit
+  `Environment=` line never reaches a role session (gosalyn-0046 item 3).
+- A role session's HOME is the run's own `home/`, and the sandbox doesn't show `~/.claude`
+  (`session.mjs:92-93`, `sandbox.mjs:16`). So `mosaic`'s claude settings file doesn't reach one either.
+- The sandbox mounts `/etc` read-only (`sandbox.mjs:85`), and Claude Code reads managed settings from
+  `/etc/claude-code/` whatever HOME is. `mosaic`'s own CLI runs, like the precheck's marker prompt
+  and F6, read it too.
+
+The pinned binary is a read-only bind inside the sandbox (`sandbox.mjs:9-10`), so a session can't
+rewrite it anyway. The managed file covers `mosaic`'s runs outside the sandbox. If the installed
+version doesn't honour `env` there, F6 catches the drift. Rollback: `rm` the file.
+
+bwrap and the user namespace (mos-1091 4a, 4b; mos-1096 item 2; N1). Three root steps in 2a', in this
+order, each with its rollback. The `mosaic` group must exist first (2a).
+
+1. `apt-get install bubblewrap=0.9.0-1ubuntu0.3`, the version the run sheet pins. Then record
+   `stat -c '%U:%G %a' /usr/bin/bwrap` to `/etc/mosaic-stack/bwrap.orig` (I expect `root:root 755`).
+   Rollback: `apt-get remove bubblewrap`.
+2. Ubuntu's own `bwrap-userns-restrict`, one file, not the package. `apt-get download
+   apparmor-profiles=4.0.1really4.0.1-0ubuntu0.24.04.9` into a root-owned temp dir, extract
+   `./usr/share/apparmor/extra-profiles/bwrap-userns-restrict` with `dpkg-deb --fsys-tarfile`, check
+   its sha256 is `11d39094f044f0cda0febb3ad517b830301da6b2ce929664af09ee9e4dd264f9`, and install it as
+   `/etc/apparmor.d/bwrap-userns-restrict`, `root:root` 0644. Load it with `apparmor_parser -r
+   /etc/apparmor.d/bwrap-userns-restrict`. `aa-status` then lists `bwrap` and `unpriv_bwrap` in
+   enforce mode. Why one file: the package also installs 20 profiles under `/etc/apparmor.d`
+   (`usr.sbin.dnsmasq`, `bin.ping`, `usr.sbin.smbd` and more), which would load at the next boot and
+   could change services on the host that have nothing to do with Mosaic.
+   What the profile does: `bwrap` gets `userns`, `capability` and `mount` for its own setup, and
+   every program it runs is stacked under `unpriv_bwrap`, which has the same file and network rules
+   with `audit deny capability`. So a role session gets a user namespace and no capabilities in it.
+   The sysctl stays at 1, so nothing else on the host gains user namespaces.
+   One consequence (N2): a bwrap that a session starts inside its own sandbox fails, because it needs
+   capabilities in the namespace. Claude Code's own sandbox is such a bwrap, and it's off by default,
+   so a role session doesn't use it. F3 shows a session still answers under the profile.
+   Rollback: `apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict`, then `rm` it.
+3. `dpkg-statoverride --update --add root mosaic 0750 /usr/bin/bwrap` (Mos). Only root and the
+   `mosaic` group can read or run bwrap, and package upgrades keep the mode. Rollback:
+   `dpkg-statoverride --remove /usr/bin/bwrap`, then `chown` and `chmod` to the values in
+   `bwrap.orig`.
+4. The drift stop (B2, below): `case1-hostcheck.sh` and `case1-pins.sh` from `/root/mosaic-stack` to
+   `/usr/local/lib/mosaic-stack/`, `root:root` 0755 and 0644; the apt hook
+   `/etc/apt/apt.conf.d/80mosaic-hostcheck`; the boot unit `mosaic-hostcheck.service`, enabled. Then
+   `case1-hostcheck.sh --check` exits 0. Rollback: disable and remove the unit, `rm` the hook file and
+   the dir.
+
+Full rollback runs 4, 3, 2, 1. Tests after 2a' and again in section 5: as `mosaic`, `bwrap --unshare-all
+--ro-bind / / true` exits 0 (row 230's precheck line, F4); as `jarvis`, `/usr/bin/bwrap --version`
+fails with "Permission denied" (P9); `getent group mosaic` lists no member and no other account has
+gid `mosaic` (P9); `fs.protected_hardlinks` is 1 (P9). A role session running under the profile is F5.
+
+One more test runs in 2a', because I can't settle it from here. Row 230's units keep the templates'
+`NoNewPrivileges=yes`, and AppArmor limits profile changes for a task with no-new-privs set. The
+`bwrap` attach happens on exec from an unconfined task, and the child's change is a stack
+(`bwrap//&unpriv_bwrap`), which only narrows. I expect both to pass under no-new-privs, since bwrap
+sets no-new-privs on itself before it runs the child, and Ubuntu's profile works with that. But I
+haven't seen it run, and .53 is read-only to me. So as root, after step 4: `systemd-run --wait --pipe
+--uid=mosaic --gid=mosaic -p NoNewPrivileges=yes -p ProtectSystem=strict -p ProtectHome=yes -p
+PrivateTmp=yes /usr/bin/bwrap --unshare-user --unshare-pid --ro-bind / / cat /proc/self/attr/current`
+prints `bwrap//&unpriv_bwrap (enforce)`. If it fails, the window stops at 2a' and rolls back 4 to 1,
+before any `mosaic` step. That beats finding it at F5.
+
+The drift stop (B2, Duckworth's REVIEW-r3 B2, mos-1098 point 1). r4 installed a profile file that no
+package owns, from a pinned deb, onto a host where unattended-upgrades changes packages every day
+(section 0). Three things can move under it: bubblewrap (its security updates install unattended), the
+`apparmor` package and its parser, and any new profile a package ships that attaches to
+`/usr/bin/bwrap`. Two more host values matter to this design: the user-namespace sysctl and the port
+floor. So:
+
+- `scripts/case1-pins.sh` holds the pins, sourced by the scripts below: the `apparmor-profiles` version
+  the file came from, the file's sha256, and the bubblewrap version 2a' installs. Changing a pin is a
+  reviewed commit and its own round. The bubblewrap version is an install pin, not a drift item:
+  a security update to bubblewrap keeps the statoverride, and the profile attaches by path.
+- `scripts/case1-hostcheck.sh` checks seven items and prints one line each:
+  1. `/etc/apparmor.d/bwrap-userns-restrict` has the pinned sha256, and `dpkg -S` finds no package
+     that owns it.
+  2. `aa-status --json` lists `bwrap` and `unpriv_bwrap` in enforce mode, and no loaded profile named
+     `mosaic-bwrap`.
+  3. `grep -rlw bwrap /etc/apparmor.d` lists exactly `/etc/apparmor.d/bwrap-userns-restrict`. The word
+     match also catches a path written as `/{usr/,}bin/bwrap`. Section 0's read found no file today.
+  4. The live label: 2a' line `systemd-run --wait --pipe --uid=mosaic --gid=mosaic -p NoNewPrivileges=yes
+     -p ProtectSystem=strict -p ProtectHome=yes -p PrivateTmp=yes /usr/bin/bwrap --unshare-user
+     --unshare-pid --ro-bind / / cat /proc/self/attr/current` prints exactly `bwrap//&unpriv_bwrap
+     (enforce)`. It runs under the units' no-new-privs, so it reads the label a role session gets.
+     This catches a profile that attaches by a glob that item 3's search misses.
+  5. `dpkg-statoverride --list /usr/bin/bwrap` reads `root mosaic 0750`, and `stat` agrees.
+  6. `kernel.apparmor_restrict_unprivileged_userns` is 1 and `fs.protected_hardlinks` is 1.
+  7. `net.ipv4.ip_unprivileged_port_start` is above the Console's `--port` in the installed unit.
+
+  `--check` exits 0 when all hold and 1 otherwise. `--enforce` runs the same check and always exits 0.
+  On a failure, or while `/etc/mosaic-stack/DRIFT` exists, it applies the stop:
+  `apparmor_parser -R` on the profile if loaded, then `chown root:root` and `chmod 0700` on
+  `/usr/bin/bwrap`. It writes the failed items to `DRIFT` and appends a line to
+  `/var/log/mosaic-stack/hostcheck.log`. With bwrap closed to `mosaic`, every role session refuses
+  to start. That's the fail-closed state, and the stack needs no change for it. The chmod is undone by
+  the next bubblewrap upgrade, which reapplies the statoverride. But the apt hook runs again right
+  after that upgrade and finds `DRIFT`, so it closes bwrap again. Only root removes `DRIFT`, in a
+  reviewed step with a new pin or a Mos go. I don't call `dpkg-statoverride` from inside the hook,
+  because I haven't confirmed it can take dpkg's lock while apt holds the frontend lock.
+- Three callers. A1 of every re-pin runs `--check` and refuses `profile-drift` on exit 1. The apt hook
+  is `DPkg::Post-Invoke { "/usr/local/lib/mosaic-stack/case1-hostcheck.sh --enforce || true"; };`, so it
+  runs after every package run, unattended ones included, and can't fail one. The boot unit,
+  `mosaic-hostcheck.service` (`Type=oneshot`, `After=apparmor.service`,
+  `Before=mosaic-bus@mosaic-stack.service`, `WantedBy=multi-user.target`), runs `--enforce` before the
+  bus starts, which covers a kernel or parser change that takes effect at boot.
+- Owner. ops-01 owns the host side under a Mos go. It reads `hostcheck.log` in each STATE report and
+  sends any `DRIFT` to Mos. Before each re-pin window it also runs `--upstream`, which downloads the
+  current `apparmor-profiles` candidate into a temp dir and compares its `bwrap-userns-restrict` to the
+  pin. A difference goes to Mos as a new-pin request and refuses nothing. The pins and the scripts are
+  this row's, and later changes go through review like any other.
+
+Who runs what:
+
+| Step | Runs as | Through |
+|---|---|---|
+| 2a: `useradd --system --user-group --home-dir /srv/mosaic --shell /usr/sbin/nologin mosaic`, `/srv/mosaic` 0700, `/etc/mosaic-stack` `root:root` 0755, `/var/log/mosaic-stack` `root:root` 0750 | root | ops-01, `ssh localadmin@10.1.1.53`, `sudo` (#423 step 1) |
+| 2a': node under `/opt/mosaic-stack`; bubblewrap, the AppArmor profile, the statoverride, the drift stop and the managed settings file, each with the test and rollback above; the no-new-privs test | root | ops-01, same path, R27 (mos-1091) |
+| 2a'': a `git bundle` of the reviewed commit copied to .53; root clones it to `/root/mosaic-stack` and checks HEAD is the commit the go names; it installs the bundle as `/srv/mosaic/incoming/<sha>.bundle`, owner `mosaic`, 0600 | root | ops-01, same path |
+| 2b: claude under `~/.local` (above); `git clone` of the bundle to `/srv/mosaic/src/mosaic-stack`; `scripts/bootstrap.sh`; `stack-copy.sh copy`; the install with the inputs above (C2-13b's `case2-install.sh --profile factory` if it has landed, else the run sheet's steps) | `mosaic` | `sudo -u mosaic -H env PATH=...` from `localadmin` (PATH above). `mosaic` gets no key and no login shell |
+| 2b': place `claude-session.env` | Jason, or who he names (Q173 secrets rule) | section 3 |
+| 2c: write `case1-unit.args`; `case2-unit.sh` with those arguments and `--copy <id>`, from `/root/mosaic-stack`; then `case2-precheck.sh --profile factory` as `mosaic`, which reads the Console's `--port` from the installed unit for its port-floor line, so it runs after the render; `systemctl enable` the bus unit; the first start of UNITS. The Console unit has no `[Install]` until Jason rules (C2-13a), so it isn't enabled, and after a host reboot root starts it by hand until then. The run sheet says so | root | ops-01, same path |
+| 2c': `stack-release.sh adopt mosaic-stack --units external`, which records the running copy as the pointer (`do_adopt`, `scripts/stack-release.sh:856`) | `mosaic` | `sudo -u mosaic -H` |
+| every later re-pin or rollback | root, with its `mosaic` steps through `sudo -u mosaic -H` | ops-01 runs `case1-repin.sh` (section 4) |
+| acceptance (section 5) | `localadmin`, with `sudo -u mosaic -H` for the in-instance checks | the agent the window names |
+
+No git credential lands on .53. Both checkouts come from bundles that ops-01 copies in, and a re-pin
+brings a new bundle that `mosaic` fetches into its checkout.
+
+## 2. Where Case 1 differs from Case 2
+
+| Case 2 item (row 230 brief) | Case 1 | Reason |
+|---|---|---|
+| business file with the library mapping | business `mosaic-stack` with no `library` key; `--profile factory` refuses a `kind: "library"` project (`profile-library-business`) | the factory has no books repo |
+| `bean`, `chet`, persona vars and files, specialists | factory roles from `roles/`, with a chief that has a harness var | Jason names the set in the go. I haven't read his live business file and won't. The acceptance needs only the chief (F3), since a chief with no harness var answers `no-route`. Others are added later by the human with `instances.set`, no new row |
+| token slot `library-gitea` | none | the factory's per-agent git identity is row 199's credential store (Megavolt, #1697). Until it lands, git work stays on dragon-lin (Q182) |
+| precheck: `bus.tester` is not on | `bus.tester` is on; `factory` requires it | the acceptance and the Q173 test system need the tester (agents act as tester, never Jason) |
+| precheck: persona file modes and digests | skipped under `factory` | no persona files |
+| precheck: `library.sync`, `library.status` | skipped under `factory` | no library |
+| precheck: `ZAI_API_KEY` in the key file | doesn't run | no instance has provider `zai` |
+| precheck: no Discord binding | kept | the factory's Discord connector stays on dragon-lin. Two connectors on one bot token would split its events |
+| precheck: claude marker prompt with `--system-prompt-file` | runs, since the chief's harness is claude-code | |
+| precheck: `sudo -n true` fails, `id -G` one entry, run root 0700, config validates, node 24 or later, `bwrap` exits 0, free memory, HOME | kept | node and bwrap are in row 230 (gosalyn-0034) |
+| Console serve flags: `--port` 1..1023, `--business`, the preview trio, `--send`, the proof pair, no `--tester-port` | `--port 732`, `--business mosaic-stack`, `--tester-port 7333`. No preview trio, no `--send`, no proof pair | below |
+| bus: `@PM_FLAGS@` and `@CLAUDE_ENV@` render empty | ` --pm`, and `Environment=MOSAIC_CLAUDE_BIN=/srv/mosaic/.local/bin/claude` | below |
+
+All of these are inputs. Nothing in the Case 2 scripts hardcodes a Case 1 value (gosalyn-0034 item 4).
+Row 230's brief says the factory profile takes the library serve set plus an optional `--tester-port`,
+and that row 195 names any other difference (gosalyn-0049). .53 can't meet the library set, and the bus
+needs two lines the brief renders empty. The factory profile I need from row 230:
+
+1. Serve flags. `--port N` with N in 1..1023 and `--business ID` are required, and `--tester-port N` in
+   1024..65535, not equal to `--port`, is optional. The preview trio (`--public-host`, `--auth-header`,
+   `--allow-user`) and the proof pair (`--proof-header`, `--proof-file`) are refused. Both exist for a
+   proxy in front of the Console: the proxy signs the user in and adds the header, and the proof shows
+   the request came through it. .53 has no proxy. Jason reaches the Console with `ssh -L` (sage-1451
+   Q3), so there is no header to trust and no proxy to hold the proof. `--send` is refused too, since
+   serve takes it only with the trio or `--sso` (`packages/webui/src/cli.mjs:15`). When Q175 SSO reaches
+   .53, `--sso` with an optional `--send` (row 192) would be the factory's sign-in, and adding it is a
+   re-install with its own go. Row 230 can accept `--sso [--send]` under factory now or later. Either
+   way it needs a `console.sso` block in `mosaic`'s config, which this row doesn't write. `--checkout`
+   and `--board` stay refused, as in the library set.
+2. `--pm` (factory only) renders the bus unit's `@PM_FLAGS@` as ` --pm`. The factory's PM dispatches its
+   work on .53 as on dragon-lin (section 4). With the token empty the bus never launches the PM, and
+   A5's PM check fails every re-pin.
+3. `--claude PATH` (factory only) renders `@CLAUDE_ENV@` as `Environment=MOSAIC_CLAUDE_BIN=PATH`, the
+   line `scripts/bus-service.sh:79` renders today. PATH must be absolute. Without it the bus runs
+   `claude` from the unit's PATH, which is the node dir, `/usr/local/bin`, `/usr/bin` and `/bin`, and
+   holds no claude on .53. The chief's first launch would then fail. The precheck's claude marker
+   prompt should run the same binary, so it reads the path from the installed bus unit.
+4. Row 190's two template tokens, if row 190 lands before row 230. Row 190 adds `@CONFIG_ENV@` to both
+   templates and `@SESSION_ENV@` to the bus template's `EnvironmentFile=` line. For the default
+   instance, `@CONFIG_ENV@` is deleted (`scripts/instance.sh`) and `@SESSION_ENV@` is
+   `<home>/.config/mosaic-dev/secrets/claude-session.env`. Row 230's "every token has one value" list
+   and its `EnvironmentFile=` check need both. This applies to the library profile too.
+
+I've sent these to Gosalyn. If row 230's candidate lacks any of them, row 195's manifest names the
+change to `case2-unit.sh` or `case2-precheck.sh`, reviewed by Duckworth with Webby told.
+
+## 3. Model access
+
+Q185: Case 1 uses the account the factory uses today, the Claude subscription behind dragon-lin's
+`claude-session.env`. The install never copies that file from dragon-lin. In the window, Jason (or the
+person he names under the Q173 secrets rule) makes a credential for .53 from that account and writes it
+to `/srv/mosaic/.config/mosaic-dev/secrets/claude-session.env` as `mosaic`, mode 0600. Nobody prints it,
+and no script reads its value. The precheck checks only its mode, owner and that the variable name is
+present (a `grep -c` on the name, output a count).
+
+Quota: the factory on dragon-lin and on .53 share one subscription. Q185's "use existing" accepts that.
+Case 2 shares nothing with it (Mos's reading of Q185).
+
+The pi harness stays off on .53 until P19 #383 settles (mos-0865). The business file names claude only.
+
+## 4. Re-pin, rollback and backup on .53
+
+Unit form (ruled, sage-1451 Q1): system units that root writes, with `User=mosaic`. `mosaic` can't
+start or stop them, and root never runs code that `mosaic` can write. `stack-release.sh activate` today
+does everything in one run under `systemctl --user` and puts the old stack back inside that run
+(`rollback_in_run`, `scripts/stack-release.sh:561`). On .53 the same run needs two users. So one
+re-pin is one ordered list, and one root command drives all of it: `scripts/case1-repin.sh`, run by
+ops-01 from `/root/mosaic-stack`. Each `mosaic` step is `sudo -u mosaic -H` running
+`/srv/mosaic/src/mosaic-stack/scripts/stack-release.sh` with `--units external`. Copies carry no
+`stack-release.sh` (`COPY_PATHS`, `scripts/stack-copy.sh:23-30`), so the `mosaic` steps run from that
+checkout, as dragon-lin's run from the canonical one.
+
+What root holds, and where each value comes from (r4's B1):
+
+| Value | Source |
+|---|---|
+| ID, the target copy | the go |
+| TO, a rollback's target | the go, as `--to ID` |
+| `--restore ACT --events N` | the go, when the rollback restores |
+| OLD, the running copy | the `ExecStart=` of the two unit files root installed. If the bus and Console units name different copies, A1 refuses `units-disagree` |
+| the `case2-unit.sh` arguments | `/etc/mosaic-stack/case1-unit.args` (section 1) |
+| each `mosaic` step's result | its exit code |
+
+Root parses nothing `mosaic` wrote and runs nothing under `/srv/mosaic` except through `sudo -u mosaic
+-H`. It never needs the activation id: the `mosaic` steps find it themselves.
+
+One result line per activation (B1). The stack log closes an activation on the first line after
+`started` that names it, whatever the result (`interrupted`, :146-156). r4 wrote an interim
+`... rollback pending` line at A3's and A5's failures. That line closed the activation, so R2 and R4
+then refused `open-activation` against an activation the log no longer held open. The rollback could
+never run as designed, and nothing tested the steps in sequence. r5 keeps an activation open from A3's
+`started` line until its single result line, and A5 or R4 writes that line:
+
+| Activation ends at | Result line | Written by |
+|---|---|---|
+| A3 fails before its rollback set exists (marker or capture) | `refused code marker-failed` or `refused code capture-failed`, as `capture || refuse` does today (:987). Nothing has changed, so there is nothing to roll back | A3 itself, exit 3, after it removes the marker. Root runs A2f |
+| A5 passes | `ok` | A5 |
+| A3 (after capture), A4 or A5 fails, and the rollback passes | `failed code <c> rollback ok` for A3 and A4, `gate-failed code <c> rollback ok` for A5 | R4 |
+| the rollback fails at R4's gate | `rollback-failed code <c> rollbackCode <r>` | R4 |
+| R1, R2 or R3 fails, or the run dies | none. The activation stays open, and the next activate refuses `interrupted-run` (:603-606), which Jason or Mos settles as on dragon-lin | |
+
+What the result line carries (r5's B1). `log_line` (:58) writes `op "$OP"`, and `from_log` (:169)
+reads only lines whose op is `adopt`, `activate` or `rollback`. So `confirm` doesn't log under its own
+op. Before A5's `ok` line or any line R4 writes, it sets OP, FROM and TO from the open activation's
+`started` line, ACT to that activation, and BACKUP from the rollback set's `BACKUP` file, which A3
+writes when `backup_store` returns. A re-pin's lines then read `op activate`, a rollback's `op
+rollback`, each with the from, to and backup a dragon-lin run would log. `from_log previous` and
+`from_log backup` read .53's log as they read dragon-lin's. `confirm` reads only the line A3 wrote for
+that activation, which `interrupted` already names.
+
+A failing `mosaic` step after `started` writes no log line. It writes its code to `FAILED` beside
+`AWAITING-UNITS` and exits 1. R4 reads that code for the result line. Root passes R4 `--cause
+A3|A4|A5`, the step it saw fail, from its own exit codes. A4 is root's own step and has no `FAILED`
+file, so R4 writes `failed code units-start` for it. A cause with no `FAILED` file where one should be
+writes code `unrecorded`.
+
+The open activation. A3 writes `$STATE/stack-rollback/<ACT>/AWAITING-UNITS` holding the target copy
+(renamed from r3's `PENDING`, which read like the pointer's `pmPending`, `P_PENDING` at :128; N3).
+`confirm` and `revert` take the copy root passed, not an activation id. Each lists the
+`AWAITING-UNITS` files and the `interrupted` set (:146), and goes on only when there is exactly one
+file, its activation is the one `interrupted` names, and the copy in it is the copy root passed.
+Anything else refuses `open-activation` with exit 3 and the list it found, and changes nothing.
+`confirm` without `--rollback` also refuses `activation-failed` when `FAILED` exists, so a second
+confirm can't pass an activation that already failed. Whichever `confirm` writes the result line
+removes `AWAITING-UNITS` and `FAILED` after it.
+
+Refusals of the three external verbs. `confirm`, `revert` and `gate` act on an open activation by
+design, so they skip the `interrupted-run` refusal (:605). Their refusals log `result refused` with no
+activation id: they set ACT only after every check has passed. So a refused `confirm`, a wrong copy
+say, leaves the open activation open. Today's `refuse` (:62-67) adds the activation id whenever ACT is
+set, and the external verbs keep that order. A test and a mutant hold it (section 7).
+
+Root's step log. Every step `case1-repin.sh` runs appends one line to `/var/log/mosaic-stack/case1-repin.log`,
+`root:root` 0640: the time from `date -u`, the step, its argv, its exit code. `mosaic` can't write it,
+so it stays readable after a run that dies before `mosaic` logs anything.
+
+### Activate: `case1-repin.sh activate ID [--migrate] [--timeout S]`
+
+| # | Step | Runner | On failure |
+|---|---|---|---|
+| A1 | `/root/mosaic-stack` HEAD is the commit the go names. ID is 40 lowercase hex and names a copy under `/srv/mosaic/.local/share/mosaic-stack/copies` that holds `scripts/mosaic` (row 230's copy-id rule). `case1-hostcheck.sh --check` exits 0, else `profile-drift` (B2). Root reads OLD from the unit files. `stack-release.sh activate ID mosaic-stack --units external --plan --expect-from OLD` exits 0. The plan refuses `pointer-differs` when the pointer's copy isn't OLD (N5), so a pointer and units that disagree stop before any stop | root; the plan as `mosaic` | refuse, exit 3. Nothing has changed |
+| A2 | `systemctl stop` UNITS in reverse order, then wait until each is inactive, within `--timeout` | root | A2f below |
+| A3 | `stack-release.sh activate ID mosaic-stack --units external [--migrate]`. Before it logs `started` (N3), it refuses `units-running` unless each of UNITS is inactive (system-manager reads, which need no privilege) and the store is stopped (`stopped`, :359), and `interrupted-run` while any activation is open. Then, in this order: logs `result started`; makes `$RS` with capture's `mkdir -p` of `stack-rollback` and exclusive `mkdir -m 0700` (:415-416), and writes `AWAITING-UNITS` in it at once (N1); captures the rollback set into that directory, making none (pointer, wrapper, and the sha256 and `ExecStart=` of each installed unit, read only); takes `backup_store` (:372) into `$DATA/backups/stack/<ACT>` and writes its name to `BACKUP` in the rollback set; under `--migrate`, writes `MIGRATING` in the rollback set and sets TAKEN, both before `migrate-schema.mjs` runs, where today's run sets TAKEN (:1004-1005, r5's B2), then migrates; installs the wrapper for ID. It writes no pointer | `mosaic` | a refusal before `started` exits 3 with nothing changed. A marker or capture failure, an existing `$RS` included, removes the marker if it wrote one, logs its `refused` line and exits 3. Root runs A2f for both. Any later failure writes `FAILED` with its code, logs nothing, cleans up nothing and exits 1. Root runs R1-R4 with `--cause A3` |
+| A4 | `case2-unit.sh` with `case1-unit.args` and `--copy ID`, `systemctl daemon-reload`, `systemctl start` UNITS in order | root | R1-R4 with `--cause A4` |
+| A5 | `stack-release.sh confirm ID mosaic-stack --units external --timeout S`. This is `gate` (:522), which polls `gate_once` (:471) every second until `--timeout`, with the external checks below. On a pass it writes the pointer, logs `result ok`, removes `AWAITING-UNITS`, exit 0. When the timeout runs out it writes `FAILED` with the last gate code, logs nothing and exits 1 | `mosaic` | R1-R4 with `--cause A5` |
+
+Why A3 writes the marker first and does no cleanup of its own. With the marker written last, as in r4,
+an A3 failure after `started` left an open activation with no marker, and R2 and R4 refused it. With
+the marker first, every A3 failure after the marker leaves exactly what R2 needs: the open activation,
+its marker and whatever part of the rollback set exists. R2 is then the one cleanup path, for A3, A4
+and A5 alike. Two cleanup paths, A3's own and R2, would each need their own tests for each failure point.
+
+A2f, a stop that fails or times out, or an A3 that exits 3. This run has no open activation: A2 logs nothing, and
+A3's exit 3 comes either before `started` or after its own `refused` line. Nothing of `mosaic`'s has
+changed. Root reads `date -u +%s` as T, runs `systemctl start` UNITS in order, then `stack-release.sh gate
+OLD mosaic-stack --units external --since T --timeout S`, a new verb that runs `gate` on OLD and writes no
+log line, no pointer and no file. A2f has no `started` line to take a start floor from (the first
+re-pin after adopt has none at all), so `--since` is the floor, and `gate` refuses `usage` without it
+(r5's N2). T is root's own clock, so root still parses nothing `mosaic` wrote. A unit that never
+stopped keeps its old `ActiveEnterTimestamp`, fails `stale-start` and takes the exit 2 path below.
+If that passes, root logs `A2 failed, OLD running` (or `A3 refused`) in its step log and exits
+1. If it fails, root stops UNITS, logs `OLD gate failed <code>` and exits 2. The next run's
+`interrupted` check finds nothing open either way.
+
+The external gate. `gate_once` keeps its order and codes, with these changes under `--units external`:
+
+- `systemctl` without `--user` for `is-active` and `show`. Both work unprivileged against the system
+  manager.
+- This start's time is the bus unit's `ActiveEnterTimestamp`, read with `systemctl show --timestamp=unix
+  -p ActiveEnterTimestamp`, in place of the `START_MS` that `start_both` (:451) sets on dragon-lin.
+  It is whole seconds (`@1792540800`), and the `started` line has milliseconds (N4). So the rule
+  compares seconds: the start passes when its second is at or after the floor of `started`'s second.
+  A unit that was active across A3 can't reach this check, because A3 refuses `units-running`, so the
+  equal second can only be a start after A3. An earlier second fails `gate_once` with the gate code
+  `stale-start`. It's a gate failure like any other, not a refusal (r4 had it as a refusal, which
+  would have logged against the open activation): `gate` keeps polling, since `Restart=on-failure`
+  can bring a fresh start, and at the timeout `FAILED` holds `stale-start`. The PM check's
+  `startedAt` bound uses the same second.
+- `copy-check` runs `stack-copy.sh check --units external`, which reads the system units.
+- The PM check is below.
+
+The PM (r4's B2). .53 runs the PM: the factory's PM dispatches its work, as it does on dragon-lin, and the
+serve flags carry `--pm`. The pointer's `pm` comes from the installed bus unit's `ExecStart=`, as the
+unit parse at :195 already reads it. Today's `pm_launched` (:505) takes the run id from the
+`launched ...` line in `journalctl --user -u BUS_UNIT`. On .53 that read fails twice over: the unit is
+a system unit, and under `SplitMode=uid` the logs of a system-range uid land in the system journal,
+which `mosaic` (no `adm` or `systemd-journal` group) can't read. Under `--units external` the check
+reads `launches list --json` alone. It passes when exactly one entry has business `mosaic-stack`,
+instance equal to the business file's `launch.by` (the PM's instance, the one `bus start --pm` launches
+at `packages/cli/src/launcher.mjs:675`), `live` true, and `startedAt` at or after this start's time.
+Zero entries, two, a stale one or one for another business fail with `pm-launch-unconfirmed` and what
+it saw, as today. A run the PM starts for another role has another instance, so it doesn't count.
+
+Why not the other reads. A regular uid for `mosaic` would put its logs in a per-user journal it can
+read, but it changes the account Case 2's install creates. Root reading the journal and passing the run id in
+would make root parse output from `mosaic`'s process, which section 4's rule forbids.
+
+Under `--units external`, `pm-on` (:1137) and `activate --pm-after-harness` refuse `external-pm`. Both
+flip the PM on dragon-lin by restarting the user bus with new arguments. On .53 the PM's state is a
+serve flag in a root-owned unit, so changing it is a re-install with its own go.
+
+### Rollback inside the run (R1-R4)
+
+| # | Step | Runner | On failure |
+|---|---|---|---|
+| R1 | `systemctl stop` UNITS, then wait as in A2 | root | rollback-failed |
+| R2 | `stack-release.sh revert ID mosaic-stack --units external`. It finds the open activation as above, puts the wrapper back from the rollback set and checks its sha256, and restores TAKEN (`restore_store`, :396) only if the rollback set holds `MIGRATING`. Each part is idempotent, so it works for an A3 that stopped partway: no `MIGRATING` means no restore, a migrate that failed partway is restored from the backup taken before it, and copying the saved wrapper over an unchanged one changes nothing. It writes no log line | `mosaic` | rollback-failed, activation left open |
+| R3 | `case2-unit.sh` with `case1-unit.args` and `--copy OLD`, `systemctl daemon-reload`, `systemctl start` UNITS | root | rollback-failed, activation left open |
+| R4 | `stack-release.sh confirm ID mosaic-stack --units external --rollback OLD --cause A3\|A4\|A5 --timeout S`. It finds the open activation, checks OLD is its `from`, gates OLD with `gate`, and writes the activation's one result line from the cause and the `FAILED` code: `failed code <c> rollback ok` (A3, A4), `gate-failed code <c> rollback ok` (A5), or `rollback-failed code <c> rollbackCode <gate>` when OLD's gate fails | `mosaic` | rollback-failed, logged |
+
+rollback-failed: root stops UNITS and exits 2, as `rollback_failed` (:587) does. When R4's gate fails,
+the log has the `rollback-failed` line and the activation is closed. When R1, R2 or R3 fails, no
+`mosaic` step writes a result, so the activation stays open with its marker. Root's step log has the
+codes, the next activate refuses `interrupted-run` until Jason or Mos settles it (:605), and status
+shows it. I chose that over a log-only verb for root to call after an R2 failure: nothing could gate
+the old stack at that point, and a closed activation would let the next activate start against a
+wrapper and store in an unknown state. Exit codes match `stack-release.sh`: 0 ok, 1 failed with the old
+stack running (rolled back, or A2f), 2 rollback-failed with UNITS stopped, 3 refused with nothing
+changed.
+
+### Rollback to the previous copy: `case1-repin.sh rollback --to ID [--restore ACT --events N]`
+
+The same list with TO in place of ID. The go names TO, from Mos's or Sage's read of `stack-release.sh
+status` as `mosaic`. Root passes it. A1's plan, `stack-release.sh rollback mosaic-stack --units external
+--to ID --plan --expect-from OLD`, refuses `pointer-differs` as in activate. It also exits 3 unless ID
+is `from_log previous` (:162), the previous distinct copy, so a
+stale or mistyped go refuses before anything stops. With `--restore`, the plan also refuses unless
+`$DATA/backups/stack/ACT` exists. `--to` is a new flag, accepted only with `--units external`;
+dragon-lin's rollback keeps reading TO from the log.
+
+The post-backup event count runs in A1's plan as `mosaic` while the bus still holds the store (the
+`heldcount` read, :1074), and again in A3 on the stopped store. A difference refuses
+`post-backup-events`, as `run_steps` does (:1013).
+
+### Migrations (N4)
+
+`--migrate` under `--units external` runs only inside A3, and A3 refuses `units-running` before it logs
+or migrates anything while any of UNITS is active. So a migration never runs against a store a live bus
+holds. The test is in section 7.
+
+### Backup
+
+A3's `backup_store` is today's. It copies the stopped store into `$DATA/backups/stack/<ACT>`, so
+`rollback --restore <ACT>` and row 181's guard find it. As on dragon-lin, the config dir isn't in the
+backup, and the credential isn't either. PBS backups of VM 1008 cover the disk (P4). A restore swaps
+only `bus/` and leaves `secrets/claude-session.env` in place (N6, in the run sheet).
+
+The install's adopt (2c') takes no backup. The store holds only what the acceptance wrote, and the first
+re-pin's A3 takes the first backup.
+
+### The log
+
+Every `mosaic` line goes to `$DATA/state/stack-activation-log.jsonl`, as today, with `units external`
+added. So `from_log previous` reads .53's history the same way it reads dragon-lin's. A3 writes
+`started`. A5 or R4 writes the one result line, with the op, from, to and backup of that activation,
+or A3 its `refused` line before any change. Refusals of
+`confirm`, `revert` and `gate` log no activation id. If a run dies between `started` and the result,
+the log keeps `started` with no result, the next run's `interrupted` check reports it, and root's step
+log shows the last step that ran.
+
+### Who
+
+Mos or Sage plans each re-pin. ops-01 runs `case1-repin.sh` on Jason's or Mos's go, and a STATE report
+follows. The gate and the in-run rollback have one owner, the root command, as they do on dragon-lin.
+
+### dragon-lin's path
+
+`--units external` is a new value. Without it, `stack-release.sh` and `stack-copy.sh check` run as they
+do today, `pm_launched` still reads the user journal, and rollback still takes TO from the log.
+`confirm`, `revert`, `gate` and `--to` refuse without it. Section 7 names the tests that show this.
+
+### Not taken
+
+- Row 190's user units under `mosaic`, with root running `loginctl enable-linger mosaic` once. Every
+  existing re-pin tool would work unchanged and root would be needed only once. But the unit form
+  would differ from Case 2, and a user manager would run as `mosaic`.
+- A sudoers rule that lets `mosaic` start and stop the units. P1 and row 230's precheck require that
+  `mosaic` has no sudo.
+- `confirm` and `revert` taking ACT from root. Root would have to read it from `mosaic`'s output or
+  log, which the rule above forbids (r4's B1).
+
+## 5. Acceptance checks
+
+A new script, `scripts/case1-accept.sh`, in this row's manifest. It runs on .53 as `localadmin` and prints
+one line per check: `<id> <path> <mark> <evidence>`. The marks are `closed`, `accepted Q182`,
+`accepted Q183`, `accepted mos-1096`, and `unnamed`, which means "not named in Q182, Q183 or a Mos
+ruling". The script ends with a count of each mark. It exits non-zero only when a functional check (F)
+fails. A P check never changes the exit status. Each `unnamed` line goes to Mos, who takes it to Jason
+(R8 N1).
+
+Functional checks. Any failure fails the row:
+
+| Id | Check | How |
+|---|---|---|
+| F1 | the units run as `mosaic` | `systemctl show <unit> -p User -p MainPID` for each of UNITS; each MainPID's uid in `/proc/<pid>/status` is `mosaic`'s, and each unit is active |
+| F2 | the Console listens on 127.0.0.1:732 on .53 and answers there | `curl -fsS http://127.0.0.1:732/healthz` on .53 succeeds, and the listener table shows 732 bound to 127.0.0.1 only, by the Console unit's MainPID. Jason reaches it with `ssh -L 7332:127.0.0.1:732 localadmin@10.1.1.53` and his browser at 127.0.0.1:7332 as today. A LAN listener waits for Q175 SSO (sage-1451 Q3) |
+| F3 | one tester message gets a reply | as `mosaic`: `mosaic talk chief <marker> --tester`, then `mosaic follow --tester`, with a 300 s limit. A stored reply to the marked message passes. The inbox alone shows decisions only, so it isn't used (N3) |
+| F4 | the precheck passes | `case2-precheck.sh --profile factory` exits 0 as `mosaic` |
+| F5 | a role session runs under bwrap with the profile | while F3's reply is pending: a `/usr/bin/bwrap` process owned by `mosaic` has a claude process under it. `/proc/<bwrap pid>/attr/current` equals `bwrap (enforce)` and the claude process's equals `bwrap//&unpriv_bwrap (enforce)`, each compared as an exact string after the trailing newline is cut (N1). If `launches list --json` records the sandbox, the build reads that for the first part, since a short session can end before `ps` sees it |
+| F6 | claude is the pinned version | `/srv/mosaic/.local/bin/claude --version` as `mosaic`, after F3, equals the run sheet's pin |
+| F7 | the PM run is live | `launches list --json` as `mosaic` has exactly one live entry for the PM's instance, the check `confirm` runs (section 4) |
+
+Privilege and host paths. These report and never fail the row:
+
+| Id | Path | Mark | Evidence the script prints |
+|---|---|---|---|
+| P1 | `mosaic` has sudo | closed only when `sudo -l -U mosaic` prints "is not allowed to run sudo" (N2); any other output is unnamed | the `sudo -l` result |
+| P2 | `mosaic` has supplementary groups or a key | closed when `id -G mosaic` is one entry and `~mosaic/.ssh/authorized_keys` is absent or empty | `id`, file state |
+| P3 | `localadmin` NOPASSWD sudo, reached with the dragon-lin key | accepted Q183 (agents keep ssh to .53; localadmin from #423 step 1) | `sudo -l -U localadmin` |
+| P4 | root on pve over VM 1008, and PBS backups of VM 1008, which hold `/srv/mosaic` including the credential | accepted Q182 and Q183 (agents keep root on pve and PBS) | a fixed line; the script can't see pve from inside |
+| P5 | `jarvis`, which runs Hermes, can reach `/srv/mosaic` through sudo, or through the docker or lxd groups, which are root-equivalent | closed when `jarvis` is in none of sudo, docker and lxd; unnamed otherwise. #423 step 4 lands before the install (mos-1091 4c), and its `step4.sh` removes `jarvis` from sudo, docker, lxd and adm, so after it this reads closed (Duckworth N2) | `id jarvis` |
+| P6 | other members of sudo, docker, lxd | closed when sudo holds only `localadmin` and docker and lxd are empty. Every other member is its own unnamed line, `jarvis` included (N1) | `getent group` lines |
+| P7 | a file under `/etc/sudoers.d` naming `mosaic` | closed when none | the file names |
+| P8 | the Console or tester reachable from the LAN | closed when 732 and 7333 are bound to 127.0.0.1 only, each by the Console's MainPID, and nothing listens on 7331 | listener table |
+| P9 | a user namespace through `/usr/bin/bwrap` | accepted mos-1096 only while all seven hold, unnamed otherwise: (1) `dpkg-statoverride --list /usr/bin/bwrap` reads `root mosaic 0750`; (2) `aa-status --json` lists `bwrap` and `unpriv_bwrap` in enforce mode; (3) `/etc/apparmor.d/bwrap-userns-restrict` has the pinned sha256 and no package owns it; (4) `sudo -u jarvis /usr/bin/bwrap --version` fails with "Permission denied"; (5) `getent group mosaic` lists no member and no other account in `/etc/passwd` has its gid; (6) `fs.protected_hardlinks` is 1; (7) no `mosaic-bwrap` profile is loaded, no other file under `/etc/apparmor.d` names `bwrap`, and the live label of a process bwrap runs is exactly `bwrap//&unpriv_bwrap (enforce)` (N1, mos-1098 point 2). Items 1-3, 6 and 7 are `case1-hostcheck.sh --check`'s, so P9 reuses its lines | each item's line, and Mos's reason: "Case 1's agents are the factory's agents. In Q182 and Q183 Jason accepted that the factory reaches root on pve and, through it, every VM. So a user-namespace path to root on .53 gives that class no new reach." With the profile, what's left is bwrap's own setup, run by `mosaic` |
+| P10 | a session binds the tester port, 7333, while the Console is down | accepted mos-1101 while `ip_unprivileged_port_start` is above 732 and 7333 is held by the Console's MainPID at the check. Serve refuses a tester port below 1024 (`cli.mjs:33`), so the Console-port fix can't cover it. A squatter would get the tester's writes and could answer them. The tester's users are the factory's agents, the class Mos's reading covers (mos-1101 item 5). Mos can object, and then this line reads unnamed | the floor, and the owner pid of 7333 |
+
+Tests, in `packages/cli/tests/case1-accept.test.mjs`. The script takes a fake root (`--root DIR`) for
+`/proc`, `/etc` and `getent` output, and fake `systemctl`, `curl`, `ss`, `sudo`, `bwrap`, `aa-status`,
+`dpkg-statoverride`, `sysctl` and `claude` on PATH. Cases:
+- each F check failing gives a non-zero exit with its line;
+- each P check in each of its marks, including P1 with output that grants nothing but lacks the refusal
+  text (unnamed), P9 unnamed once for each of its seven items missing, and P10 unnamed with a floor of
+  700 and with 7333 held by another pid;
+- F5 fails on a label of `unpriv_bwrap (enforce)`, `bwrap//&unpriv_bwrap (complain)` and
+  `bwrap (enforce)` with a trailing space;
+- a run with every P check `unnamed` still exits 0;
+- the summary counts match the lines.
+
+Mutants: one per F check (the check made to pass on failure), one that maps P5 to `closed`, one that
+closes P1 on any output without a rule line, one that drops P9's jarvis item, one that drops P9's item
+7, and one that makes F5 a substring match.
+
+Nothing in the tests reaches .53 or dragon-lin's live state.
+
+## 6. Rulings
+
+sage-1451:
+
+- Q1, unit form: the brief's system unit. C2-13's `ExecStart=` check accepts a varying copy id, and
+  C2-13 took that (gosalyn-0034 item 3).
+- Q3, the Console: it listens on 127.0.0.1 on .53 (`packages/webui/src/serve.mjs:466`; `cli.mjs` passes no
+  host), and Jason reaches it with `ssh -L`. F2 says so. A LAN listener waits for Q175 SSO.
+- Q4, the date: if C2-13's candidate is late, I build on C2-13's latest commit and rebase (Q177). Under
+  the #426(a) push rules (mos-1086) a rebase goes to a new branch name.
+
+mos-1091 (none goes to Jason):
+
+- Q2 4a: installing bubblewrap is an install step, run by ops-01 as root under R27. Rollback is
+  `apt-get remove`.
+- Q2 4b: a per-binary AppArmor profile for `/usr/bin/bwrap`, the sysctl left at 1. r4 takes Ubuntu's
+  `bwrap-userns-restrict` for it (mos-1096). Section 1 has the steps.
+- 4c: P5 ends at #423 step 4, which Mos sent to Duckworth so it lands in Jason's VM 1008 boot session,
+  before the install. The P5 check stays.
+
+mos-1096:
+
+- B1 and B2 are mine, and so is the PM answer: .53 runs the PM (section 4).
+- The `dpkg-statoverride` on `/usr/bin/bwrap`, the hardlink and group checks, the jarvis refusal and F5
+  under the profile (sections 1 and 5).
+- P9 is Mos's acceptance, with the reason quoted in section 5.
+- Jason's Q9 on install and upgrade is open. r4 goes ahead, since B1's re-pin and rollback are needed
+  whatever he answers. If his answer changes how upgrades reach .53, the change lands in section 4 and
+  the run sheet as a new round.
+
+mos-1098 and mos-1101 (on Duckworth's REVIEW-r3):
+
+- Duckworth's CHANGES stand. B1 and B2 are fixed in this round, with B1's real-sequence test, and all
+  three of B2's asks: an owner across upgrades, what fails closed, and the pins as reviewed values.
+- r4's PM, statoverride and P9 stand. mos-1098's two questions are answered in section 1: the profile's
+  owner across upgrades is ops-01 with `case1-hostcheck.sh`, and the stop is bwrap closed to `mosaic`.
+  Both profiles attach to `/usr/bin/bwrap`: `bwrap` to the binary and `unpriv_bwrap` stacked on what it
+  runs. P9 item 7 checks that no third one does.
+- P9 has seven items and F5 compares exact strings (N1).
+- The port squat applies (section 1). The Console takes Case 2's fix, a port below 1024 with
+  `CAP_NET_BIND_SERVICE` and the floor checked. Only the tester port can't take it, and P10 records it
+  under Mos's reading that Case 1's sessions are the factory class. I've told Mos, who can object.
+- Work on r5 goes ahead while Jason's Q9 (Vikunja #429) is open. If install and upgrade become
+  product commands, these steps become that installer's configuration and row 195 rebases on its row
+  (sage-1481, sage-1491).
+
+sage-1499: C2-13a is row 230 (#1732, Gosalyn), and row 195 chains on row 230's candidate.
+
+gosalyn-0049: the factory profile is the library set plus an optional `--tester-port`, and row 195 names
+any other difference. Section 2 names four, with the reason .53 can't meet the preview trio, `--send` or
+the proof pair. The managed-settings route needs no Case 2 change.
+
+## 7. Manifest (planned)
+
+- `scripts/case1-repin.sh` (new) and `packages/cli/tests/case1-repin.test.mjs` (new). Fake `systemctl`,
+  `sudo` and `case2-unit.sh` on PATH record their argv, with a scratch home standing in for `/srv/mosaic`,
+  a scratch dir for `/etc/mosaic-stack` and one for `/var/log/mosaic-stack`. Cases:
+  - a pass runs A1-A5 in order;
+  - a failure at A3, A4 or A5 runs R1-R4 with `--cause` set to that step, and exits 1;
+  - an A3 exit 3 runs A2f, not R1-R4;
+  - a failure at R2 or R4 exits 2 with UNITS stopped;
+  - A1 refuses `profile-drift` when a fake `case1-hostcheck.sh --check` exits 1, before any stop;
+  - every `mosaic` step's argv carries `env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin`, with the node
+    dir from `case1-unit.args`;
+  - a HEAD mismatch, an ID that fails the copy-id rule, or unit files that name two copies refuses with
+    exit 3 before any stop;
+  - A1's plan argv carries `--expect-from` with OLD from the unit files;
+  - A2f passes `gate OLD --since T`, with T from a fake `date` that root calls before its start;
+  - A2f: a fake `systemctl` that never reports inactive. The script starts UNITS, runs `gate OLD`, exits
+    1 with OLD's gate passing and 2 with it failing, and the stack log is byte-identical before and
+    after;
+  - `rollback --to` with an ID that isn't `from_log previous` exits 3 before any stop;
+  - every exec of a path under the home goes through `sudo -u mosaic -H` (from the recorded argv);
+  - no argv root passes holds an activation id, and OLD comes from the unit files, not from anything
+    the `mosaic` steps print;
+  - every `case2-unit.sh` call carries the arguments in `case1-unit.args` and differs only in `--copy`;
+  - the step log has one line per step with its exit code.
+- `scripts/stack-release.sh`: `--units external` for `adopt`, `activate`, `rollback` and `status`, the
+  `--to` flag for an external rollback, and the new `confirm`, `revert` and `gate` verbs, which refuse
+  without it. `scripts/stack-copy.sh`: `check --units external`, which reads the system units. Tests in
+  `packages/cli/tests/stack-release-external.test.mjs` (new), against a fake system-scope `systemctl`
+  and a fake `mosaic` for `bus status` and `launches list`:
+  - `units-running` refuses while any unit is active, and `activate --migrate` with a unit active
+    leaves the store, the log and TAKEN as they were (N4);
+  - activate leaves the pointer as it was, writes `AWAITING-UNITS`, and writes a backup of the stopped
+    store under `$DATA/backups/stack/<ACT>`;
+  - `confirm` and `revert` refuse `open-activation` with zero `AWAITING-UNITS` files, with two, with
+    one whose copy isn't the one passed, and with one whose activation isn't in the `interrupted` set;
+  - `confirm` polls: a fake bus whose status turns good after 3 s passes with `--timeout 10` and fails
+    with `--timeout 1`;
+  - `stale-start` (N4): with `started` at 1792540800.900, an `ActiveEnterTimestamp` of `@1792540800`
+    passes and `@1792540799` fails `gate_once` with `stale-start`. A fake that turns to `@1792540805`
+    after 2 s passes with `--timeout 10`, which shows it's a gate code that polling can clear, not a
+    refusal;
+  - `confirm` on a pass writes the pointer, logs `ok` and removes `AWAITING-UNITS`. On a timeout it
+    writes `FAILED` with the gate code, leaves the pointer, the log and the marker as they were, and
+    exits 1;
+  - `confirm` without `--rollback` refuses `activation-failed` when `FAILED` exists;
+  - every line `confirm` writes has op `activate` or `rollback`, never `confirm`, and the from, to and
+    activation of its `started` line, and backup equal to the rollback set's `BACKUP`;
+  - `gate` (N2): with `--since 1792540800`, `@1792540800` passes and `@1792540799` fails `stale-start`;
+    without `--since` it refuses `usage`;
+  - `--plan --expect-from` (N5) refuses `pointer-differs` when the pointer names another copy, for
+    activate and for `rollback --to`;
+  - A3's order: a fake that fails the capture leaves the log with `started` and `refused code
+    capture-failed` for that activation, no marker and no `FAILED`, and exit 3. An existing `$RS`
+    gives `refused code marker-failed` and exit 3, and a capture under `--units external` makes no
+    directory of its own. A fake that fails the
+    wrapper install after a migration leaves `started` only, the marker, `FAILED`, TAKEN as migrated,
+    and exit 1;
+  - refusals by `confirm`, `revert` and `gate` log with no activation id, and the `interrupted` set
+    is the same before and after each one;
+  - the PM check passes with one live entry for the PM's instance since the start, and fails
+    `pm-launch-unconfirmed` with none, with two, with one whose `startedAt` is before the start, with one
+    not live, and with one for another business. A second live entry for another instance doesn't
+    count. A fake `journalctl` on PATH records any call, and no external run makes one;
+  - `pm-on` and `activate --pm-after-harness` refuse `external-pm`;
+  - `revert` puts the wrapper back, and restores TAKEN only after a migration;
+  - `confirm --rollback OLD` writes the line for each `--cause` (A3 and A4 `failed`, A5 `gate-failed`,
+    with the `FAILED` code, `units-start` for A4, `unrecorded` when the file is missing), or
+    `rollback-failed` when OLD's gate fails. It removes the marker and `FAILED` after the line, and
+    refuses when OLD isn't the open activation's `from`;
+  - real sequences on one log (B1). The fake `sudo` execs the real `stack-release.sh` as the test's
+    user, so each step reads the log and state the last one wrote. Fakes stand in only for
+    `systemctl`, `mosaic` and `case2-unit.sh`. Each sequence ends with the log holding exactly one
+    `started` and one result line for its activation, an empty `interrupted` set, no marker or
+    `FAILED`, and a following `activate --plan` that doesn't refuse `interrupted-run`:
+    1. activate, confirm times out, revert, `confirm --rollback --cause A5` passes:
+       `gate-failed code <c> rollback ok`;
+    2. activate with `--migrate`, the wrapper install fails, revert restores TAKEN, `confirm --rollback
+       --cause A3`: `failed code <c> rollback ok`;
+    3. activate, root's A4 fails, revert, `confirm --rollback --cause A4`: `failed code units-start
+       rollback ok`;
+    4. activate whose capture fails: `refused code capture-failed` and nothing open, then A2f's
+       `gate OLD` writes nothing;
+    5. activate, then `confirm` with the wrong copy is refused, then revert and `confirm --rollback
+       --cause A5` still close the activation, because the refusal didn't;
+    6. activate, revert fails (a wrapper whose saved copy is missing): the activation stays open, and
+       the next `activate --plan` refuses `interrupted-run`;
+    7. adopt C0, activate C1 and confirm, activate C2 and confirm (r5's B1): both `ok` lines read
+       `op activate` with their `started` line's from and to and the backup each took. `rollback --to C1
+       --plan` exits 0 and `--to C0 --plan` refuses. A rollback to C1, confirmed, logs `op rollback`, and
+       `from_log previous` then names C2;
+    8. activate with `--migrate`, where the copy's `migrate-schema.mjs` is a fake that writes to the
+       store and exits 1 (r5's B2): `FAILED` holds `migrate-failed` and `MIGRATING` exists. revert
+       restores the store byte-identical to the backup, and `confirm --rollback --cause A3` gates OLD on
+       it: `failed code migrate-failed rollback ok`;
+  - `rollback --to` refuses when ID isn't `from_log previous`, and `rollback --restore` finds a backup
+    that an external activate took;
+  - `gate` writes nothing: the log, the pointer and the state dir are byte-identical before and after;
+  - `confirm`, `revert`, `gate` and `--to` refuse without `--units external`.
+- dragon-lin unchanged. `stack-release.test.mjs` and `stack-copy.test.mjs` run unchanged and green. A
+  new case in `stack-release-external.test.mjs` runs a default activate, rollback and check against a
+  fake `systemctl` that records argv, and every call carries `--user`. A default `activate --plan`
+  prints the same bytes on the candidate as on its base, with the base output as a fixture.
+- Mutants for the re-pin:
+  - `confirm` writes the pointer on a gate failure;
+  - `confirm` calls `gate_once` once in place of `gate`;
+  - the external PM check counts entries of any instance;
+  - the external PM check drops the `startedAt` bound;
+  - `confirm` takes the newest `AWAITING-UNITS` instead of refusing two;
+  - `rollback --to` skips the `from_log previous` comparison;
+  - `case1-repin.sh` skips R1-R4;
+  - `case1-repin.sh` exits 0 after A2f;
+  - `case1-repin.sh` runs `mosaic`'s `stack-release.sh` without `sudo -u mosaic`;
+  - the default path drops `--user` from one `systemctl` call;
+  - `confirm`'s timeout writes r4's interim `gate-failed ... rollback pending` line (B1; killed by
+    sequences 1 and 5);
+  - A3 writes `AWAITING-UNITS` last, after the wrapper (killed by sequence 2);
+  - an external verb's refusal logs with the open activation id (ACT set before the checks; killed by
+    sequence 5 and the refusal test);
+  - `stale-start` is a refusal again (killed by the polling case);
+  - `revert` restores TAKEN without `MIGRATING` (killed by the revert case);
+  - `confirm` logs with its own op, `confirm` (killed by sequence 7 and the op case);
+  - A3 writes `MIGRATING` after `migrate-schema.mjs` (killed by sequence 8);
+  - `gate` takes its floor from the newest `started` line when `--since` is missing (killed by the
+    `gate` case).
+- `scripts/case1-pins.sh` and `scripts/case1-hostcheck.sh` (new),
+  `packages/cli/systemd/mosaic-hostcheck.service` (new) and `packages/cli/tests/case1-hostcheck.test.mjs`
+  (new). The script takes `--root DIR` for `/etc`, `/proc/sys` and `/usr/bin/bwrap`'s stat, and fake
+  `aa-status`, `dpkg`, `dpkg-statoverride`, `apparmor_parser`, `systemd-run`, `chown` and `chmod`
+  on PATH record their argv. Cases:
+  - `--check` exits 0 with all seven items and 1 with each one failing alone, its line naming it;
+    item 3 fails on a second file naming `bwrap` as a word, one that writes `/{usr/,}bin/bwrap` included,
+    and passes with `bwrap-userns-restrict` alone. Item 4 fails on a label of `unpriv_bwrap (enforce)`
+    or one with a trailing space, and its `systemd-run` argv carries `-p NoNewPrivileges=yes` and the
+    other 2a' properties. Item 7 fails with the floor at 732;
+  - `--enforce` exits 0 on a pass and on every failure. On a failure it unloads the profile, closes
+    bwrap to `root:root` 0700, writes `DRIFT` and one log line. With `DRIFT` present and every item
+    passing, it still closes bwrap;
+  - `--enforce` never calls `dpkg-statoverride` with `--update`, `--add` or `--remove`;
+  - a bubblewrap version other than the install pin is a printed line, not a failure;
+  - `--upstream` against a fake deb whose file differs prints the difference and exits 0;
+  - the service unit has `Type=oneshot`, `After=apparmor.service`,
+    `Before=mosaic-bus@mosaic-stack.service` and runs `--enforce`.
+
+  Mutants: `--enforce` exits 1 on a drift; `--enforce` ignores `DRIFT` when the items pass; item 1
+  drops the `dpkg -S` owner check; item 3 matches only the `/usr/bin/bwrap` path; item 4 matches a
+  substring; item 4 drops `-p NoNewPrivileges=yes`; item 7 compares with `>=`.
+- `scripts/case1-accept.sh` (new) and `packages/cli/tests/case1-accept.test.mjs` (new), section 5.
+- Row 230 (C2-13a). `--profile`, the node, bwrap and port-floor precheck lines, the copy-id rule, the
+  two units and the Console's capability lines are in its brief at 5b8def2f1. Section 2's four items
+  are not. Any of them that row 230's candidate lacks becomes a named change here, reviewed by
+  Duckworth with Webby told. I told Gosalyn earlier that the settings-file route for
+  `DISABLE_AUTOUPDATER` doesn't reach a role session, and that Case 1 uses the managed settings file.
+- Docs: the Case 1 run sheet `docs/guides/case1-install.md` (new). It lists the window's steps in order,
+  each with who runs it and its go, the pinned node sha256 and claude version, a pointer to
+  `case1-pins.sh` for the bubblewrap and profile pins, the statoverride, the drift stop and the managed
+  settings file, each with its rollback, how ops-01 clears a `DRIFT`, the `ssh -L` line for port 732,
+  and a note that a restore leaves the credential in place.
+- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, dragon-lin's units or `~/.mosaic`.
@@ -0,0 +1,7 @@
+# Duckworth
+
+Reviewer seat, Claude Opus 5.5, started by Mos (mos-0977, thread ffceafec). Reviews federation designs and MVP T1 row 193.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `duckworth/*` branches
+through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+# Gander
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for the human
+boundary row (P19 333, #1694, mos-0989).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `gander/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,9 @@
+# Gizmoduck
+
+Design and builder seat, Claude Opus 5.5, a T3 thread (9312a896). Author of the federation design
+(`agents/gizmoduck/work/federation/DESIGN.md` on `gizmoduck/federation-design`, #414). Builds FED R1, the
+access.json loader and validator, under Mos's order mos-1023 item 1.
+
+No launcher in this directory. The seat works in its own worktree and has no credentials of its own; until
+the credentials row settles per-agent identity, it pushes only its own `gizmoduck/*` branches through the
+repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+# Herb
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for a second gate lane
+design row (#1695, mos-0977 item 6).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `herb/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,7 @@
+# Honker
+
+Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 194 (agent lifecycle, #1692) under mos-0974 and mos-0977.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `honker/*` branches
+through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,158 @@
+# PRD 1.7 draft: the chief of staff's hire and fire authority, the coder's push to its fork, and agent
+# host access through the credential store
+
+Draft by Honker for row 194 (#1692), under Mos's ruling mos-1017 (through Sage, sage-1365). Not approved.
+It changes nothing until Jason approves it as a `prd.approve` decision in the Console. Sage opens that
+decision and sends Mos its id. Base: `docs/prd/mosaic-stack.md` version 1.6 at 53bb59462.
+
+## What it changes
+
+Row 194 adds `role.hire` and `role.fire` to the vocabulary, and row 199 adds `git.push.remote`. Under
+REQ-WAIT-3 all three are hard waits, so today Jason resolves every hire, every fire and every push to a
+remote. This version routes hire and fire for the chief of staff within fixed bounds, so the chief hires
+and fires as needed and the user's per-agent forbid still holds. It routes `git.push.remote` for the coder
+only (Mos, mos-1028 item 3). It adds agent host access with sudo through the credential store for
+agents with a grant (Q183, Q184, Vikunja #424, due 2026-10-27). One `prd.approve` decision covers it all
+(Vikunja #420).
+
+When this version lands, a reviewed commit:
+
+1. adds `role.hire`, `role.fire` and `git.push.remote` to `ROUTED` in
+   `packages/business/src/vocabulary.mjs` and in `packages/bus/src/broker.mjs`.
+2. adds `role.hire` and `role.fire` to `roles/chief-of-staff.json` withinRole, and `git.push.remote` to
+   `roles/coder.json` withinRole. No other role file gets `git.push.remote`.
+3. switches the broker's check on `instance.hire` and `instance.fire` from a cited decision to the
+   `reason` form, as `role.end` works for REQ-ROLE-2, and makes `publish`'s `decision` optional for a
+   within-role class (row 199 D9 step 1).
+4. states, for a `git.push.remote` with no decision, where the source commit comes from: the latest work
+   commit the bus recorded for the coder's task. The check still matches it against the work ref tip and
+   the push sends it by oid (row 199, duckworth-0022 N9).
+5. adds the host credential grant check and the host access it allows (REQ-CRED-3, Vikunja #424).
+
+Every other check stays as rows 194 and 199 build it. Filling `hireable` stays a separate reviewed role
+file commit in `roles/`.
+
+## Text for the PRD
+
+Status line, appended to the current paragraph:
+
+> Version 1.7 routes the chief of staff's hire and fire actions and the coder's push to its own fork,
+> and adds agent host access through the credential store, approved by Jason in decision
+> <prd.approve decision id>.
+
+Source, a new bullet above "Version 1.6 source":
+
+> - Version 1.7 source, TARGET.md line 66: "Chief of staff agent has hire/fire authority for agents as
+>   needed; unless user forbids per agent". And Jason through Mos (mos-1067), DECISIONS Q183, in part: "I will
+>   still want to allow infra agent(s) on my .53 instance to access other servers, etc. However, not all
+>   agents will need to have that access. I envision a credential store within Mosaic Stack that works
+>   as some sort of variable for the agent to call. The system will enforce access to the credentials to
+>   keep the agents sandboxed with proper security. I need to be able to trust my agents with assisting
+>   me. This will require sudo access to several systems. If we can utilize the credential store in
+>   Mosaic Stack and allow agents to perform their jobs with NOPASSWD sudo on various machines, I am a
+>   happy man." DECISIONS Q184, on whether that is in place by 10-27: "Q5: by 10.27"
+
+Under "Added in version 1.2", after REQ-COS-2:
+
+> Added in version 1.7:
+>
+> - **REQ-COS-3.** The chief of staff hires and fires role instances without a decision each time. Hiring
+>   adds a role instance to the organization file and lists it for launch. Firing ends the instance's
+>   runs and removes it from the launch list. It stays in the organization file. Only the user deletes
+>   an instance. These actions are `role.hire` and `role.fire`. They leave the hard waits and route
+>   under this requirement, within these bounds:
+>   - The chief acts only in its own organization.
+>   - The chief hires only role definitions that need no credentials, until a later version adds
+>     credentialed roles.
+>   - The chief hires only the role kinds its role file lists. Changing that list is a reviewed commit.
+>   - The chief hires only a role whose every action is on a fixed list of plain work actions: sending
+>     messages, writing records, asking for review, updating its assigned tasks, and the scope and
+>     working-push actions of an assigned task. A role holding any other action, such as launch, end,
+>     organization, naming, hire, review verdict or merge authority, or any action added later, is never
+>     hired. So the chief never hires a chief, never picks its own reviewers or merge gate, and the author
+>     is never the reviewer. This holds whatever the role file's list says. Adding to that list is a PRD
+>     change.
+>   - The chief may set a hired instance's model and narrow its limits, and nothing else about it.
+>   - The user can forbid per agent. The user marks an instance so the chief can't fire it, end its runs
+>     or change its model, and marks role kinds the chief can't hire. Only the user changes these marks, through the
+>     WebUI or the CLI.
+>   - The kill switch stops every hire and fire while it is on.
+>   - Every hire and fire is logged with the chief's instance, its run and the reason.
+
+Under "Landing", after REQ-LAND-1:
+
+> Added in version 1.7:
+>
+> - **REQ-LAND-2.** A coder pushes its own work to its own fork. The action is `git.push.remote`.
+>   - What it pushes: one commit, by its oid, never a ref name. That commit is the latest work commit the
+>     bus recorded for the coder's task, and the coder made that push. A decision that authorizes a push
+>     names that commit, and it doesn't authorize any other.
+>   - Where it lands: only the branch `refs/heads/<its Gitea user>/<branch>`. The host builds that
+>     name, the agent never does. A push never forces.
+>   - Which remote: the agent's own fork of the project's upstream. The business file names the upstream,
+>     and the host never contacts it. For each push the host builds the fork's address over https from
+>     the upstream's host, port and repository name and the agent's own Gitea user. The history check,
+>     the push and the credential match all use that address. So the agent's own user owns the receiving
+>     repository on every push, and the agent never names it.
+>   - The host refuses an upstream on a host or port other than the agent's Gitea, and an upstream the
+>     agent's own user owns. It refuses a fork that is missing, empty or doesn't share the project's
+>     history. Gitea's push-to-create stays off, so a push never creates a repository.
+>   - Who may: the action routes under REQ-DEC-2 and is granted within-role to the coder role only. No
+>     other role file grants it.
+>   - Before version 1.7 the action was a hard wait under REQ-WAIT-3, so each push needed a decision
+>     the human resolved, and that decision named the commit.
+>
+>   Every push is logged with the remote, the ref, the commit and, when one was given, the decision.
+
+Under "Credentials", after REQ-CRED-2:
+
+> Added in version 1.7:
+>
+> - **REQ-CRED-3.** An agent with a grant can run commands with sudo on another host. The agent asks
+>   for the host credential by name. The stack checks that a grant exists for that agent and that host
+>   before the credential is used. The agent never sees the key or any other secret value (REQ-CRED-1,
+>   REQ-VAR-2). An agent without a grant for that host is refused. Not every agent gets a grant. Who
+>   grants a host credential, and how, is set by the #424 design, which Jason approves.
+
+REQ-WAIT-3, appended:
+
+> `role.hire` and `role.fire` were added as hard waits and route under REQ-COS-3 since version 1.7.
+> `git.push.remote` was added as a hard wait and routes under REQ-LAND-2 since version 1.7.
+
+## Notes for the reviewer and for Mos
+
+- REQ-COS-1 (1.2) already says the chief "hires and terminates role instances". REQ-COS-3 gives that
+  sentence its actions and bounds. It doesn't widen REQ-COS-1.
+- The forbid now names what r3 called "replace": ending a kept instance's run with a reason and changing
+  its model (webby-0010 N2). A user-resolved decision still ends a kept run (row 194 D2.4).
+- The fixed list is `HIRE_ALLOWED` in row 194 D2.3, an allowlist since r4 (webby-0010 B1). r3's text
+  named the refused authorities instead, which let merge-gate and any later action through.
+- The kill switch is row 191's. If row 191 hasn't landed when this version is approved, the bound still
+  holds through row 194's chain on its candidate.
+- REQ-LAND-2 follows row 199's design r6 (4d3007ec9 on megavolt/row199, approved by Duckworth in
+  duckworth-0027: D9 to D11, D9a, D9c, Q-M1 and Q-M2, and the oid binding from mos-1034 item 5) and
+  Megavolt's wording in megavolt-0005, megavolt-0008 and megavolt-0014, through Sage (sage-1377,
+  sage-1380, sage-1387). The fork bullet answers duckworth B5 and B6 and webby-0011 N1. Commit-email
+  checks, the refusal codes and the URL parse rules (D9c) are host checks with tests in row 199, not
+  bounds, so they stay out of the text (megavolt-0008).
+- Once the routing lands and the decision is optional for the within-role class, the commit is the task's
+  latest recorded push at check time. It is still checked against the work ref tip and pushed by oid, so
+  the binding holds without a decision (megavolt-0008). Step 4 of "When this version lands" puts that in
+  the routing commit (duckworth-0022 N9, sage-1387).
+- REQ-LAND-2 and REQ-COS-3 meet at the coder. Coder declares Gitea credentials, so REQ-COS-3's
+  credentials bound keeps the chief from hiring one until a later version lifts it. `git.push.remote` isn't
+  on REQ-COS-3's fixed list either, so a coder holding it stays unhireable until a PRD version adds it
+  (row 194 D2.3).
+- Adding to the fixed action list is a PRD change (mos-1035 item 3, sage-1395). The role file's
+  `hireable` list stays a reviewed commit in `roles/`.
+- The credentials bound names no row number, so the text doesn't go stale when row 199 lands. A later
+  version lifts it.
+- REQ-CRED-3 states only what Jason said in Q183 and Q184 (sage-1422). It names the outcome and the
+  check, not how the stack reaches the host. Proxying the ssh and a signing socket are both designs, and
+  the #424 design picks one (duckworth-0038 B1).
+- Open point: Q183 doesn't say who grants host access or how, so the text leaves it open and defines no
+  mechanism. The #424 design settles it, Jason approves that design, and Duckworth reviews it because it
+  gives agents sudo on hosts (Q184, Mos's reading, duckworth-0038 B2). The build is row 210 (#1707,
+  owner Gizmoduck), a new row on top of row 199 (megavolt-0019, sage-1430).
+- This draft follows the PRD's own style: plain words, no semicolons in new sentences, and the status
+  paragraph never edited in place except to append.
@@ -0,0 +1,7 @@
+# Launchpad
+
+Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 192 (Q175 SSO phase 1, #1690) under mos-0974 and mos-0977.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `launchpad/*` branches
+through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+# Megavolt
+
+Builder seat, Claude Opus 5.5, started by Sage under mos-0974 and mos-0977 item 5 for MVP T1 item 6, the
+credential store per agent with its own git identity (#1697).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `megavolt/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,7 @@
+# Morgana
+
+Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 193 (human users and RBAC, #1691) under mos-0974 and mos-0977.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `morgana/*` branches
+through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,10 @@
+# Quackerjack
+
+Builder seat, Claude Haiku 5.5 at high effort, started by Sage under mos-1023 item 1 and Q177 for federation
+rows R5 (`mosaic access list, grant, revoke`) and R2 (the `federation` config key), per Gizmoduck's design
+section 7 (#414).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own
+`quackerjack/*` branches through the repository credential helper (mos-0981), never `refactor`, `main` or
+another seat's branch.
@@ -0,0 +1,8 @@
+#!/bin/bash
+n=0
+for p in /proc/[0-9]*; do
+  c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null) || continue
+  case "$c" in *shell-snapshots*|*chrome-devtools-mcp*|*sage-busy-now*) continue;; esac
+  if echo "$c" | grep -qE 'node --test|gate\.sh|mutant|scripts/test-[a-z-]+\.sh|docker compose'; then echo "BUSY ${p#/proc/}: ${c:0:160}"; n=$((n+1)); fi
+done
+[ $n -eq 0 ] && echo CLEAR
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -o pipefail
+# Landing gate template (2026-10-14): sed the G= and OUT= lines and this comment.
+# Sequential suites, each teed to its own log; stops at the first failure.
+G=/mnt/storage/scratch/SET-ME-wt
+OUT=/mnt/storage/scratch/SET-ME-out
+cd "$G" || exit 9
+mkdir -p "$OUT" || exit 9  # a missing OUT failed the row 142 gate at step 1 (2026-10-15)
+# test-task.sh live cases run `docker compose` from $G, so without a name the project is "wt"
+# and leaves wt_default behind (row 142 gate, 2026-10-15). Name it per gate dir and remove it on exit.
+export COMPOSE_PROJECT_NAME="$(basename "$(dirname "$G")")"
+trap 'docker network rm "${COMPOSE_PROJECT_NAME}_default" >/dev/null 2>&1 && echo "removed network ${COMPOSE_PROJECT_NAME}_default"' EXIT
+# A gate tree without the node_modules link fails cli tests with ENOENT (2026-10-13).
+[ -d "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
+echo "base $(git rev-parse --short HEAD) dirty $(git status --short | grep -vc node_modules) DOCKER_HOST=${DOCKER_HOST:-unset}"
+run() { local name="$1" dir="$2" cmd="$3"
+  (cd "$G/$dir" && bash -c "$cmd") > "$OUT/$name.log" 2>&1; local rc=$?
+  echo "$name rc=$rc $(grep -E '^ℹ (pass|fail) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
+  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
+# No pkg-queue step: scripts/test-queue.sh runs packages/queue/tests/ itself (same 156 tests; CI debate item 2a, Vikunja #274).
+for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue; [ "$p" = queue ] && continue
+  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
+for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
+echo GATE_PASSED
@@ -0,0 +1,36 @@
+# Row 189 gate timing (for row 197, Herb)
+
+Sage, 2026-10-20T19:25:04Z. Gate on 0c177e9ef (base 0217b71c8), one lane. The slot was mine. Seats may have run single test files at the same time, which the slot rules allow, and I did not record that.
+Start 2026-10-20T19:09:37Z, end 2026-10-20T19:20:36Z. Total wall time: 659 s.
+
+Wall time per suite is the gap between one suite's log mtime and the one before it (the first suite starts at start.txt), so it includes node start-up. node's duration_ms is listed where the suite prints it. Scripts print no duration.
+
+| Suite | Wall s | duration_ms s | Ended (UTC) |
+|---|---|---|---|
+| pkg-bus | 3 | 3.8 | 19:09:40 |
+| pkg-business | 3 | 2.2 | 19:09:43 |
+| pkg-cli | 388 | 388.5 | 19:16:11 |
+| pkg-control-board | 1 | 0.8 | 19:16:12 |
+| pkg-conversation | 35 | 35.4 | 19:16:47 |
+| pkg-discord | 3 | 2.6 | 19:16:50 |
+| pkg-harness | 12 | 11.6 | 19:17:02 |
+| pkg-ledger | 13 | 13.5 | 19:17:15 |
+| pkg-mosaic | 3 | 2.3 | 19:17:18 |
+| pkg-plugins | 0 | 0.3 | 19:17:18 |
+| pkg-project | 1 | 1.2 | 19:17:19 |
+| pkg-runs | 1 | 0.8 | 19:17:20 |
+| pkg-seat | 6 | 6.2 | 19:17:26 |
+| pkg-tasks | 1 | 1.2 | 19:17:27 |
+| pkg-webui | 58 | 57.9 | 19:18:25 |
+| script-auth | 1 | - | 19:18:26 |
+| script-conductor | 5 | - | 19:18:31 |
+| script-config | 2 | - | 19:18:33 |
+| script-discord | 8 | - | 19:18:41 |
+| script-extension-package | 1 | - | 19:18:42 |
+| script-foundation | 40 | - | 19:19:22 |
+| script-land-work | 11 | - | 19:19:33 |
+| script-queue | 21 | - | 19:19:54 |
+| script-release | 11 | - | 19:20:05 |
+| script-task | 31 | - | 19:20:36 |
+
+Source: /mnt/storage/scratch/sage-g189/out/*.log mtimes and gate.log. The cli suite is about 59% of the run, and webui plus conversation add about 14%.
@@ -0,0 +1,541 @@
+# Q175 design: the Console verifies SSO itself (Vikunja #412)
+
+Author Sage, 2026-10-20, r3. Reviewer Filbert, and the review comes before any code. Line numbers are at
+refactor 4ca8d6e94 unless a line says otherwise. This replaces Part B (row 178 proxy proof, #385 comments 345
+and 353). #385 stays open until the Console stops trusting `X-authentik-username`.
+
+## Changes from r2 (Filbert's r2 review, CHANGES)
+
+- C1: the `console` key goes into the shared loader, scripts/mosaic-config.mjs, which today refuses any
+  unknown top-level key (:113). Section 4 names the blast radius. Jason step 4 moves inside the phase 2
+  window, after the pin and before the Console starts. The phase 2 rollback removes `console` first. A
+  test-config.sh case covers it (test 25). Mos confirms the sequence before phase 1 (section 5).
+- C2: under `--sso` the page treats a 401 `sign-in required` as signed out and links to
+  `/auth/login?return=<path>` (section 5 phase 1, test 24).
+- Notes: tests 7 and 15 are built so that only the record rule refuses; test 9a is an alg test; Q-B's two
+  classes are defined, and test 23 adds a 200 HTML page; the phase 2 scratch Console uses a scratch config,
+  a dummy slot, no `--send` and no `--tester-port`.
+- r3 fix (Filbert r3 approve): D1, the loader checks the slot reference's shape only, and the file checks
+  run in the Console's `--sso` start; D2, the slot resolves from the config dir, and the scratch Console has
+  a scratch dataRoot and an unreachable issuer (section 5).
+- Q-E: settled as Filbert ruled. The `subject-unknown` line keeps iss and sub, JSON-escaped and capped
+  (section 1, tests 10 and 19).
+
+## Changes from r1 (Filbert's r1 review, CHANGES)
+
+- B1: the provider config moves to `~/.config/mosaic-dev/config.json` (section 4). Mos agreed (mos-0973). The
+  Console prints provider ids, issuers and subject counts at start. The rehearse-strip follow-up is dropped.
+- B2: one return-path rule, `new URL(ret, publicOrigin).origin === publicOrigin` (section 1 step 7), with
+  tests for `/\evil.example` and `/%09/evil.example`.
+- B3: refusals log a fixed code and the provider id, never the error or its cause (section 1).
+- B4: login records are capped at 32 (section 1 step 1), with a test.
+- B5: test 9 splits into a forged payload under a real kid and a kid missing from the JWKS, and a try/catch
+  mutant joins the list. Test 2 no longer claims the signature mutant (section 9).
+- B6: the phase 2 forged-header check runs on a scratch Console, or Mos or Jason runs it on live (section 5).
+- Rulings: Q-B start degraded (section 4), Q-C only the public Host on 7332 (section 3), Q-D keep 1 h idle
+  but polls don't count as activity (section 3).
+- Section 6: `startServer` throws on `tester && sso`, and `human` joins `tester` as a refused subject label.
+- The missing tests and nits N1-N5 are in sections 1, 3, 7 and 9.
+- Section 8: the human-cli statement stays as written (mos-0972). The recommendation is now Mos's ruling.
+
+## The ruling this implements
+
+Jason, DECISIONS Q175, verbatim: "Q1: yes. This should be a requirement for SSO usage. Whether we are using
+Pocket ID, Authentik, WorkOS, or another provider (we should support multiple), the system should use best
+practices for jwt or other methods of validation that do not rely on hacks to pass the auth." He added "Zero
+trust with verification" and confirmed five points (mos-0970):
+
+1. The stack verifies every SSO login itself. It never takes identity from a proxy header or a shared secret.
+2. The Console is an OIDC relying party: discovery from the issuer URL, authorization code with PKCE, the ID
+   token checked against the provider JWKS (signature, iss, aud, exp, nonce), then its own session cookie.
+3. Several providers can be configured side by side.
+4. Only asymmetric signing counts. HS256 is refused.
+5. A proxy-forwarded token such as `X-authentik-jwt` counts only through the same checks. It is optional and
+   never the only way in.
+
+## What exists today
+
+The live Console runs from copies/490e2771d3d0 with `--public-host mosaic.woltje.com --auth-header
+X-authentik-username --allow-user jason.woltje --send --tester-port 7333`. Row 189 (#1687, P19 #413) adds
+`stack-release.sh activate --no-send`, and Mos's ruling mos-0972 takes `--send` off the live Console until
+phase 2.
+
+- `previewOptions` (packages/webui/src/serve.mjs:205) builds `{ host, header, user }`.
+- A request is `named` when its Host equals the public name (:493). A named request passes sign-in when it
+  carries exactly one auth header value equal to the user (:517-521). That header value is the whole identity.
+- Requests with a loopback Host on 7332 get the unauthenticated read path (:509-512). Writes need `named` (:526-546).
+- `proofOptions` (:217) is the row 178 shared-secret header. Q175 point 1 rules it out, so it retires with the
+  auth header.
+- The tester listener (`--tester-port`, row 176) binds 127.0.0.1. Its writer is fixed as
+  `{ tester: true, user: 'tester' }` (:522), it allows only the instance, route, name and chat writes (:523),
+  and it refuses the auth and proof headers (:486-487). 7332 refuses `x-mosaic-tester` (:485).
+- The public path is Traefik, then the Authentik proxy outpost (provider mosaic-preview, HS256, empty JWKS),
+  then chisel `R:0.0.0.0:7332:127.0.0.1:7332`, then the Console. Every public request reaches the Console from
+  127.0.0.1 with whatever Host the outpost forwards.
+
+## Design
+
+### 1. The Console becomes an OIDC relying party
+
+New module `packages/webui/src/sso.mjs`, used only by the human listener (7332). Routes:
+
+| Route | Method | What it does |
+|---|---|---|
+| `/auth/login` | GET | One provider configured: start its flow. Several: a plain page listing them, each a link to `/auth/login?provider=ID`. A provider whose discovery hasn't succeeded gets 503 (section 4). |
+| `/auth/callback` | GET | Finish the flow, create the session, 303 to the saved return path. |
+| `/auth/logout` | POST | Same-origin checks, delete the session, 303 to the provider's `end_session_endpoint`. |
+| `/auth/signed-out` | GET | Static "signed out" page with a sign-in link. |
+
+Every URL the Console hands a provider is built from the configured `publicOrigin`: `redirect_uri` is
+`publicOrigin + '/auth/callback'` and `post_logout_redirect_uri` is `publicOrigin + '/auth/signed-out'`. No
+code path reads the request's Host to build them (N2).
+
+The flow per provider:
+
+1. Start. Generate a state, a nonce and a PKCE verifier (`generateRandomState`, `generateRandomNonce`,
+   `generateRandomCodeVerifier`), and a challenge with `calculatePKCECodeChallenge` (S256 only). Put them, the
+   provider id, the return path and an expiry 10 minutes out in a server-side login record keyed by a random
+   id. The store holds at most 32 login records; a new one evicts the oldest (B4). Set `__Host-mosaic_login` to
+   that id. 303 to `authorization_endpoint` with `response_type=code`, `scope=openid profile email`,
+   `code_challenge_method=S256`, `redirect_uri`, `state` and `nonce`.
+2. Callback. Read exactly one `__Host-mosaic_login` cookie, then take and delete its record (single use, so a
+   replayed callback finds nothing). Expire the cookie in the response. The provider comes from the record,
+   never from the query, which stops a mix-up between providers. Two tabs signing in at once each set the
+   cookie, so the later one wins and the earlier tab's callback finds no record and gets the 403 page with a
+   sign-in link (N5). That costs one retry and keeps one cookie per browser.
+3. `validateAuthResponse(as, client, url, record.state)` checks state, refuses an error response, and checks
+   the `iss` parameter when the provider advertises RFC 9207.
+4. `authorizationCodeGrantRequest(as, client, clientAuth, params, redirectUri, record.verifier)` returns a
+   `Response`. Keep that object. `processAuthorizationCodeResponse(as, client, response, { expectedNonce:
+   record.nonce, requireIdToken: true })` checks iss, aud (and azp when aud has several values), exp, iat and
+   nonce, and checks `alg` against `client.id_token_signed_response_alg`. That field gets the provider's whole
+   `algs` array, which the library's `checkSigningAlgorithm` accepts, so a provider listing RS256 and ES256
+   takes either and nothing else (N1). Test 16 pins this.
+5. Signature. oauth4webapi does not verify the signature of an ID token that came straight from the token
+   endpoint over TLS (OIDC Core 3.1.3.7 allows that, and the library docs for
+   `validateApplicationLevelSignature` say so). Point 2 asks for the JWKS check, so the callback always calls
+   `validateApplicationLevelSignature(as, response)` with the same `Response` object from step 4. It fetches
+   the JWKS from the discovered `jwks_uri`, picks the key by `kty`, `kid`, `alg` and `use`, and refuses HS*
+   outright. On a `kid` it doesn't have, it refetches the JWKS once if the cache is at least 60 s old, which
+   covers key rotation (test 18). The call is not wrapped in a catch that continues; its throw ends the
+   callback.
+6. Our own checks on top of the library: `header.alg` is in the provider's `algs`, the token's `iss` equals
+   the configured issuer as a raw string compare, with no URL normalising (N3; the library's discovery check
+   compares normalised hrefs, so this one is stricter), and `(iss, sub)` is in the provider's `subjects` list.
+7. Create the session (section 3), then 303 to the return path. The rule (B2): resolve
+   `u = new URL(ret, publicOrigin)`, and use `u.pathname + u.search` only when
+   `u.origin === publicOrigin`; otherwise use `/`. A missing or unparsable `ret` gives `/`.
+
+Every refusal in steps 2-6 ends at a 403 page saying sign-in failed, with a link back to `/auth/login`. No
+step falls back to a header.
+
+Logging (B3). A refusal logs one line: a fixed code from a closed list (`login-record-missing`,
+`state-mismatch`, `auth-error-response`, `grant-failed`, `id-token-invalid`, `signature-invalid`,
+`alg-refused`, `issuer-mismatch`, `subject-unknown`, `discovery-failed`, `jwks-failed`) and the provider id.
+It never logs the exception, its message or its `cause`. oauth4webapi's errors carry token bodies and claims
+in `cause`, so even a message can leak. The one extra field is on `subject-unknown`: it logs `iss` and `sub`,
+because Jason step 3 reads his `sub` from that line (Q-E, Filbert's ruling). Authentik's default subject mode
+is a hashed user id that its admin view doesn't show, so the line is the practical source. Neither value is a
+credential. Three conditions hold:
+
+- Only a token that passed steps 3-6 up to the subject check reaches this line. Every earlier refusal logs
+  its own code and the provider id only.
+- Both values are written with `JSON.stringify` and each is cut to 255 characters first. Any account at the
+  provider can get a signed token, so a `sub` may hold a newline, and an unescaped one would let a sign-in
+  forge a log line.
+- Test 10 uses a `sub` holding `\n` and a fake `refused sign-in` suffix and asserts one escaped line.
+
+Test 19 asserts that no log line holds a token, code, state, nonce, verifier, client secret or session id.
+It exempts only the `iss` and `sub` fields of the `subject-unknown` line.
+
+### 2. Library: oauth4webapi 3.8.8, pinned exactly
+
+Mos's steer (mos-0971) was to prefer oauth4webapi over hand-rolled verification on `node:crypto` unless I
+could name a defect or a dependency cost that outweighs it. I found neither.
+
+- MIT, no dependencies, one ESM file (build/index.js, 99,856 bytes). Tarball sha256 `bac088aecc7c...`,
+  integrity `sha512-8N28E+a/oxfXW...` (the full values go in package-lock.json).
+- `supported()` covers PS/ES/RS 256/384/512, Ed25519/EdDSA and ML-DSA. No HS*. RSA keys under 2048 bits are
+  refused.
+- It does discovery with an issuer equality check (`processDiscoveryResponse(expectedIssuer, ...)`), PKCE,
+  state, the RFC 9207 `iss` parameter, nonce, and JWKS caching.
+- The one gap is the default skip of the token-endpoint signature check (section 1 step 5). Calling one
+  exported function closes it, so it isn't a reason to hand-roll.
+
+Hand-rolling would mean writing JOSE parsing, JWK import, key selection by `kid`, the claim checks and the
+discovery checks ourselves, with the same tests and more places to get it wrong.
+
+Pin: `"oauth4webapi": "3.8.8"` in the root package.json `dependencies`, next to the pi pin, with the lockfile
+entry. Root is right because `scripts/stack-copy.sh:23-31` copies only the root package.json and lock and runs
+`npm ci` there (:55-56). packages/webui/src resolves the import from the copy's root node_modules. This is the
+webui's first runtime dependency. The root dependency rule (exact pins, never unversioned) applies to it.
+Upgrades are reviewed commits.
+
+### 3. Sessions, cookies, Host and logout
+
+- Session id: 32 random bytes, base64url. The store keys on its sha256 and holds no raw id, so a heap dump
+  doesn't hold usable ids. Test 20 checks that the store's keys and values never contain the cookie value.
+- Cookie, exactly: `__Host-mosaic_session=<id>; Path=/; Secure; HttpOnly; SameSite=Lax`, no Domain, no
+  Max-Age (a browser-session cookie). The `__Host-` prefix makes the browser refuse it unless it was set over
+  https on this exact host. Test 21 asserts the whole Set-Cookie value, and a mutant drops `HttpOnly`.
+- Login cookie `__Host-mosaic_login`, the same attributes plus `Max-Age=600`. The login record also expires
+  at 10 minutes server-side.
+- Lax, not Strict, because the callback is a top-level navigation from the provider's site, and a Strict
+  cookie set there would be missing on the redirect to `/`. Lax still keeps the session off cross-site POSTs.
+  The write routes keep their exact `Origin` and `Sec-Fetch-Site: same-origin` checks (:171, :250, :297, :340,
+  :387, :425), so cross-site writes are refused twice.
+- Lifetime: 8 h absolute, 1 h idle, both server-side (Q-D, Filbert's ruling). The store is in memory with a
+  cap of 64 sessions (oldest goes first), so a Console restart signs everyone out. That's acceptable for one
+  human and keeps sessions off disk.
+- Activity (Q-D). Only a page load (a GET outside `/api/`) or a write (a POST) refreshes `seen`. The page's
+  background reads don't: `refresh` re-reads the board every 10 s (packages/webui/src/public/app.js:346) and
+  the 5 s timer at :301 redraws the age label. Without this rule an open tab would never go idle. Test 13
+  covers it.
+- The session holds `{ provider, iss, sub, name, idToken, created, seen }`. `name` is the subject entry's
+  label. It goes where `preview.user` goes today (send logs, settings, seat routes), so the downstream writer
+  shape stays as it is. `idToken` is kept only as the logout hint and never leaves the server.
+- Host (Q-C, Filbert's ruling). Under `--sso`, 7332 serves only requests whose Host is the public host.
+  Any other Host, loopback included, gets 403 `public Host required`, except `GET /healthz`. The loopback read
+  path at :509-512 is gone under `--sso`. Today's readers of 127.0.0.1:7332 and where they go:
+  - `scripts/webui-service.sh status` (:406), the stack-release gate (scripts/stack-release.sh:484) and the
+    rehearse gate (:1369) read only `/healthz`, which stays open on loopback.
+  - The webui README (:83) describes the loopback path. It changes in phase 1.
+  - Agent reads of the board go to the tester listener on 7333, which already serves reads. I found no other
+    code that reads 7332 on loopback. A person opening http://127.0.0.1:7332 in a local browser gets the 403
+    and uses the public URL instead.
+  Test 22 covers a loopback Host on `/`, `/api/board` and a write, and `/healthz` passing.
+- Every request on 7332 except `/healthz` and `/auth/*` needs a valid session. Without one, `/api/*` gets
+  401 JSON and other GETs get a 303 to `/auth/login?return=<path>`.
+- Logout: `POST /auth/logout` with the same-origin checks. It deletes the session, expires the cookie, and
+  303s to `end_session_endpoint?id_token_hint=...&post_logout_redirect_uri=<publicOrigin>/auth/signed-out&client_id=...`.
+  If the provider has no `end_session_endpoint`, it goes straight to `/auth/signed-out`.
+- Limit: signing out at the provider does not end a Console session until idle or absolute expiry. Back-channel
+  logout is a follow-up, not phase 1.
+
+### 4. Provider config: shape and location
+
+Location (B1, Filbert's ruling, Mos agreed in mos-0973): a `console.sso` key in
+`~/.config/mosaic-dev/config.json`. The reason is who can write it. The business file is writable by agents
+through `organizationWriter` (the tester verbs and the chief's `organization.set`), so a provider entry there
+could be changed by the agents the Console is meant to keep out. config.json is user-authored and never
+auto-written: `scripts/bootstrap.sh` creates it and nothing overwrites it. Adding the key is a Jason step
+(section 10).
+
+The loader (C1). Every tool reads config.json through one loader, scripts/mosaic-config.mjs. Its `validate`
+refuses any top-level key other than `configVersion`, `environment`, `dataRoot` and `execution` with
+`unsupported configuration key` (:113). The business, seat, cli, discord, bootstrap, land-work, stack-copy and
+conductor-apply code all use it. So phase 1 changes the shared loader, not a Console-only reader:
+
+- mosaic-config.mjs accepts an optional `console` key, and the strict `console.sso` shape validator (the
+  config checks below, except the slot file checks) runs inside the loader. The fail-closed canon holds for
+  every reader. The loader checks shape only and never touches a slot file: `clientSecret` must be
+  `{ slot: <name> }` with the name matching `[a-z0-9-]{1,64}`. The file checks and the read run only in the
+  Console's `--sso` start (D1), so a missing slot or a 0640 slot stops the Console, not the stack.
+- The blast radius is the whole stack. A typo in `console.sso` makes every tool refuse the config, not just
+  the Console. That's the price of one loader, and the reason step 4 writes the key inside a window with a
+  backup first.
+- The other direction breaks too. A copy older than phase 1 refuses a config that has the key. If the key
+  went in before the phase 2 pin, the live copy (490e2771d3d0 or later) would refuse its own config on the
+  next read, and the bus, seats and host would stop. After phase 2, a rollback to a pre-phase-1 copy fails
+  the same way until the key is removed. This is the same trap as the plug-in kind before a rollback.
+- Files without the key still load, on old and new copies.
+
+Test 25 in scripts/test-config.sh: a config with a valid `console.sso` loads, a malformed one fails with
+the bad key path named, and a config without `console` loads.
+
+No secret value goes in this file. The client secret is a slot reference.
+
+```json
+"console": {
+  "sso": {
+    "publicOrigin": "https://mosaic.woltje.com",
+    "providers": [
+      {
+        "id": "authentik",
+        "issuer": "https://auth.diversecanvas.com/application/o/mosaic-stack/",
+        "clientId": "<from Jason>",
+        "clientSecret": { "slot": "console-sso-authentik" },
+        "algs": ["RS256"],
+        "subjects": [ { "sub": "<from Jason>", "name": "jason.woltje" } ]
+      }
+    ]
+  }
+}
+```
+
+At start, `--sso` prints one line per provider: its id, its issuer and the number of subjects. No client id
+value beyond that, no secret, no `sub`.
+
+The slot is `<configDir>/secrets/mosaic-stack/<slot>`, where `configDir` is the directory of the config file
+the loader read (`MOSAIC_CONFIG`, default `~/.config/mosaic-dev`), so a scratch config gets a scratch slot
+(D2). The Console's `--sso` start reads it. The Console refuses to start if
+the file is a symlink, isn't a regular file, isn't owned by the Console's uid, has any group or other mode
+bits (0640 refuses as well as 0644), or resolves under the repo or a stack copy. The value is never logged or
+put in a refusal message.
+
+`stack-release.sh rehearse` starts its Console with `serve --port N --business B` and no `--sso`, so a
+rehearsed Console never reads `console.sso` and never uses the live redirect URI. No rehearse change is
+needed; r1's follow-up is dropped.
+
+Config checks, run at start without the network. Any failure refuses the start, and the message names the
+provider and the check:
+
+- `publicOrigin` is an https origin with no path, query or fragment.
+- Provider ids are unique and `[a-z0-9-]{1,32}`.
+- `issuer` is https with no query or fragment.
+- `algs` is non-empty and holds only asymmetric algs from the library's list. `HS256`, any `HS*` and `none`
+  refuse.
+- `subjects` is non-empty, each `sub` is 1..255 visible characters, and no `name` is `tester` or `human`.
+- `clientSecret` is `{ slot: <name> }` with the name matching `[a-z0-9-]{1,64}` (shape only, in the loader).
+- In the Console's `--sso` start only, the slot file passes the file checks above.
+
+Discovery checks, run per provider when its discovery succeeds:
+
+- Discovery returns `issuer` exactly.
+- `id_token_signing_alg_values_supported` shares at least one alg with `algs`. mosaic-preview advertises HS256
+  only, so it fails here.
+- `code_challenge_methods_supported` includes `S256`.
+- `jwks_uri` returns at least one key usable for one of `algs`. The empty mosaic-preview JWKS fails here too.
+
+Unreachable provider (Q-B, Filbert's ruling). Config errors still refuse the start. Each fetch of the
+discovery document or the JWKS lands in one of two classes:
+
+- Unreachable: a network error, a timeout, a status other than 200, or a body that doesn't parse as JSON. An
+  Authentik maintenance page served as 200 HTML is unreachable, not refused, so it can't block a restart.
+- Refused: a JSON document that fails the issuer, alg, S256 or JWKS check.
+
+An unreachable provider doesn't stop the Console. It starts, that provider's `/auth/login` gets 503
+`sign-in unavailable`, and a retry runs with backoff (5 s, doubling, capped at 5 minutes). `/healthz` stays
+200 and adds `sso: { <id>: "ready" | "unreachable" | "refused" }`, so the gates still pass and an operator
+can see the state. A refused provider at start refuses the start, because it's a configuration problem. On a
+later retry it stays disabled with the `discovery-failed` code until a restart. Sessions already made keep
+working while a provider is unreachable, since a session check needs no network. Test 23 covers the degraded
+start, a 200 HTML page, and the recovery.
+
+Several providers: Pocket ID, WorkOS and other compliant OPs use the same entry shape. The login page lists
+them. Each entry has its own issuer, client, algs and subjects, and a session records which provider made it.
+
+### 5. Retiring `--auth-header`, `--allow-user` and the proof header
+
+1. **Phase 1 (code row).** Add `--sso` to `cli.mjs serve` and `webui-service.sh`. It reads `console.sso` from
+   config.json. `--sso` cannot be combined with `--auth-header`, `--allow-user` or `--proof-*`. Under
+   `--sso`, `named` means "has a session", and `writer` comes from the session. `--send` needs `--sso` or the
+   old preview set. Phase 1 also carries the loader change and its test-config.sh case (section 4, test 25).
+   Nothing live changes until the re-pin.
+
+   The page (C2). Today app.js signs out only on `res.type === 'opaqueredirect'` (packages/webui/src/public/
+   app.js:111 and :305), which is the outpost's redirect. Under `--sso` the Console answers an `/api/*`
+   request without a session with 401 `sign-in required`, so the page would show an error on every 10 s
+   refresh and never offer a way back. Phase 1 makes both fetch paths treat a 401 whose body has
+   `error: 'sign-in required'` as signed out, and the signed-out notice links to
+   `/auth/login?return=<current path and query>`. Other 401s stay errors. The opaqueredirect branch stays
+   until phase 3, because the preview flags still run behind the outpost until then. Test 24 covers it.
+
+   Before phase 1 starts, Mos confirms the config.json sequence in phase 2 (C1).
+2. **Phase 2 (Jason-gated window).** Re-pin to the phase 1 commit with `--sso --send --tester-port 7333`
+   instead of the preview flags, after Jason steps 1 to 3. Backup first, STATE after (Q173). The order
+   inside the window:
+   1. Back up the store, the pointer, the unit and config.json.
+   2. Pin the phase 1 copy with the Console stopped. The copy's loader accepts a config with or without
+      `console`, so the bus and seats keep reading the old config.
+   3. Straggler check (Mos's C1 condition, mos-0977): list every running process, unit and timer that
+      still runs from the old copy and reads config.json. Each one is restarted on the new copy or shown
+      not to re-read config. The old loader refuses the key, so a straggler would fail on its next read.
+      Step 4 waits until the list is clean.
+   4. Jason step 4: the `console.sso` key goes into config.json, written by Jason or by an agent on his go
+      for that one key. The new loader reads it back (`scripts/mosaic-config.mjs` validate) before anything
+      starts.
+   5. Start the Console with `--sso --send --tester-port 7333`.
+   Acceptance: Jason signs in through the Console flow, sends one message and signs out. The forged-header
+   check (a request with `X-authentik-username` and no cookie gets 401) runs either on a scratch Console or
+   on live by Mos or Jason (B6). No agent sends the auth header to the live 7332 (section 8). The scratch
+   Console runs from the same copy as `serve --sso --port <scratch port>`, with `MOSAIC_CONFIG` pointing at a
+   scratch config in a scratch dir. That config has a scratch `dataRoot`, and any business it serves comes
+   from the scratch config dir; neither points at live. Its dummy client secret sits in the scratch slot
+   (`<scratch configDir>/secrets/mosaic-stack/<slot>`). Its issuer is an unreachable loopback host, not
+   Authentik, so the scratch Console sends nothing outbound (D2, mos-0971). It comes up in the degraded
+   state (Q-B), and the 401 check needs no sign-in. It has no `--send` and no `--tester-port`.
+
+   Rollback for phase 2: remove the `console` key from config.json first (restore the step 1 backup), then
+   roll the pointer back. An older copy's loader refuses a config holding the key (section 4), so the other
+   order stops the bus and seats. The window plan lists that order, and the STATE check after a rollback
+   reads config.json for the key's absence.
+3. **Phase 3 (code row).** Remove `previewOptions`, `proofOptions` and their tests. `cli.mjs` and
+   `webui-service.sh` refuse the old flags with `--auth-header was retired by Q175; use --sso`. Close #385
+   with the phase 2 STATE and the phase 3 commit.
+
+The Authentik proxy outpost can stay in front. It still sends `X-authentik-*` headers, and the Console never
+reads them. A test proves that a request carrying them gets nothing without a session cookie.
+
+### 6. The tester port and the N3 tester identity
+
+The tester listener exists so agents can test as the tester and never as Jason (mos-0870 N3). Under SSO:
+
+- It never mounts `/auth/*` (404), never reads a cookie, and refuses any request carrying `Authorization` or a
+  `__Host-mosaic_session` / `__Host-mosaic_login` cookie (403 `tester listener takes no sign-in`). The same
+  goes for `X-authentik-jwt` and the old auth and proof header names.
+- `startServer` throws when its options hold both `tester` and `sso`, so the SSO module can't be mounted on
+  the tester listener by a wiring mistake. A unit test calls it with both.
+- Its writer stays the fixed `{ tester: true, user: 'tester' }`, and it allows only the row 175 writes, as
+  today. No session or header can change it.
+- Its bus calls stay on `TESTER_CLI`. The bus checks the tester proof and refuses human verbs from it, and the
+  broker refuses a business whose human is `tester` and any role named `tester`. So nothing that reaches 7333
+  can become the human.
+- 7332 keeps refusing `x-mosaic-tester` for every Host (:485).
+- `subjects` validation refuses a `name` of `tester` or `human`.
+
+### 7. Point 5, the proxy-forwarded token
+
+Not in phase 1. Point 5 makes it optional and the code flow covers the ruling. If it's built later:
+
+- Verify with jose (MIT, exact pin), against the JWKS from the configured issuer's own discovery. Never use
+  the `X-authentik-meta-jwks` header, because it arrives with the request and the forger controls it.
+- Use the same alg allow list, iss, exp and subject list. `aud` is the proxy provider's client id, and the
+  config check refuses it if it equals any code-flow `clientId`, so an ID token issued to the Console can't be
+  replayed as a proxy token or the other way round (N4).
+- The mosaic-preview provider signs with HS256 and has an empty JWKS, so its `X-authentik-jwt` fails every
+  check until Jason gives it an RSA or EC key (Jason step 1).
+
+### 8. Interim exposure until phase 2
+
+Today, with `--send` live, any same-uid process on dragon-lin can connect to 127.0.0.1:7332 with
+`Host: mosaic.woltje.com`, `X-authentik-username: jason.woltje`, the matching Origin and
+`Sec-Fetch-Site: same-origin`, and send as Jason. That includes agent seats. Through the tunnel, the outpost
+strips client copies of the header, so a remote forger needs local code execution first. Users on other uids
+can reach the loopback port too (P19 333).
+
+Mos ruled (mos-0972) that the Console runs without `--send` until phase 2. Reads stay up, the header path
+stops carrying writes, and Jason sends piece 1 with `mosaic talk pm` instead. Row 189 (`stack-release.sh
+activate --no-send`, #1687) makes that change through the pointer so the unit and stack-active.json stay in
+step; the restart follows its landing. Until phase 2, no agent sends a request with the auth header to 7332.
+The tests use fixture servers.
+
+To be clear about the limit: SSO protects Console ingress. It doesn't protect the bus's human boundary. The
+human proof is path-bound (#225), so a same-uid process can already run the tree's `human-cli.mjs` and act
+as the human without touching the Console. Q175 doesn't change that. P19 333 owns it.
+
+### 9. Tests
+
+All tests run against a fake OP in `packages/webui/tests/helpers/fake-oidc.mjs`. It's a loopback https
+server with a self-signed cert. Each test passes the library a `customFetch` that trusts only that cert, so
+production code needs no insecure-request flag. The fake OP has discovery, a JWKS, and authorization, token
+and end-session endpoints, with keys made by `node:crypto` (RSA 2048, P-256, and an HMAC secret for the
+forgeries). It can serve two issuers at once and rotate its keys. No test reaches a real provider. Each
+refusal test asserts the status, that no `__Host-mosaic_session` was set, and that the bus send stub was
+never called. Each test also passes once unmutated, as the control.
+
+Refusals Mos named:
+
+1. Forged header. `X-authentik-username: jason.woltje` with `Host: mosaic.woltje.com`, the right Origin and
+   Fetch Metadata, and no cookie: 401 on `/api/bus/message`, `/api/settings` and `/api/config`, and a 303 to
+   login on `/`.
+2. HS256 ID token. The fake OP signs the ID token with HS256, using the client secret as the key (the classic
+   confusion) and `kid` set to a real RSA kid: refused at the callback. The library's alg check refuses it
+   before any signature check, so this test proves the alg rule, not the signature check. Test 9 covers that.
+3. Wrong aud. A correctly signed RS256 token with `aud` set to another client id: refused. Also an `aud`
+   array holding our client id and another, with no `azp`: refused.
+4. Expired token. A correctly signed token with `exp` 10 minutes ago (beyond the library's 30 s clock
+   tolerance): refused.
+
+More refusals:
+
+5. Wrong `iss`, both a different issuer and a trailing-slash variant.
+6. Nonce mismatch or missing nonce.
+7. State mismatch, a missing login cookie, a replayed callback (record already taken), an expired login record,
+   and two login cookies. For the replay, the fake OP is set to accept the same code twice, so the second
+   callback reaches the record lookup and only the take-and-delete rule refuses it.
+8. A provider that demands no PKCE. The token request must carry `code_verifier`, and the fake OP refuses a
+   wrong one.
+9. The signature check (B5), three cases: (a) `alg: none`; (b) an RS256 token whose header names a real kid in
+   the JWKS, with a changed payload and the original signature; (c) an RS256 token signed by a key whose kid
+   isn't in the JWKS, even after the refetch. (a) is refused by the alg check in step 4, so it's an alg test
+   like test 2. Only (b) and (c) reach step 5, and (b) is the case only the signature check catches.
+10. A valid token for a `sub` not in `subjects`: 403 and one `subject-unknown` log line with the provider id,
+    iss and sub only.
+11. Start refusals: `algs` holding `HS256` or `none`, HS-only discovery (the mosaic-preview shape), an empty
+    JWKS, no S256, an issuer mismatch, a subject named `tester` or `human`, `--sso` together with
+    `--auth-header`, and slot files that are a symlink, mode 0644, mode 0640, or under the repo. The owner
+    check has no test: making a file owned by another uid needs root, which the suite doesn't have. The
+    review reads that branch instead.
+12. Tester port: a valid session cookie (taken from a 7332 sign-in), `Authorization: Bearer <valid id token>`,
+    and `X-authentik-jwt` each get 403. `/auth/login` on 7333 gets 404. `startServer` with `tester` and `sso`
+    throws.
+13. Session: idle expiry, absolute expiry, a logout followed by reuse of the old cookie, and logout without
+    same-origin (refused, session kept). Background `/api/` GETs every 10 s for over an hour don't keep the
+    session alive; a page load does.
+14. Open redirect: `return=//evil.example`, `return=https://evil.example`, `return=/\evil.example` and
+    `return=/%09/evil.example` all land on `/`, and `return=/board?x=1` lands there.
+15. Provider mix-up. Two providers, A and B. A login started for A whose callback carries B's `iss` and a
+    code from B is refused, and a `provider=` query on the callback is ignored. B's code is issued against
+    A-record's PKCE challenge, so the verifier matches and only the record rule (the callback belongs to A)
+    refuses it.
+16. Several algs: a provider with `algs: ["RS256", "ES256"]` takes a token signed with either, and refuses
+    PS256 even when the JWKS holds a usable PS256 key.
+17. Login record cap: 33 started logins leave 32 records, and the first login's callback finds no record.
+18. JWKS rotation: the fake OP rotates to a new key with a new kid. A sign-in after the rotation succeeds
+    through the one refetch, and a token under the removed kid is refused.
+19. Logs: across every test in this file, captured log lines hold none of the tokens, codes, states, nonces,
+    verifiers, the client secret or a session id that the test produced.
+20. The session store holds no raw session id (keys are sha256 values, and no value holds the cookie).
+21. Set-Cookie: the exact session and login cookie strings, including the expiry of the login cookie at
+    callback.
+22. Host: under `--sso`, a loopback Host on `/`, `/api/board` and a write each get 403; `/healthz` on
+    loopback gets 200.
+23. Degraded start: the fake OP is down at start; the Console starts, `/auth/login` is 503, `/healthz` reports
+    `unreachable`; the OP comes up and the next retry makes sign-in work. A discovery URL that answers 200
+    with an HTML page also counts as `unreachable` and the Console starts. A provider that answers with
+    HS-only discovery at start refuses the start.
+24. Signed-out page (C2). A page test in the board-held.test.mjs style stubs fetch to answer 401
+    `{ error: 'sign-in required' }`: the page shows the signed-out notice, its link is
+    `/auth/login?return=<current path and query>`, and the refresh stops. A 401 with another error stays an
+    error. The existing opaqueredirect case still signs out.
+25. Loader (C1), in scripts/test-config.sh: a config with a valid `console.sso` loads; a malformed one (an HS
+    alg, a missing `slot` field, a slot name outside the pattern, an unknown key under `console`) fails and
+    names the bad key path, and no case reads a slot file (the file cases stay in test 11); a config without
+    `console` loads.
+
+Positive paths: an RS256 and an ES256 provider each complete sign-in and one send, and two providers configured
+together each work with their own subjects.
+
+Mutants for the gate, each killed by the named test:
+
+- drop the `validateApplicationLevelSignature` call (9b);
+- wrap that call in a try/catch that continues (9b);
+- drop the `subjects` check (10);
+- accept HS* in `algs` (11);
+- take the provider from the query (15);
+- let the tester listener read cookies (12);
+- skip the login record delete (7);
+- drop `HttpOnly` from the session cookie (21);
+- refresh `seen` on every request (13);
+- build `redirect_uri` from the request Host (a test with a different Host on `/auth/login` checks the
+  `redirect_uri` sent to the fake OP);
+- serve the loopback read path under `--sso` (22).
+
+### 10. Jason-gated steps
+
+1. Authentik mosaic-preview: give it an RSA or EC signing key or retire it, and confirm by an admin read that
+   client_id `GEQ84kBbt2RG6fhYQGgZl2J9jgjw6wRJ3oSWxqZQ` belongs to it. (Ask B matched it only on scopes and
+   redirect_uri.)
+2. Authentik mosaic-stack provider: register redirect URI `https://mosaic.woltje.com/auth/callback` and
+   post-logout URI `https://mosaic.woltje.com/auth/signed-out`, keep RS256, and give the client id. Put the
+   client secret into slot `console-sso-authentik` (or say an agent may create the slot file from a value he
+   puts in place, per the Q173 secrets rule). Agents never see the value.
+3. His `sub` for that provider, or a go to read it from the Console's one `subject-unknown` log line on his
+   first sign-in attempt.
+4. The `console.sso` entry in `~/.config/mosaic-dev/config.json`, inside the phase 2 window, after the pin
+   and before the Console starts (section 5). He writes it, or he gives an agent the go to write that one
+   key from the values in steps 2 and 3, with a backup of the file first. config.json is user-authored, so
+   this isn't covered by Q173. Writing it earlier stops every tool on the live copy, whose loader refuses
+   the key.
+5. Any Traefik or outpost change. None is needed while the outpost stays in front. Dropping the outpost
+   later, so the Console is the only gate, changes who can reach the Console from outside and is his call.
+6. The phase 2 re-pin window go.
+
+## Questions for review
+
+Q-A to Q-E are settled (Filbert r1 and r2, Mos mos-0973). One open point, for Mos:
+
+- The config.json sequence (C1): the key goes in only inside the phase 2 window, after the pin and before
+  the Console starts, with a backup first, and a rollback removes it before the pointer moves (section 5).
+  Mos confirms this before phase 1 starts.
@@ -0,0 +1,147 @@
+# Row 163 (D2): `stack-release.sh rehearse` and `bus start --no-launch`
+
+Gitea #1660. Brief: docs/plans/2026-10-18_stack-release.md, "Stack rehearsal on a scratch root
+(D2)", blob b1500d96ad27. Reviewer: Filbert. Rulings: mos-0961, mos-0962, mos-0963.
+Base: 4f02486d5 (origin/refactor). D2 lands after the Part B window (P19 385), because Part B's
+window file names the stack-release.sh blob (mos-0958, mos-0959).
+
+## What it does
+
+`rehearse ID BUSINESS --backup ACTIVATION|PATH --port N [--timeout S]` builds
+`<dataRoot>/rehearsals/<UTC second>-<copy 12>/` (0700) from a backup, runs a guard on the scratch
+config with the target copy's code, runs the migration checks when the schema differs, starts the
+target's `bus start BUSINESS --no-launch` and Console on the scratch root, gates them with D1's
+checks minus the PM's, checks that no session started, stops both, and compares the backup and the
+live config and business files with sums taken first. One PASS or FAIL line per check, then
+REHEARSAL_PASS (0) or REHEARSAL_FAIL (1). Usage exits 4. docs/TOOLS.md has the operator text.
+
+`bus start --no-launch` (brief item 4): `start()` refuses `launches-disabled`, so every launch path
+spawns nothing; a session's launch request is refused and logged; `listen()` starts no thread
+ticker; `recover()` signals and ends nothing and logs what it left; the Registry is read-only, so
+sessions.json stays as an earlier host left it and `add()` refuses. The host-up line ends
+`, launches disabled`. `--pm` with it is a usage error. No unit passes it.
+
+## Rulings carried
+
+- mos-0961: `data-root-live` refuses a scratch dataRoot that resolves to the live data root;
+  `sessions-live` refuses when a sessions.json in the scratch data root names a running pid. The run
+  never deletes the file or retries. recover() under --no-launch is covered by the launcher test
+  "bus start --no-launch leaves an earlier host's live session alone: no signal, no end,
+  sessions.json as it was".
+- mos-0962: every tracker.* variable is stripped, business and role level; `business.diff` keeps the
+  change; `tracker-configured` fails if bootConfig still sets trackers; notify.json is asserted to be
+  exactly {"notifyVersion":1,"binding":null} at 0600.
+- mos-0963: every role credential reference and @sync's is moved to its own 0600 file under
+  `<rehearsal>/placeholders/` holding `rehearsal-placeholder-token`; `credential-ref-live` fails for
+  an env reference or a file whose real directory is not the placeholders directory. Test R9 leaves
+  one role ref on a file outside placeholders and gets the FAIL; mutant K1 drops the check and R9
+  fails.
+
+## Outbound calls
+
+The rehearsal reaches nothing off the host:
+
+- reads: the live config.json, the live business file, the pointer, the backup, the copies
+  directory, the target copy's roles/, git in the canonical checkout (`copy_ok`'s merge-base);
+- writes: only `<dataRoot>/rehearsals/<stamp>/`;
+- processes: the target's bus host (`--no-launch`) and Console (`serve --port N --business B`, no
+  `--send`), both with `env -i HOME PATH MOSAIC_CONFIG=<scratch config>`;
+- network: 127.0.0.1:N for /healthz, and the host's sockets under the scratch data root.
+
+No model call: launches are disabled and no session starts (`no-session`). No Vikunja: tracker.*
+is stripped and `tracker-configured` checks bootConfig. No Discord: notify binding null. No Gitea:
+every credential ref is a placeholder file, and the git socket serves only bound sessions, of
+which there are none.
+
+`projects.stack.root` stays at the live checkout, /mnt/storage/src/mosaic-stack. The business
+file's projects are copied unchanged. Under --no-launch nothing makes a checkout from it, because
+checkouts are made only in `start()`, which refuses.
+
+## Deviations from the brief
+
+1. Item 1 says to copy "the business file, roles and organization file from the live config
+   directory". Roles come from the target copy's `roles/`, as the live bus reads them (rolesDir is
+   `<REPO>/roles` unless MOSAIC_ROLES_DIR is set, and `env -i` leaves it unset). The live config
+   directory has no organization file; bootConfig's organization entry is the config dir itself,
+   which here is the scratch config dir.
+2. The business file is rewritten, not copied (mos-0962, mos-0963), and `business.diff` records
+   the change.
+3. The `tracker` key stays and `tracker.sync.credentials` becomes a placeholder: the business
+   schema requires both, so stripping the key (mos-0962's wording) makes the loader refuse.
+   bootConfig sets trackers only with tracker.baseUrl and a project's tracker.project, and both are
+   stripped; `tracker-configured` checks the result. Authority: mos-0964 (2026-10-20T14:35:30Z),
+   which accepts this and replaces the "@sync still present" clause of mos-0963 item 2:
+   business.mjs:197 calls checkTracker on every load, and checkTracker requires tracker and
+   tracker.sync (:57, :59) and checks sync.credentials (:63). @sync stays with its ref on a
+   placeholder, and `credential-ref-live` covers it with the role refs. Evidence: R10 (a tracker
+   still set fails `tracker-configured`), K2 (the check dropped, R10 fails), K10 (the tracker.*
+   strip dropped, R1 fails on `tracker-configured`), and K9 (the @sync swap dropped, R1 fails on `credential-ref-live`).
+4. mosaic-config already refuses a scratch config that names the live data root lexically, because
+   the rehearsal directory sits inside the live data root and a dataRoot may not contain the config
+   dir. The guard's `data-root-live` catches the form that reaches the live root through a link
+   (R11).
+5. Files owned: the brief lists stack-release.sh, its test, TOOLS.md and the packet. Item 4's flag
+   adds packages/cli/src/cli.mjs, packages/cli/src/launcher.mjs, packages/seat/src/session.mjs and
+   their tests (host.test.mjs, launcher.test.mjs, session.test.mjs).
+6. The brief's "free loopback port" is an operator-given `--port`, refused when reserved (7332,
+   7333, the pointer's --port and --tester-port) or in use, never replaced by another port.
+7. Brief item 3's "in the foreground": the host runs as a child of the script for the length of
+   the gate, then gets SIGTERM; it is not a unit and not detached.
+
+## Tests
+
+packages/cli/tests/stack-release.test.mjs, rehearse section (stand-in host, Console, migrate and
+Store in four fixture copies; real scripts/mosaic, mosaic-config, cli config and the business
+loader):
+
+- R1 passes on the same schema: files, modes, placeholders, business.diff, the host's meta row in
+  the scratch store and not in the backup, args logs, steps.log equal to the output, live files
+  byte-identical.
+- R2 migration path 3g to 3h; R3 migrate fails.
+- R4 host fails, status fails, status names another pid, host launches, host keeps writer.lock.
+- R5 SIGTERM ignored: SIGKILL and FAIL host-stopped. R6 healthz. R7 copy-match.
+- R8 port in use, and 7332, 7333, the pointer's --port and --tester-port reserved.
+- R9 credential-ref-live (mos-0963). R10 tracker-configured (mos-0962). R11 data-root-live through
+  a link and sessions-live on a running pid (mos-0961). R12 notify-off.
+- R13 old copy, backup missing, backup sums, no pointer, usage.
+
+packages/cli/tests/launcher.test.mjs: recover() under --no-launch leaves an earlier host's live
+session alone; every launch is refused and logged; no thread tick (and the same host with
+launches runs it). packages/cli/tests/host.test.mjs: the host-up line, no sessions.json, --pm
+with --no-launch is usage, and no unit renders --no-launch. packages/seat/tests/session.test.mjs:
+a read-only Registry never writes and refuses add().
+
+## Mutants
+
+33, one per behaviour, each killed (mutants.py, mutants-run.log and mutants-rerun.log beside this file). The first run left K11
+(bus-status pid), K21 (scratch store linked to the backup), K27 (ticker under --no-launch) and
+K31 (cli drops launches); each got a test and the rerun killed all four. K21 now dies on
+FAIL backup-unchanged, the check it exists for.
+
+## Round 2 (Filbert r1, comment 29445: F1-F3 changes, N1)
+
+Filbert's six mutants M1-M6 survived the R tests. Each named a check that worked but that no test
+drove to FAIL. Round 2 adds those tests. stack-release.sh is unchanged (blob 0053f35d1360).
+
+- F1 (M1, M2): R14. A new fixture fault, host-touches, has the host append to a file it lists.
+  Three cases (the live config, the live business file, the backup's bus.sqlite) each give exactly
+  one FAIL, live-config-unchanged or backup-unchanged, after the gate passed and the host stopped.
+- F2 (M3): R9 gains a pm gitea reference left on env REHEARSAL_GITEA_TOKEN, which fails
+  credential-ref-live with "pm gitea is env REHEARSAL_GITEA_TOKEN" before the host starts.
+- F2 (M4): R11 gains a scratch config whose dataRoot is another existing directory ("resolves to
+  X, not R/data") and one whose dataRoot is not there ("X does not exist"). Both fail
+  data-root-scratch before the host starts.
+- F2 (M5): R4 gains host-launches-dir, a host that makes data/launches, which fails no-session
+  with "found launches under".
+- F3 (M6): R15 sends TERM, INT and HUP to a rehearsal whose gate is still waiting on /healthz.
+  Each gives FAIL signal, then console-stopped, host-stopped, host-released-store,
+  backup-unchanged and live-config-unchanged all PASS, REHEARSAL_FAIL, exit 1, and the host's pid
+  is gone. rehearse() gained an e.during hook that gets the child process.
+- N1: Registry.remove() wrote sessions.json under readOnly. #write() now returns at once when the
+  registry is read-only, so the constructor, add() and remove() share one rule. The session test
+  calls remove() on a read-only registry and checks that the file is unchanged.
+
+Mutants K34-K41, one per finding and N1, are all killed (r2/mutants-run.log beside this file):
+K34 backup-unchanged always passes, K35 live-config-unchanged always passes, K36 env ref
+accepted, K37 data-root-scratch mismatch dropped, K38 missing root dropped, K39 launches dir
+ignored, K40 no INT/TERM/HUP trap, K41 read-only Registry writes.
@@ -0,0 +1,10 @@
+04d72e5ef4d8d5fc85a4f11aa51331354696cc7cf66af2ed7540cf6cfc0153b9  agents/sage/work/queue-163/BUILD.md
+5bd1bc697cd56e57b00e60c0e80be72cd1043a55a6d2fc0b9e2ccdd0c5cf9802  docs/TOOLS.md
+52597d7fa1469510fcf8e6dfd63664ad4c492bc17039885aa839231798693058  packages/cli/src/cli.mjs
+5492ebb5aa3c9c85874e4c7de7b65fc37733e2db636690c11fe2d2fdf72c2dd0  packages/cli/src/launcher.mjs
+e9ce0e0f7368d3fb2e1edbd4ebc724513ec19d7bac0c993f8be0d9494427be07  packages/cli/tests/host.test.mjs
+42519898b5bcf84c21088647e161a86934d4fe351207f736b9b120b6e1c2b91b  packages/cli/tests/launcher.test.mjs
+4dfeefa1bb3c11e8633d75df4f628497ebd427ebf8402ba5efc3e5c7fd030057  packages/cli/tests/stack-release.test.mjs
+5abdeab8bc6b63d291d0054124a4311a2260b590c68f758daa142a9deb2f4a72  packages/seat/src/session.mjs
+741883e399d77d429cc29a87beef6db9c51c1759669b025006f037001d101eb6  packages/seat/tests/session.test.mjs
+5bb3ac40102ce515f1acdcbc5670feb161ce40a193e94e2f8b104ebf98eddc38  scripts/stack-release.sh
@@ -0,0 +1,28 @@
+base 580500699 dirty 0 DOCKER_HOST=unset
+pkg-bus rc=0 ℹ pass 451 ℹ fail 0  | ℹ duration_ms 3051.98676
+pkg-business rc=0 ℹ pass 149 ℹ fail 0  | ℹ duration_ms 1933.965446
+pkg-cli rc=0 ℹ pass 470 ℹ fail 0  | ℹ duration_ms 337885.04401
+pkg-control-board rc=0 ℹ pass 124 ℹ fail 0  | ℹ duration_ms 585.587135
+pkg-conversation rc=0 ℹ pass 182 ℹ fail 0  | ℹ duration_ms 33296.254589
+pkg-discord rc=0 ℹ pass 183 ℹ fail 0  | ℹ duration_ms 2624.332987
+pkg-harness rc=0 ℹ pass 133 ℹ fail 0  | ℹ duration_ms 11808.615207
+pkg-ledger rc=0 ℹ pass 89 ℹ fail 0  | ℹ duration_ms 12902.241615
+pkg-mosaic rc=0 ℹ pass 69 ℹ fail 0  | ℹ duration_ms 2051.760841
+pkg-plugins rc=0 ℹ pass 111 ℹ fail 0  | ℹ duration_ms 247.493374
+pkg-project rc=0 ℹ pass 40 ℹ fail 0  | ℹ duration_ms 1031.233595
+pkg-runs rc=0 ℹ pass 43 ℹ fail 0  | ℹ duration_ms 727.865986
+pkg-seat rc=0 ℹ pass 152 ℹ fail 0  | ℹ duration_ms 5858.066276
+pkg-tasks rc=0 ℹ pass 97 ℹ fail 0  | ℹ duration_ms 1147.333901
+pkg-webui rc=0 ℹ pass 269 ℹ fail 0  | ℹ duration_ms 46548.273469
+script-auth rc=0  | selftest: 15 passed, 0 failed
+script-conductor rc=0  | selftest: 17 passed, 0 failed
+script-config rc=0  | selftest: 24 passed, 0 failed
+script-discord rc=0  | discord suite: 78 passed, 0 failed
+script-extension-package rc=0  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0  | selftest: 44 passed, 0 failed
+script-land-work rc=0  | land-work selftests: 86 passed, 0 failed
+script-queue rc=0 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0  | selftest: 14 passed, 0 failed
+script-task rc=0  | selftest: 98 passed, 0 failed
+GATE_PASSED
+removed network sage-r163_default
@@ -0,0 +1,5 @@
+KILLED K11 bus-status pid check dropped (rc 1)
+KILLED K21 scratch store links the backup (rc 1)
+KILLED K27 ticker runs under --no-launch (rc 1)
+KILLED K31 cli --no-launch not passed to the launcher (rc 1)
+ALL_KILLED
@@ -0,0 +1,34 @@
+KILLED K1 credential-ref-live dropped (rc 1)
+KILLED K2 tracker-configured dropped (rc 1)
+KILLED K3 data-root-live dropped (rc 1)
+KILLED K4 sessions-live dropped (rc 1)
+KILLED K5 notify-off dropped (rc 1)
+KILLED K6 no-session dropped (rc 1)
+KILLED K7 copy-match dropped (rc 1)
+KILLED K8 role credential swap dropped (rc 1)
+KILLED K9 @sync swap dropped (rc 1)
+KILLED K10 business tracker strip dropped (rc 1)
+SURVIVED K11 bus-status pid check dropped (rc 0)
+KILLED K12 host-released-store dropped (rc 1)
+KILLED K13 SIGKILL counted as a pass (rc 1)
+KILLED K14 healthz always ok (rc 1)
+KILLED K15 port-reserved dropped (rc 1)
+KILLED K16 port-in-use dropped (rc 1)
+KILLED K17 backup-sums dropped (rc 1)
+KILLED K18 copy-without-no-launch dropped (rc 1)
+KILLED K19 migration skipped (rc 1)
+KILLED K20 migrate failure ignored (rc 1)
+SURVIVED K21 scratch store links the backup (rc 0)
+KILLED K22 scratch config keeps the live dataRoot (rc 1)
+KILLED K23 host started without --no-launch (rc 1)
+KILLED K24 start() launches under --no-launch (rc 1)
+KILLED K25 session launch request allowed under --no-launch (rc 1)
+KILLED K26 recover() ends sessions under --no-launch (rc 1)
+SURVIVED K27 ticker runs under --no-launch (rc 0)
+KILLED K28 registry writes under --no-launch (rc 1)
+KILLED K29 Registry readOnly writes anyway (rc 1)
+KILLED K30 Registry readOnly add() allowed (rc 1)
+SURVIVED K31 cli --no-launch not passed to the launcher (rc 0)
+KILLED K32 cli --pm with --no-launch allowed (rc 1)
+KILLED K33 cli host-up line drops launches disabled (rc 1)
+SOME_SURVIVED
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+# Row 163 mutants: each one drops or weakens one behaviour; the named tests must then fail.
+import hashlib, os, shutil, subprocess, sys, signal
+W = '/mnt/storage/scratch/sage-b163'
+OUT = os.environ.get('MUT_OUT', '/mnt/storage/scratch/sage-b163-gate/mutants')
+os.makedirs(OUT, exist_ok=True)
+SR = 'scripts/stack-release.sh'
+T = 'packages/cli/tests/stack-release.test.mjs'
+M = [
+ ('K1 credential-ref-live dropped', SR, 'if(f===null||phr===null||path.dirname(f)!==phr)fail("credential-ref-live"', 'if(false)fail("credential-ref-live"', T, '^R9 '),
+ ('K2 tracker-configured dropped', SR, 'if(config.trackers!==undefined)fail(', 'if(false)fail(', T, '^R10 '),
+ ('K3 data-root-live dropped', SR, 'if(root===real(live))fail(', 'if(false)fail(', T, '^R11 '),
+ ('K4 sessions-live dropped', SR, 'if(running.length)fail(', 'if(false)fail(', T, '^R11 '),
+ ('K5 notify-off dropped', SR, 'fail("notify-off",`${nf} is not {', 'void("notify-off",`${nf} is not {', T, '^R12 '),
+ ('K6 no-session dropped', SR, 'if [ -z "$found" ]; then r_pass no-session', 'if true; then r_pass no-session', T, '^R4 '),
+ ('K7 copy-match dropped', SR, '    R_GATE=copy-match\n', '    R_GATE=""; return 0\n', T, '^R7 '),
+ ('K8 role credential swap dropped', SR, 'strip(r?.vars);swap(name,r?.credentials)}', 'strip(r?.vars)}', T, '^R1 '),
+ ('K9 @sync swap dropped', SR, 'swap("@sync",b.tracker?.sync?.credentials);', '', T, '^R1 '),
+ ('K10 business tracker strip dropped', SR, '\nstrip(b.vars);\n', '\n', T, '^R1 '),
+ ('K11 bus-status pid check dropped', SR, 'String(s.host.pid)!==main?`host pid ${s.host.pid} is not ${main}, the host this run', 'false?`host pid ${s.host.pid} is not ${main}, the host this run', T, '^R4 '),
+ ('K12 host-released-store dropped', SR, 'if [ -e "$R/data/bus/writer.lock" ]; then', 'if false; then', T, '^R4 '),
+ ('K13 SIGKILL counted as a pass', SR, 'kill -KILL "$pid" 2>/dev/null || true; r_fail "$name-stopped"', 'kill -KILL "$pid" 2>/dev/null || true; r_pass "$name-stopped"', T, '^R5 '),
+ ('K14 healthz always ok', SR, '.then((r)=>process.exit(r.status===200?0:1),()=>process.exit(1));\' -- "$R_PORT"', '.then(()=>process.exit(0),()=>process.exit(0));\' -- "$R_PORT"', T, '^R6 '),
+ ('K15 port-reserved dropped', SR, '[ "$((10#$R_PORT))" != "$i" ] || r_abort port-reserved', 'true || r_abort port-reserved', T, '^R8 '),
+ ('K16 port-in-use dropped', SR, 'r_port_free "$R_PORT" || r_abort port-in-use', 'true || r_abort port-in-use', T, '^R8 '),
+ ('K17 backup-sums dropped', SR, 'sha256sum -c --quiet ../SHA256SUMS) >/dev/null 2>&1 ||', 'true) >/dev/null 2>&1 ||', T, '^R13 '),
+ ('K18 copy-without-no-launch dropped', SR, 'grep -qF -- \'"--no-launch"\' "$COPIES/$TO/packages/cli/src/cli.mjs" 2>/dev/null ||', 'true ||', T, '^R13 '),
+ ('K19 migration skipped', SR, 'if [ "$v" = "$T_SCHEMA" ]; then r_pass migration', 'if true; then r_pass migration', T, '^R2 '),
+ ('K20 migrate failure ignored', SR, '[ "$rc" = 0 ] && [ "$(tail -n 1 <<< "$out")" = "bus schema $T_SCHEMA ready" ] || r_abort migrate "', 'true || r_abort migrate "', T, '^R3 '),
+ ('K21 scratch store links the backup', SR, 'cp "$R_BK"/bus/* "$R/data/bus/" &&', 'ln -s "$R_BK"/bus/* "$R/data/bus/" &&', T, '^R1 '),
+ ('K22 scratch config keeps the live dataRoot', SR, 'c.dataRoot=data;', '', T, '^R1 '),
+ ('K23 host started without --no-launch', SR, '"$COPIES/$TO/scripts/mosaic" bus start "$BUSINESS" --no-launch >', '"$COPIES/$TO/scripts/mosaic" bus start "$BUSINESS" >', T, '^R1 '),
+ ('K24 start() launches under --no-launch', 'packages/cli/src/launcher.mjs', '    if (!launches) throw new Refusal("launches-disabled", "this host was started with --no-launch");\n', '', 'packages/cli/tests/launcher.test.mjs', None),
+ ('K25 session launch request allowed under --no-launch', 'packages/cli/src/launcher.mjs', '      if (!launches) {\n        await host.op({ op: "refuse", cap, code: "launches-disabled" })', '      if (false) {\n        await host.op({ op: "refuse", cap, code: "launches-disabled" })', 'packages/cli/tests/launcher.test.mjs', None),
+ ('K26 recover() ends sessions under --no-launch', 'packages/cli/src/launcher.mjs', '    if (!launches) {\n      for (const s of leftover) log(', '    if (false) {\n      for (const s of leftover) log(', 'packages/cli/tests/launcher.test.mjs', None),
+ ('K27 ticker runs under --no-launch', 'packages/cli/src/launcher.mjs', 'if (b.launch && launches) ticker', 'if (b.launch) ticker', 'packages/cli/tests/launcher.test.mjs', None),
+ ('K28 registry writes under --no-launch', 'packages/cli/src/launcher.mjs', 'new Registry(dataRoot, { readOnly: !launches })', 'new Registry(dataRoot)', 'packages/cli/tests/launcher.test.mjs', None),
+ ('K29 Registry readOnly writes anyway', 'packages/seat/src/session.mjs', '    if (!readOnly) this.#write();', '    this.#write();', 'packages/seat/tests/session.test.mjs', None),
+ ('K30 Registry readOnly add() allowed', 'packages/seat/src/session.mjs', '    if (this.#readOnly) throw new SeatError("this host keeps no sessions (--no-launch)", 2);\n', '', 'packages/seat/tests/session.test.mjs', None),
+ ('K31 cli --no-launch not passed to the launcher', 'packages/cli/src/cli.mjs', 'tracker: Boolean(boot.trackers?.[businessId]), launches, ', 'tracker: Boolean(boot.trackers?.[businessId]), ', 'packages/cli/tests/host.test.mjs', None),
+ ('K32 cli --pm with --no-launch allowed', 'packages/cli/src/cli.mjs', '    if (!launches && parsed.flags.has("--pm")) throw usage(', '    if (false) throw usage(', 'packages/cli/tests/host.test.mjs', None),
+ ('K33 cli host-up line drops launches disabled', 'packages/cli/src/cli.mjs', '${launches ? "" : ", launches disabled"}', '', 'packages/cli/tests/host.test.mjs', None),
+ ('K34 backup-unchanged always passes', SR, 'if [ "$(r_tree_sums "$R_BK")" = "$(cat "$R/backup.before")" ]; then r_pass backup-unchanged', 'if true; then r_pass backup-unchanged', T, '^R14 '),
+ ('K35 live-config-unchanged always passes', SR, 'if [ "$(sha256sum "$LIVE_CFG" "$LIVE_BIZ" 2>&1)" = "$(cat "$R/live.before")" ]; then', 'if true; then', T, '^R14 '),
+ ('K36 credential-ref-live accepts an env ref', SR, 'if(ref?.env!==undefined)fail("credential-ref-live"', 'if(false)fail("credential-ref-live"', T, '^R9 '),
+ ('K37 data-root-scratch mismatch dropped', SR, 'if(root!==real(scratch))fail(', 'if(false)fail(', T, '^R11 '),
+ ('K38 data-root-scratch missing root dropped', SR, 'if(root===null)fail("data-root-scratch"', 'if(false)fail("data-root-scratch"', T, '^R11 '),
+ ('K39 no-session ignores a launches dir', SR, '[ ! -e "$R/data/launches" ] || found+=" launches"', 'true || found+=" launches"', T, '^R4 '),
+ ('K40 no INT/TERM/HUP trap', SR, '    trap \'r_fail signal "the rehearsal was interrupted"; r_end\' INT TERM HUP\n', '', T, '^R15 '),
+ ('K41 read-only Registry writes', 'packages/seat/src/session.mjs', '    if (this.#readOnly) return;\n', '', 'packages/seat/tests/session.test.mjs', None),
+]
+sha = lambda p: hashlib.sha256(open(p, 'rb').read()).hexdigest()
+env = dict(os.environ, TMPDIR='/mnt/storage/scratch/sb163t')
+results = []
+ONLY = set(sys.argv[1:])
+for name, f, old, new, test, pat in M:
+    if ONLY and name.split()[0] not in ONLY: continue
+    p = os.path.join(W, f); bak = os.path.join(OUT, os.path.basename(f) + '.orig')
+    shutil.copy2(p, bak)
+    if sha(bak) != sha(p): sys.exit(f'backup of {p} failed')
+    src = open(p).read()
+    if src.count(old) != 1: sys.exit(f'{name}: pattern count {src.count(old)} in {f}')
+    open(p, 'w').write(src.replace(old, new))
+    cmd = ['node', '--test'] + (['--test-name-pattern', pat] if pat else []) + [test]
+    log = os.path.join(OUT, name.split()[0] + '.log')
+    try:
+        with open(log, 'w') as lf:
+            pr = subprocess.Popen(cmd, cwd=W, env=env, stdout=lf, stderr=subprocess.STDOUT, start_new_session=True)
+            try: rc = pr.wait(timeout=600)
+            except subprocess.TimeoutExpired:
+                os.killpg(pr.pid, signal.SIGKILL); pr.wait(); rc = 'timeout'
+    finally:
+        shutil.copy2(bak, p)
+        if sha(bak) != sha(p): sys.exit(f'restore of {p} failed')
+    killed = rc != 0
+    results.append((name, killed, rc))
+    print(f'{"KILLED" if killed else "SURVIVED"} {name} (rc {rc})', flush=True)
+print('ALL_KILLED' if all(k for _, k, _ in results) else 'SOME_SURVIVED')
@@ -0,0 +1,48 @@
+✖ R14 a host that writes the live config, the live business file or the backup fails the end check by name (10205.967212ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 10820.998717
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:2062:1
+✖ R14 a host that writes the live config, the live business file or the backup fails the end check by name (10205.967212ms)
+  AssertionError [ERR_ASSERTION]: /mnt/storage/scratch/sb163t/sr-V3yNfh/data/backups/stack/20261020T000000Z-2a52abd7922e/bus/bus.sqlitePASS copy: 2a52abd7922ec2ce073c2b481b490e984630e9ce, schema 3g
+  PASS port: 127.0.0.1:38065 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-V3yNfh/data/backups/stack/20261020T000000Z-2a52abd7922e matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-V3yNfh/data/rehearsals/20261020T150815Z-2a52abd7922e/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-V3yNfh/data/rehearsals/20261020T150815Z-2a52abd7922e/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-V3yNfh/data/rehearsals/20261020T150815Z-2a52abd7922e/data is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  PASS notify-off: binding null, so no Discord bridge
+  PASS tracker-configured: bootConfig sets no trackers
+  PASS credential-ref-live: 9 reference(s), each a placeholder
+  PASS migration: not needed: the backup is already 3g
+  PASS gate: host-up, bus-status, console-up, healthz and copy-match on 2a52abd7922ec2ce073c2b481b490e984630e9ce
+  PASS no-session: no sessions.json and no launches under /mnt/storage/scratch/sb163t/sr-V3yNfh/data/rehearsals/20261020T150815Z-2a52abd7922e/data
+  PASS console-stopped: pid 3546679
+  PASS host-stopped: pid 3546678
+  PASS host-released-store
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_PASS
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-V3yNfh/data/rehearsals/20261020T150815Z-2a52abd7922e
+  
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:2066:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
@@ -0,0 +1,48 @@
+✖ R14 a host that writes the live config, the live business file or the backup fails the end check by name (2394.880127ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 3000.67202
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:2062:1
+✖ R14 a host that writes the live config, the live business file or the backup fails the end check by name (2394.880127ms)
+  AssertionError [ERR_ASSERTION]: /mnt/storage/scratch/sb163t/sr-VQM0Df/cfg/config.jsonPASS copy: bf4bac79a205e5010c48897456fc6e665a3cf9aa, schema 3g
+  PASS port: 127.0.0.1:45755 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-VQM0Df/data/backups/stack/20261020T000000Z-bf4bac79a205 matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-VQM0Df/data/rehearsals/20261020T150820Z-bf4bac79a205/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-VQM0Df/data/rehearsals/20261020T150820Z-bf4bac79a205/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-VQM0Df/data/rehearsals/20261020T150820Z-bf4bac79a205/data is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  PASS notify-off: binding null, so no Discord bridge
+  PASS tracker-configured: bootConfig sets no trackers
+  PASS credential-ref-live: 9 reference(s), each a placeholder
+  PASS migration: not needed: the backup is already 3g
+  PASS gate: host-up, bus-status, console-up, healthz and copy-match on bf4bac79a205e5010c48897456fc6e665a3cf9aa
+  PASS no-session: no sessions.json and no launches under /mnt/storage/scratch/sb163t/sr-VQM0Df/data/rehearsals/20261020T150820Z-bf4bac79a205/data
+  PASS console-stopped: pid 3547161
+  PASS host-stopped: pid 3547160
+  PASS host-released-store
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_PASS
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-VQM0Df/data/rehearsals/20261020T150820Z-bf4bac79a205
+  
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:2066:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
@@ -0,0 +1,39 @@
+✖ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (609.420853ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1216.913248
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:1971:1
+✖ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (609.420853ms)
+  AssertionError [ERR_ASSERTION]: PASS copy: f2cd6e0875411f82c798b2a541604410cc77d2c7, schema 3g
+  PASS port: 127.0.0.1:41709 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-TRrjEx/data/backups/stack/20261020T000000Z-f2cd6e087541 matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-TRrjEx/data/rehearsals/20261020T150823Z-f2cd6e087541/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-TRrjEx/data/rehearsals/20261020T150823Z-f2cd6e087541/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-TRrjEx/data/rehearsals/20261020T150823Z-f2cd6e087541/data is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  PASS notify-off: binding null, so no Discord bridge
+  PASS tracker-configured: bootConfig sets no trackers
+  FAIL credential-ref-live: pm gitea is undefined, not a file in /mnt/storage/scratch/sb163t/sr-TRrjEx/data/rehearsals/20261020T150823Z-f2cd6e087541/placeholders
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_FAIL
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-TRrjEx/data/rehearsals/20261020T150823Z-f2cd6e087541
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:1990:9)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: false,
+    expected: true,
+    operator: '==',
+    diff: 'simple'
+  }
@@ -0,0 +1,37 @@
+✖ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (605.865597ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1061.260755
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:2006:1
+✖ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (605.865597ms)
+  AssertionError [ERR_ASSERTION]: other-rootPASS copy: 236c2e27d28711316d96143968ae477b7fa7b7e7, schema 3g
+  PASS port: 127.0.0.1:37319 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-aZQJrB/data/backups/stack/20261020T000000Z-236c2e27d287 matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-aZQJrB/data/rehearsals/20261020T150824Z-236c2e27d287/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-aZQJrB/data/rehearsals/20261020T150824Z-236c2e27d287/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-aZQJrB/other-root is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  FAIL notify-off: /mnt/storage/scratch/sb163t/sr-aZQJrB/other-root/notify/acme/notify.json is missing or not JSON
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_FAIL
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-aZQJrB/data/rehearsals/20261020T150824Z-236c2e27d287
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:2021:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: false,
+    expected: true,
+    operator: '==',
+    diff: 'simple'
+  }
@@ -0,0 +1,35 @@
+✖ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (916.097165ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1239.364874
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:2006:1
+✖ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (916.097165ms)
+  AssertionError [ERR_ASSERTION]: no-rootPASS copy: 998d46411d6c1d3168396f7bb5932e1e200a9263, schema 3g
+  PASS port: 127.0.0.1:43579 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-v0EeC4/data/backups/stack/20261020T000000Z-998d46411d6c matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-v0EeC4/data/rehearsals/20261020T150825Z-998d46411d6c/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-v0EeC4/data/rehearsals/20261020T150825Z-998d46411d6c/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-v0EeC4/no-root is not the live data root
+  FAIL guard: The "path" argument must be of type string. Received null
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_FAIL
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-v0EeC4/data/rehearsals/20261020T150825Z-998d46411d6c
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:2021:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: false,
+    expected: true,
+    operator: '==',
+    diff: 'simple'
+  }
@@ -0,0 +1,48 @@
+✖ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (18892.096194ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 19506.873236
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:1920:1
+✖ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (18892.096194ms)
+  AssertionError [ERR_ASSERTION]: host-launches-dirPASS copy: 2cb8943db81ed8e914000449977627f0a9d42d00, schema 3g
+  PASS port: 127.0.0.1:43729 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/backups/stack/20261020T000000Z-2cb8943db81e matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/rehearsals/20261020T150843Z-2cb8943db81e/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/rehearsals/20261020T150843Z-2cb8943db81e/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/rehearsals/20261020T150843Z-2cb8943db81e/data is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  PASS notify-off: binding null, so no Discord bridge
+  PASS tracker-configured: bootConfig sets no trackers
+  PASS credential-ref-live: 9 reference(s), each a placeholder
+  PASS migration: not needed: the backup is already 3g
+  PASS gate: host-up, bus-status, console-up, healthz and copy-match on 2cb8943db81ed8e914000449977627f0a9d42d00
+  PASS no-session: no sessions.json and no launches under /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/rehearsals/20261020T150843Z-2cb8943db81e/data
+  PASS console-stopped: pid 3550603
+  PASS host-stopped: pid 3550602
+  PASS host-released-store
+  PASS backup-unchanged
+  PASS live-config-unchanged
+  REHEARSAL_PASS
+  rehearsal directory: /mnt/storage/scratch/sb163t/sr-D2Wt2k/data/rehearsals/20261020T150843Z-2cb8943db81e
+  
+  
+  0 !== 1
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:1924:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
@@ -0,0 +1,39 @@
+✖ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (1289.845744ms)
+ℹ tests 1
+ℹ suites 0
+ℹ pass 0
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 1749.897862
+
+✖ failing tests:
+
+test at packages/cli/tests/stack-release.test.mjs:2073:1
+✖ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (1289.845744ms)
+  AssertionError [ERR_ASSERTION]: SIGTERMPASS copy: ba3ad437eb120f80d3a1bdc438860968dd038962, schema 3g
+  PASS port: 127.0.0.1:45847 is free
+  PASS backup: /mnt/storage/scratch/sb163t/sr-Bin1lp/data/backups/stack/20261020T000000Z-ba3ad437eb12 matches its SHA256SUMS
+  PASS scratch-root: /mnt/storage/scratch/sb163t/sr-Bin1lp/data/rehearsals/20261020T150846Z-ba3ad437eb12/data from the backup, config and business file under /mnt/storage/scratch/sb163t/sr-Bin1lp/data/rehearsals/20261020T150846Z-ba3ad437eb12/config, business.diff beside them
+  PASS data-root-live: /mnt/storage/scratch/sb163t/sr-Bin1lp/data/rehearsals/20261020T150846Z-ba3ad437eb12/data is not the live data root
+  PASS sessions-live: no running session named in the data root
+  PASS data-root-scratch
+  PASS notify-off: binding null, so no Discord bridge
+  PASS tracker-configured: bootConfig sets no trackers
+  PASS credential-ref-live: 9 reference(s), each a placeholder
+  PASS migration: not needed: the backup is already 3g
+  
+  
+  null !== 1
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/cli/tests/stack-release.test.mjs:2079:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: null,
+    expected: 1,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
@@ -0,0 +1,56 @@
+✔ REQ-LIMIT-1: family substring matching is no longer exported (0.993829ms)
+✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.643651ms)
+✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.22563ms)
+✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.390202ms)
+✔ session file and launch log: 0600, the session file written once (0.890354ms)
+✔ endReason maps the runner's exit codes; a signal is killed (0.110674ms)
+✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.151527ms)
+✖ a read-only Registry never writes sessions.json, refuses add() and leaves the file on remove() (1.357741ms)
+✔ REQ-THREAD-1 Registry.running keys a thread run by business, instance and thread (0.526184ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 threadStore checks both segments before the join and refuses an unsafe directory (1.243195ms)
+✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (0.781332ms)
+✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (192.679392ms)
+ℹ tests 12
+ℹ suites 0
+ℹ pass 11
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 266.973886
+
+✖ failing tests:
+
+test at packages/seat/tests/session.test.mjs:137:1
+✖ a read-only Registry never writes sessions.json, refuses add() and leaves the file on remove() (1.357741ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  + actual - expected
+  
+  + '{\n  "sessionsVersion": 1,\n  "sessions": []\n}\n'
+  - '{\n' +
+  -   '  "sessionsVersion": 1,\n' +
+  -   '  "sessions": [\n' +
+  -   '    {\n' +
+  -   '      "business": "acme",\n' +
+  -   '      "instance": "chief",\n' +
+  -   '      "run": "r1",\n' +
+  -   '      "runnerPid": 3551219,\n' +
+  -   '      "runnerStartTime": "61011768"\n' +
+  -   '    }\n' +
+  -   '  ]\n' +
+  -   '}\n'
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/sage-b163/packages/seat/tests/session.test.mjs:142:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: '{\n  "sessionsVersion": 1,\n  "sessions": []\n}\n',
+    expected: '{\n  "sessionsVersion": 1,\n  "sessions": [\n    {\n      "business": "acme",\n      "instance": "chief",\n      "run": "r1",\n      "runnerPid": 3551219,\n      "runnerStartTime": "61011768"\n    }\n  ]\n}\n',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
@@ -0,0 +1,10 @@
+f04d12a963b3199420f1d9c41fbdae67faf46f710a805cb9358f1fb52f5faed9  agents/sage/work/queue-163/BUILD.md
+5bd1bc697cd56e57b00e60c0e80be72cd1043a55a6d2fc0b9e2ccdd0c5cf9802  docs/TOOLS.md
+52597d7fa1469510fcf8e6dfd63664ad4c492bc17039885aa839231798693058  packages/cli/src/cli.mjs
+5492ebb5aa3c9c85874e4c7de7b65fc37733e2db636690c11fe2d2fdf72c2dd0  packages/cli/src/launcher.mjs
+e9ce0e0f7368d3fb2e1edbd4ebc724513ec19d7bac0c993f8be0d9494427be07  packages/cli/tests/host.test.mjs
+42519898b5bcf84c21088647e161a86934d4fe351207f736b9b120b6e1c2b91b  packages/cli/tests/launcher.test.mjs
+b01ff656962c6fdb5bc3554cfbb13645b7f25adae5f6cd9608af8de6d6091c6c  packages/cli/tests/stack-release.test.mjs
+448138d12404346989a6751a01c747718cef7d2bec19a0639a29fa6a8b74a82d  packages/seat/src/session.mjs
+cd6277c4e7155a7c93d09f5bc7cca1130708a35a6b75aa02d99af8360d6338b0  packages/seat/tests/session.test.mjs
+5bb3ac40102ce515f1acdcbc5670feb161ce40a193e94e2f8b104ebf98eddc38  scripts/stack-release.sh
@@ -0,0 +1,28 @@
+base 2a5f3a3a0 dirty 0 DOCKER_HOST=unset
+pkg-bus rc=0 ℹ pass 451 ℹ fail 0  | ℹ duration_ms 2970.304395
+pkg-business rc=0 ℹ pass 149 ℹ fail 0  | ℹ duration_ms 1953.76274
+pkg-cli rc=0 ℹ pass 472 ℹ fail 0  | ℹ duration_ms 367258.38335
+pkg-control-board rc=0 ℹ pass 124 ℹ fail 0  | ℹ duration_ms 585.394845
+pkg-conversation rc=0 ℹ pass 182 ℹ fail 0  | ℹ duration_ms 33402.754981
+pkg-discord rc=0 ℹ pass 183 ℹ fail 0  | ℹ duration_ms 2610.108892
+pkg-harness rc=0 ℹ pass 133 ℹ fail 0  | ℹ duration_ms 11612.167166
+pkg-ledger rc=0 ℹ pass 89 ℹ fail 0  | ℹ duration_ms 12928.162376
+pkg-mosaic rc=0 ℹ pass 69 ℹ fail 0  | ℹ duration_ms 2092.404214
+pkg-plugins rc=0 ℹ pass 111 ℹ fail 0  | ℹ duration_ms 250.471164
+pkg-project rc=0 ℹ pass 40 ℹ fail 0  | ℹ duration_ms 1069.844547
+pkg-runs rc=0 ℹ pass 43 ℹ fail 0  | ℹ duration_ms 732.731695
+pkg-seat rc=0 ℹ pass 152 ℹ fail 0  | ℹ duration_ms 5889.377731
+pkg-tasks rc=0 ℹ pass 97 ℹ fail 0  | ℹ duration_ms 1159.016661
+pkg-webui rc=0 ℹ pass 269 ℹ fail 0  | ℹ duration_ms 54984.81726
+script-auth rc=0  | selftest: 15 passed, 0 failed
+script-conductor rc=0  | selftest: 17 passed, 0 failed
+script-config rc=0  | selftest: 24 passed, 0 failed
+script-discord rc=0  | discord suite: 78 passed, 0 failed
+script-extension-package rc=0  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0  | selftest: 44 passed, 0 failed
+script-land-work rc=0  | land-work selftests: 86 passed, 0 failed
+script-queue rc=0 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0  | selftest: 14 passed, 0 failed
+script-task rc=0  | selftest: 98 passed, 0 failed
+GATE_PASSED
+removed network sage-r163_default
@@ -0,0 +1,9 @@
+KILLED K34 backup-unchanged always passes (rc 1)
+KILLED K35 live-config-unchanged always passes (rc 1)
+KILLED K36 credential-ref-live accepts an env ref (rc 1)
+KILLED K37 data-root-scratch mismatch dropped (rc 1)
+KILLED K38 data-root-scratch missing root dropped (rc 1)
+KILLED K39 no-session ignores a launches dir (rc 1)
+KILLED K40 no INT/TERM/HUP trap (rc 1)
+KILLED K41 read-only Registry writes (rc 1)
+ALL_KILLED
@@ -0,0 +1,86 @@
+# Row 189: `stack-release.sh activate --no-send`
+
+Gitea #1687. Vikunja P19 #413 (Q175 interim, #412). Brief: docs/plans/2026-10-20_activate-no-send.md.
+Rulings: mos-0972 (the Console runs without `--send` until Q175 phase 2), mos-0973 (go; Sage builds,
+Dewey reviews; gate is the cli suite plus every scripts/test-*.sh). Base: def2e7932 (refactor, the
+brief commit on 9ae8c73ac).
+
+## What it does
+
+`activate ID BUSINESS --no-send` drops `--send` from `RUN_CONSOLE` in a new `send_for_target`, which
+`console_for_target` calls after `proof_for_target`. `install_stack` renders the unit from
+`RUN_CONSOLE` and `write_pointer` writes the pointer from it, so both lose the flag and `flags_drift`
+stays quiet afterwards. Only `activate` takes the flag; the parser sends every other op to usage
+(exit 4).
+
+`check_target` lets a `--no-send` activate name the pointer's copy only when the pointer's Console
+flags hold `--send`. That run is a live-copy re-pin, the same path row 187 uses for the proof pair:
+the plan prints the live-copy note, the run stops both units, backs up the stopped store and starts
+them again. A plain same-copy activate, or a same-copy `--no-send` once `--send` is gone, still
+refuses `already-active`.
+
+`--plan` prints one `send:` line after the `proof:` line, for activate and rollback:
+
+- `send: dropped; --no-send was given`
+- `send: off; --no-send was given and the pointer holds no --send`
+- `send: carried` (the pointer's `--send` goes on unchanged)
+- `send: off`
+
+The steps log gets `drop --send; --no-send was given`, or `--no-send was given and the pointer holds no
+--send, so there is nothing to drop`.
+
+Rollback and pm-on carry the pointer's flags as they are, so once `--no-send` has run, nothing adds
+`--send` back. There is no re-enable flag (mos-0973). Q175 phase 2 changes the Console flags in its
+own row.
+
+docs/TOOLS.md: `[--no-send]` in the usage block and one paragraph after the proof paragraph.
+
+## Tests (packages/cli/tests/stack-release.test.mjs, T55)
+
+1. Seeded preview pointer with `--send --tester-port 7333`: a same-copy `activate B acme --no-send`
+   passes. The pointer and the unit ExecStart lack `--send` and keep the other flags in order, status
+   says the unit flags match, the steps log has the drop line, the log line has from = to = B and the
+   backup sum equals the stopped store's, and the units stop and start in order.
+2. Plain same-copy activate, with `--tester-port` and with `--no-proof`, refuses `already-active`. So does
+   a same-copy `--no-send` once `--send` is gone, and on a pointer that never held it.
+3. The four `send:` lines, the live-copy note on the same-copy plan only, and the Console line right
+   after `send:` without `--send`. The run on a pointer with no `--send` logs the nothing-to-drop line
+   and no drop line.
+4. After `--no-send` on C1, a rollback to B leaves `--send` out of the pointer and the unit, the steps
+   log never names `--send`, and status matches. pm-on after `activate --pm-after-harness --no-send`
+   keeps it off.
+5. `--no-send` on rollback (with and without `--plan`), pm-on, status, adopt and rehearse is a usage
+   error with the usage text, nothing written, started or logged. The usage text shows `[--no-send]`.
+6. A pointer holding both the proof pair and `--send`: the plans for `--no-proof`, `--no-send` and both
+   name what each drops and carries. `--no-send` keeps the pair, `--no-send` with a new pair replaces it,
+   `--no-proof` keeps `--send`, and both together leave neither. Status matches after each.
+
+`planTail` gains `'send: off'` after `'proof: off'`, because every plan now prints the line. T36 takes
+`out.slice(-n)` around `planTail`, so its four slice counts grow by one.
+
+## Mutants
+
+mutants.sh in this packet, run on the candidate. Each mutates scripts/stack-release.sh and runs T55
+plus T1 and T2.
+
+- M1: the same-copy exception ignores `--no-send`.
+- M2: the same-copy exception allows `--no-send` without `--send` in the pointer.
+- M3: with `--no-send`, the pointer is written from `P_CONSOLE`, so it keeps `--send` while the unit
+  drops it.
+- M4: rollback re-adds `--send`.
+- M5: the parser accepts `--no-send` for rollback.
+
+Results: mutants-run.log, all five killed (M1 5 failures, M2 2, M3 7, M4 2, M5 2).
+
+## Deviations from the brief
+
+- The brief's line numbers were taken before row 163 landed. The candidate corrects them to the
+  9ae8c73ac lines (check_target :249-256, flags_drift :646-657, console_for_target :664-693, adopt
+  :828).
+- Test 5 also covers rehearse and `rollback --plan`, which the brief did not list.
+
+## Outbound calls
+
+None. The change edits an array before the existing unit render and pointer write. Every test uses
+the stand-in systemctl, units, stores and data root the file already builds; no test touches
+`~/.mosaic-dev`, the live units or a slot file.
@@ -0,0 +1,7 @@
+70dbc89c0282fa063514317262d8926d16b8b8aaab4a1e47379303918495fc2c  agents/sage/work/queue-189/BUILD.md
+4bd216cce2b40b39998725daa8989f6e3acb3ccd81a7017f6b09026af3965584  agents/sage/work/queue-189/mutants-run.log
+ddbdddf03abf4aa91aa62f52e468be7af3c6b2f5d7bec2ee99b11e315471f18c  agents/sage/work/queue-189/mutants.sh
+5d7b2da84d994f4f93d1212e349b4e4c19c5c00780e6cfcde91edb3ca08c014e  docs/plans/2026-10-20_activate-no-send.md
+38e410c4cb731390f96747646eb7f6caa7a587fca9024ccbe901aab5ac19c7cf  docs/TOOLS.md
+fe430969cc669515e348fced1a22cbe839a12023f7ac67cfba905b7afd29872f  packages/cli/tests/stack-release.test.mjs
+16f77305e558f4fb953accc6d09f1f7b408aba363851d8ca79216ffce41bed9f  scripts/stack-release.sh
@@ -0,0 +1,5 @@
+M1 KILLED fail=5
+M2 KILLED fail=2
+M3 KILLED fail=7
+M4 KILLED fail=2
+M5 KILLED fail=2
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Row 189 mutants M1-M5: each mutates scripts/stack-release.sh in the sage-b189 worktree, runs T55 and
+# the plan-tail tests, and restores the file from a checked backup.
+set -uo pipefail
+WT=/mnt/storage/scratch/sage-b189
+OUT=/mnt/storage/scratch/sage-b189-mut/out
+S=$WT/scripts/stack-release.sh
+mkdir -p "$OUT" || exit 1
+cp -p "$S" "$OUT/stack-release.sh.orig" || { echo "backup failed"; exit 1; }
+ORIG=$(sha256sum "$S" | cut -d' ' -f1)
+[ "$(sha256sum "$OUT/stack-release.sh.orig" | cut -d' ' -f1)" = "$ORIG" ] || { echo "backup differs"; exit 1; }
+restore() { cp -p "$OUT/stack-release.sh.orig" "$S"; [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ] || { echo "RESTORE FAILED"; exit 1; }; }
+trap restore EXIT
+
+mutate() {
+    case "$1" in
+        M1) sed -i '/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/d' "$S" ;;
+        M2) sed -i 's/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/{ [ "$NO_SEND" = 1 ]; } ||/' "$S" ;;
+        M3) sed -i 's/^    write_pointer "\$TO" "\$RUN_PM" "\$RUN_PENDING" "\$P_CLAUDE" "\$T_SCHEMA" "\${RUN_CONSOLE\[@\]}"$/    if [ "$NO_SEND" = 1 ]; then write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${P_CONSOLE[@]}"; else write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${RUN_CONSOLE[@]}"; fi/' "$S" ;;
+        M4) sed -i 's/^        SEND_PLAN="send: off"$/        SEND_PLAN="send: off"; [ "$OP" != rollback ] || RUN_CONSOLE+=(--send)/' "$S" ;;
+        M5) sed -i 's/--no-send) \[ "\$OP" = activate \] || usage;/--no-send) { [ "$OP" = activate ] || [ "$OP" = rollback ]; } || usage;/' "$S" ;;
+    esac
+}
+
+for m in M1 M2 M3 M4 M5; do
+    restore
+    mutate "$m"
+    if [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ]; then echo "$m NOT-APPLIED"; continue; fi
+    bash -n "$S" || { echo "$m SYNTAX"; continue; }
+    diff "$OUT/stack-release.sh.orig" "$S" > "$OUT/$m.diff"
+    (cd "$WT" && TMPDIR=/mnt/storage/scratch/t189 timeout 900 node --test --test-reporter=tap --test-name-pattern='T55|T1 |T2 ' packages/cli/tests/stack-release.test.mjs) > "$OUT/$m.log" 2>&1
+    fails=$(awk '/^# fail /{print $3}' "$OUT/$m.log")
+    if [ "${fails:-0}" -gt 0 ]; then echo "$m KILLED fail=$fails"; else echo "$m SURVIVED"; fi
+done
@@ -0,0 +1,23 @@
+b99e7f4bf58ac68c8f5fa58eb7b90c0f85b15ca9a80fd093f6aaeafeac931608  adapters/README.md
+c32d2a3276db92433d4e3c4f4b45fab048d9a46119d9f69cead6a11cfacfeadb  agents/sage/work/queue-66/BUILD.md
+8777fac3acb89f3af4ac0db2e7c44e309408a8ab8d1b0a0942c81c54ad295fa9  docs/TOOLS.md
+ea11398dc5751a0f9415079e7c03f413e97f5443f6bd0fc1fc2319ec646c20cb  packages/cli/tests/stack-copy.test.mjs
+b027dc74583217b4151173ecbabfcfbfc7b108ac6b7a8e93dd21a2834051714f  packages/harness/README.md
+bfb2156c609eeaf87c9e209c562576a5ef47535eaeee61d841bb0bd75a76a69d  packages/harness/src/runner.mjs
+0a27f2c8de7b9191f9c0d4a209331c63ff7630923e669838b41715924b0a64b0  packages/harness/tests/bundle.test.mjs
+81d0352f2dcd41eb2e2ef962365d9b97515d7e8d9668a35bb9ce9dce4f1451ea  packages/harness/tests/claude-session.test.mjs
+b16f33442cefd5b5ae2af85edab33250ee6b31025e437edf0e4eba9fe0afa793  packages/harness/tests/fixtures/fake-adapter.mjs
+1e187a2e23a197640d139e6975dfaf83dd7e337c360d128833678dc60f3e2046  packages/harness/tests/pi-session.test.mjs
+37ca6ad6467573658c1ac6807b6cd00e3f9da289107fb689190a1872bff9b89c  packages/harness/tests/runner.test.mjs
+04c24058f37260c9192d5036c8cf28b50faba8e3e3bf57f198d233485d0d57e6  packages/plugins/harness/claude-code/index.mjs
+2c1252e8e8db3ba4551bf1e34156ddf4e933cc664fc157105bef9a2705d6ce3b  packages/plugins/harness/pi/index.mjs
+7e0bea27d4360a39874fa64b3506a85f83888613a285ec0b087d74bf22b76421  packages/plugins/README.md
+ec4ec9502ee8e766e3abd04d9f724c0d8ff4ef114394a0f76d5320c2dc715c5c  packages/plugins/tests/harness.test.mjs
+f6141dac9a8c61573e4198480fed85e093992ee9c19fb55e9bc2752381b7b07a  packages/seat/tests/sandbox.test.mjs
+e60bf54c23e04436a982174348857458039a22e1769fc9ad4db8d4f9b57f2e86  packages/webui/tests/pinned-copy.test.mjs
+3ba3dbd9ff8dd68f0aa85bac92a8960af10166130bbc16df74fd7340776bb3b1  scripts/stack-copy.sh
+7ee6ed6e6ac55b1348d40a358372e66c86fdebacd90001d447040133e1187882  tools/unslop-hook/claude-hook.js
+ce1dfb11d0a8e8efd3d6dae67cc259c2e7443a62c7416bdedd4c71306d8c6df1  tools/unslop-hook/extension.ts
+f07d67806f40763b4be87d31c2976448b5cfc34d7328519fae2d8313b1ca3e20  tools/unslop-hook/README.md
+dbe3d5c9ae654d2401e3c496a6b03757a438e4a551fd8e460df8c82902bb80a7  tools/unslop-hook/test-unslop-check.js
+76be78178a0703b9d20a7df2278ecb13f429dea90cea45180f22302e267ea25e  tools/unslop-hook/unslop-check.js
@@ -0,0 +1,31 @@
+base 8ec03b45a dirty 11 DOCKER_HOST=unset
+unslop rc=0  | 28/28 passed
+pkg-bus rc=0 ℹ pass 451 ℹ fail 0  | ℹ duration_ms 3039.978
+pkg-business rc=0 ℹ pass 149 ℹ fail 0  | ℹ duration_ms 2119.713943
+pkg-cli rc=0 ℹ pass 454 ℹ fail 0  | ℹ duration_ms 294959.155129
+pkg-control-board rc=0 ℹ pass 124 ℹ fail 0  | ℹ duration_ms 590.346847
+pkg-conversation rc=0 ℹ pass 182 ℹ fail 0  | ℹ duration_ms 33735.620305
+pkg-discord rc=0 ℹ pass 183 ℹ fail 0  | ℹ duration_ms 2607.173768
+pkg-harness rc=0 ℹ pass 142 ℹ fail 0  | ℹ duration_ms 11398.667142
+pkg-ledger rc=0 ℹ pass 89 ℹ fail 0  | ℹ duration_ms 12920.093134
+pkg-mosaic rc=0 ℹ pass 69 ℹ fail 0  | ℹ duration_ms 2060.508354
+pkg-plugins rc=0 ℹ pass 111 ℹ fail 0  | ℹ duration_ms 245.928975
+pkg-project rc=0 ℹ pass 40 ℹ fail 0  | ℹ duration_ms 1052.940331
+pkg-runs rc=0 ℹ pass 43 ℹ fail 0  | ℹ duration_ms 741.129125
+pkg-seat rc=0 ℹ pass 151 ℹ fail 0  | ℹ duration_ms 5795.650378
+pkg-tasks rc=0 ℹ pass 97 ℹ fail 0  | ℹ duration_ms 1148.870662
+pkg-webui rc=0 ℹ pass 269 ℹ fail 0  | ℹ duration_ms 55714.69432
+script-auth rc=0  | selftest: 15 passed, 0 failed
+script-conductor rc=0  | selftest: 17 passed, 0 failed
+script-config rc=0  | selftest: 24 passed, 0 failed
+script-discord rc=0  | discord suite: 78 passed, 0 failed
+script-extension-package rc=0  | extension package selftest: 18 passed, 0 failed
+script-foundation rc=0  | selftest: 44 passed, 0 failed
+script-land-work rc=0  | land-work selftests: 86 passed, 0 failed
+script-queue rc=0 ℹ pass 156 ℹ fail 0  | queue suite: 28 passed, 0 failed
+script-release rc=0  | selftest: 14 passed, 0 failed
+script-task rc=0  | selftest: 98 passed, 0 failed
+GATE_PASSED
+removed network sage-b66_default
+exit=0
+2026-10-20T13:41:45Z
@@ -0,0 +1,5 @@
+K1-note-r1 rc=1 KILLED ℹ pass 37 ℹ fail 2 
+K2-reason-uncut rc=1 KILLED ℹ pass 38 ℹ fail 1 
+K3-sent-first rc=1 KILLED ℹ pass 38 ℹ fail 1 
+K4-no-copy-path rc=1 KILLED ℹ pass 12 ℹ fail 1 
+MUTANTS_DONE
@@ -0,0 +1,10 @@
+packages/harness/tests/runner.test.mjs rc=0 ℹ pass 39 ℹ fail 0 
+packages/harness/tests/pi-session.test.mjs rc=0 ℹ pass 10 ℹ fail 0 
+packages/harness/tests/claude-session.test.mjs rc=0 ℹ pass 10 ℹ fail 0 
+packages/cli/tests/stack-copy.test.mjs rc=0 ℹ pass 13 ℹ fail 0 
+packages/webui/tests/pinned-copy.test.mjs rc=0 ℹ pass 10 ℹ fail 0 
+packages/cli/tests/stack-release.test.mjs rc=0 ℹ pass 151 ℹ fail 0 
+packages/cli/tests/thread-launch.test.mjs rc=0 ℹ pass 11 ℹ fail 0 
+packages/seat/tests/sandbox.test.mjs rc=0 ℹ pass 10 ℹ fail 0 
+unslop rc=0 28/28 passed
+SINGLES_DONE
@@ -117,3 +117,82 @@ d. Before piece 1 opens, I check on the live pin which role takes a piece

 Mos passes this to Jason when piece 1 opens, not before. Lead decisions 94,
 114 and 115 stand.
+
+## 2026-10-20T12:54Z trigger (a) met; check (d), the part an agent can read
+
+Trigger (a): the Part A window put 490e2771d3d0 live (pm true, schema 3i,
+proof off), checked by Mos (mos-0928). That is the first window verified
+since mos-0855, and it carries 3i, so piece 1 may open.
+
+Check (d), what I can read from this seat at 12:54Z:
+- `scripts/mosaic launches list` prints one run, r34520a581318,
+  mosaic-stack/chief, claude-code claude-opus-5-5, by jason, since
+  2026-10-20T07:58:02Z, running.
+- The bus, the Console (7332) and that run's runner all run from
+  copies/490e2771d3d0, and the bus runs `bus start mosaic-stack --pm`.
+- What I can't check: that a human message to the PM gets answered. Every
+  other `scripts/mosaic` verb refuses an agent run ("this runs only from a
+  human shell"), and the tester switch is Jason's. That half needs a human
+  send, or Mos's Part A STATE evidence if it holds one.
+
+Rule (c) still applies: Part B (P19 385) is a window, so if Jason gives J1
+while a piece is open, Part B waits for that piece to close.
+
+## 2026-10-20T12:55Z mos-0960: the first message to pm is a reachability check
+
+Mos accepted the correction (no date) and agreed trigger (a) is met. Check
+(d) item 3 is not settled: the Part A window (W9) tested only the tester
+thread d0ba7a66, and S1 had no human thread, so no talk or follow answer
+from pm exists on 490e2771d3d0. Mos read the live business file: launch.by
+is chief, and pm is in launch.instances with cto, assistant, coder and
+reviewer, with no threadIdleSeconds. Mos's reading of cli.mjs:345 (not a
+test) is that a talk to pm tells the chief to launch pm.
+
+Ruling:
+- Jason's first message to pm is a reachability check, not a piece, like
+  6b5b7aef and a8df1e12 on 10-12.
+- If pm answers, his next real Mosaic Stack request is piece 1.
+- If pm doesn't answer, I file the defect and piece 1 doesn't open.
+- Rule (c) stands. Mos recommends to Jason that J1 and Part B go before
+  piece 1 if he gives both together, so the pieces run on the final Console
+  auth.
+
+Mos tells Jason in the morning summary.
+
+## 2026-10-20T17:48Z correction: on a pinned host Jason uses plain `mosaic` (Mos mos-0968)
+
+This supersedes the 10-12 line at 18:56Z, "Until row 85 lands, Jason uses
+the full path, `/mnt/storage/src/mosaic-stack/scripts/mosaic talk pm
+"..."`". Row 85 landed, and the host, bus and Console now run from the
+pinned copy 490e2771d3d0. The bus takes human commands only from the tree
+it runs from. The canonical checkout is not that tree.
+
+Jason ran the full-path command Mos gave him from that line. It refused
+with human-required: "the bus accepts these commands only from the tree it
+runs from; on a pinned host run `mosaic` on PATH". ~/.npm-global/bin/mosaic
+now execs copies/490e2771d3d0/scripts/mosaic, which I read at 17:48Z, so
+Jason uses plain `mosaic talk pm "..."` or the Console. Friction is on
+Vikunja #205, comment 369.
+
+Nothing else changes. The refused command never reached pm, so the
+reachability check (mos-0960) has not happened and piece 1 is not open.
+
+## 2026-10-20T17:54Z S7 reachability pass (Mos mos-0969)
+
+Jason ran the plain PATH command from the 17:48Z entry. His output, as Mos
+relayed it in mos-0969:
+
+```
+[jwoltje@dragon-lin winA]$ mosaic talk pm "Can you hear me?"
+sent 51cebff7 to pm
+pm isn't running, chief has been told
+pm (RESULT, re 51cebff7) cff1e9ad:
+Yes, I'm getting your messages. I haven't changed anything on the tracker. What do you need?
+```
+
+pm was not running when 51cebff7 arrived. The chief launched it, and pm
+answered with cff1e9ad. Under mos-0960 this is the reachability check, not
+a piece. It passed, so the "pm doesn't answer" branch does not apply and
+no defect is filed.
+
+Piece 1 is Jason's next real Mosaic Stack request to pm. It is not open yet.
@@ -0,0 +1,48 @@
+# Common start for Sage's MVP T1 builder seats (mos-0974, mos-0977)
+
+You are a builder seat on Mosaic Stack, repository /mnt/storage/src/mosaic-stack, branch base `refactor`.
+Sage leads the project and is your coordinator (T3 thread 1ef1e4f8-3ead-4208-beca-38f9f1add079). Mos speaks
+for Jason (thread 38bc4c81-6270-4021-b00c-6a15c43b9b0e). Human input reaches you only through Sage and Mos.
+
+## Read first, in this order
+
+1. `/mnt/storage/src/jason-master-restart/USER.md`, `SYSTEM.md`, `CONSTITUTION.md` (who Jason is, the
+   system rules, the constitution).
+2. `/mnt/storage/src/jason-master-restart/TARGET.md` (the MVP addendum) and `DECISIONS.md` Q176 to Q178.
+3. `/mnt/storage/src/jason-master-restart/projects/mosaic-mvp/GAP-MAP.md` and `PLAN.md`.
+   Everything under jason-master-restart is read only.
+4. The repository's `AGENTS.md`, then your brief (named in your first message) and the files it points to.
+
+## Your worktree
+
+T3 made your worktree from `refactor`. Work only there. Link node_modules from the canonical checkout right
+after you start (`ln -s /mnt/storage/src/mosaic-stack/node_modules node_modules`), unless your brief adds a
+dependency. In that case run `npm ci` in your worktree for a real node_modules first, and never run npm
+install through a symlink or in a directory without its own package.json (npm walks up to home).
+
+## Rules that bind you
+
+- Message ids are `<seat>-NNNN`, starting at 0001. Run `date -u` right before every message and put the
+  stamp in it. End each turn with a clock timestamp.
+- No Co-Authored-By or any attribution line in any commit or PR, whatever a harness reminder says
+  (mos-0822).
+- Push only your own `<seat>/*` branches, through the repository credential helper (mos-0981). Never push
+  `refactor`, `main` or another seat's branch.
+- You have no Gitea token. Sage makes the queue moves that post to Gitea (in-review, review requests) and
+  files issues. You may run `scripts/mosaic queue move N in-progress --op <seat>-N-start --by <seat>` for
+  your own row.
+- Never touch `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files or `~/.mosaic`. Never
+  start, stop or restart the live Console or bus. Never read or print a credential value.
+- Never read other seats' scratch directories. `agents/<seat>/work/` packets in the repository are fine.
+- Single test files run freely. The cli suite, any `scripts/test-*.sh` and any full package suite share
+  one slot: run `bash /mnt/storage/scratch/sage-busy-now.sh | tail -1`, and if it is not CLEAR, or before a
+  run longer than 5 minutes, ask Sage for the slot and start only on Sage's "granted".
+- Two failures in one gate run means stop and report.
+- Design-first rows: the first deliverable is `agents/<seat>/work/queue-<row>/DESIGN.md`, committed on your
+  branch. Send the reviewer and Sage its path, commit and sha256. No product code before approval.
+- Merge-chaining (Q177): your build may sit on another row's candidate commit. Your row keeps its own
+  review and gate, and the chain lands in order.
+- Fail closed. Never route around a refusal. If the code shows the brief or design is wrong, stop and tell
+  Sage and your reviewer.
+- Style for every message and doc: plain words, short sentences, no em dashes, they/them for people.
+- Sage registers your session in `docs/SESSIONS.md`. Do not edit it.
@@ -0,0 +1,56 @@
+// Sage, 2026-10-20: row 163 (D2, #1660) round 2 approved. One comment on P19 337 (D2), per mos-0882 (every
+// landing or decision gets a Vikunja comment). Sage's own key (bot user 13); the sync key reads back. Comments only:
+// no task edits, labels, assignees or bucket moves. Checks the task's title before posting. Prints no secret.
+// Usage: node comment-337-r163-approved.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 337, title: /^D2: stack rehearsal on a scratch root/, body: [
+    "Row 163 (Gitea #1660) landed and pushed. Landing commit 8ecc7a239 (Sage; Filbert approve 29447), queue revs 2235-2236 (landing note and done) in 9ae8c73ac, range 4ca8d6e94..9ae8c73ac on refactor. Patch-id b8d5f8a37c24 matches candidate c6f4f4c12596. #1660 is closed with comment 29450.",
+    "Sage gate passed at 18:16Z on eaa0f2666: cli 472/472 and every package and scripts/test-*.sh green. The pushed commit is a cherry-pick of eaa0f2666 onto 7f57419b3, which adds only the Q175 design doc, and no test reads that file. Mos dropped the Part B wait when Q175 replaced Part B (mos-0971).",
+    "Not live. The live stack still runs copies/490e2771d3d0. Rehearse and bus start --no-launch go live at the next re-pin, where the Q173 backup and STATE report apply.",
+  ] },
+  { id: 412, title: /^Console SSO: zero-trust OIDC verification/, body: [
+    "Design r1 is committed: agents/sage/work/q175-sso/DESIGN.md in 7f57419b3 (blob 91e5b1b5e737), pushed in 9ae8c73ac. The Console becomes an OIDC relying party on oauth4webapi 3.8.8, pinned exactly. It always calls validateApplicationLevelSignature, because the library skips the signature check on a token-endpoint ID token. Identity is an (iss, sub) pair, and only asymmetric algs are accepted.",
+    "Filbert's r1 review asks for changes in the doc before any code (B1-B6). B1 moves the provider config to config.json, because agents have write paths into the business file. B2 closes an open-redirect hole. B3 keeps the library's error causes out of logs. B4 caps login records. B5 fixes the signature mutant test. B6 removes a live forged-header probe from the phase 2 acceptance. Their rulings: Q-B start degraded when the IdP is unreachable, Q-C yes (7332 accepts only the public Host under --sso), Q-D keep idle expiry but don't refresh it on poll GETs. r2 follows.",
+    "Interim (mos-0972): the Console runs without --send until phase 2. stack-release.sh has no way to drop --send that keeps stack-active.json and the unit in step, so a small tool row comes first, through review.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,50 @@
+// Sage, 2026-10-20: row 163 (D2, #1660) round 2 approved. One comment on P19 337 (D2), per mos-0882 (every
+// landing or decision gets a Vikunja comment). Sage's own key (bot user 13); the sync key reads back. Comments only:
+// no task edits, labels, assignees or bucket moves. Checks the task's title before posting. Prints no secret.
+// Usage: node comment-337-r163-approved.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 337, title: /^D2: stack rehearsal on a scratch root/, body: [
+    "Row 163 (Gitea #1660) round 2 is approved by Filbert (comment 29447, queue rev 2234, committed cd2b377bb). Candidate 2c090eefd on code 2a5f3a3a0, base 4f02486d5, manifest digest c6f4f4c12596. Filbert's own run: 249 of 249 single-file tests pass, and their seven mutants (M1-M6 from round 1, plus one for the read-only registry) are all killed.",
+    "Not landed yet. Mos's landing order holds (mos-0965, mos-0967): the candidate moves scripts/stack-release.sh off blob 2586a2a37cd2, which the Part B A2 check rests on, so D2 lands only after the Part B window closes (B7). If refactor moves past 4f02486d5 on any manifest path or otherwise before then, the full gate runs again on the new base before landing.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,51 @@
+// Sage, 2026-10-20: row 163 (D2, #1660) in review, round 2. One comment on P19 337 (D2), per mos-0882 (every
+// landing or decision gets a Vikunja comment). Sage's own key (bot user 13); the sync key reads back. Comments only:
+// no task edits, labels, assignees or bucket moves. Checks the task's title before posting. Prints no secret.
+// Usage: node comment-337-r163-inreview-2.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 337, title: /^D2: stack rehearsal on a scratch root/, body: [
+    "Row 163 (Gitea #1660) is in review, round 2, with Filbert as reviewer (request comment 29446, queue revs 2231-2233, committed c539995cf). Round 1 got changes from Filbert (comment 29445, rev 2230): six mutants survived because no test drove those checks to fail, plus a non-blocking note that a read-only session registry still wrote on remove().",
+    "Round 2 adds the tests: R14 (a host that writes the live config, business file or backup fails live-config-unchanged or backup-unchanged), R15 (TERM, INT and HUP during the gate fail signal and still stop the host and Console and run the end checks), an env-ref case in R9, other-root and missing-root cases in R11, and a launches directory case in R4. The read-only registry now never writes its file. stack-release.sh is unchanged from round 1.",
+    "Candidate 2c090eefd on code 2a5f3a3a0, base 4f02486d5; manifest digest c6f4f4c12596, 10 files, +1024/-13 (round 1 to round 2: 4 files, +85/-7). The gate passed on 2a5f3a3a0; mutants K34-K41 are all killed. Mos checked the manifest before the request (mos-0967). Packet: agents/sage/work/queue-163/r2/ in refactor 7af166574. Landing order is unchanged: after the Part B window closes (B7), with a new gate if the base moves.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,51 @@
+// Sage, 2026-10-20: row 163 (D2, #1660) in review, round 1. One comment on P19 337 (D2), per mos-0882 (every
+// landing or decision gets a Vikunja comment). Sage's own key (bot user 13); the sync key reads back. Comments only:
+// no task edits, labels, assignees or bucket moves. Checks the task's title before posting. Prints no secret.
+// Usage: node comment-337-r163-inreview.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 337, title: /^D2: stack rehearsal on a scratch root/, body: [
+    "Row 163 (Gitea #1660) is in review, round 1, with Filbert as reviewer (request comment 29444, queue revs 2228-2229, committed def677bc7). Candidate 4be3f6aec on 580500699, base 4f02486d5; manifest digest 430212299beb, 10 files, +947/-14. It adds `stack-release.sh rehearse`, which runs the D2 rehearsal on a scratch root from a backup, and `bus start --no-launch`, a host that launches no sessions, runs no thread tick and writes no sessions.json.",
+    "The gate passed on 580500699 (all package and script suites; Docker network removed, 0 containers left). Mutants K1-K33 are all killed; four survived the first run (K11, K21, K27, K31) and each got a test. Packet: agents/sage/work/queue-163/ in refactor 51f67f1f8.",
+    "Mos accepted deviations 1-7 in mos-0965; deviation 3 (the scratch business keeps its tracker key, with @sync on a placeholder ref) rests on mos-0964, since business.mjs:197 refuses a file without it. Landing order (mos-0965): the candidate moves stack-release.sh off blob 2586a2a37cd2, which the Part B A2 check rests on, so D2 lands only after the Part B window closes (B7). If the base moves before then, the gate runs again.",
+  ] },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,56 @@
+// Sage, 2026-10-20: files the activate --no-send row (mos-0972, mos-0973) as one P19 task, owner Sage, no due date.
+// Sage's own key (bot user 13); the sync key reads back. No labels, assignees, due dates or bucket moves. Refuses if
+// the title exists. Prints no secret.
+// Usage: node file-no-send-row.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const T = {
+  title: "stack-release.sh activate --no-send: drop the Console's --send and keep the pointer in step (Q175 interim, mos-0972)",
+  description: ps(SIG, [
+    "Mos ruled (mos-0972) that the Console runs without --send until Q175 phase 2 (P19 #412), because with --send live any same-uid process can forge X-authentik-username on 127.0.0.1:7332 and send as Jason.",
+    "stack-release.sh has no path that drops --send and keeps ~/.mosaic-dev/state/stack-active.json and the unit in step: console_for_target (:658-687) carries the pointer's flags, check_target (:247-249) allows a same-copy activate only for the proof pair, and adopt refuses once a pointer exists. A hand reinstall makes flags_drift refuse every later activate, pm-on and rollback.",
+    "The row adds activate --no-send, modeled on row 187's --no-proof. It drops --send from the pointer and the unit. A same-copy activate is allowed when the pointer holds --send. Rollback and pm-on carry the pointer as they do now. There is no re-enable flag. Brief: docs/plans/2026-10-20_activate-no-send.md. Owner Sage, reviewer Dewey, gate the cli suite plus every scripts/test-*.sh (mos-0973 go).",
+    "After landing: a same-copy activate on 490e2771d3d0 with --no-send under Q173, with the plan output sent to Mos first, a backup first and a STATE report after. Then row 66 lands.",
+  ]),
+};
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+if ((await existing()).some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+rec.created = { status: r.status, id: r.json?.id ?? null };
+if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`);
+else {
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(rec.created, { readBack: back.status, done: back.json?.done, inverse: `mark done: POST /api/v1/tasks/${r.json.id} with the whole task, done true (sage key); delete is Jason's or ops-01's` });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push("create read-back differs");
+}
+save();
+console.log(JSON.stringify(rec));
@@ -0,0 +1,12 @@
+{
+ "at": "2026-10-20T18:21:15.323Z",
+ "project": 19,
+ "created": {
+  "status": 201,
+  "id": 413,
+  "readBack": 200,
+  "done": false,
+  "inverse": "mark done: POST /api/v1/tasks/413 with the whole task, done true (sage key); delete is Jason's or ops-01's"
+ },
+ "problems": []
+}
@@ -0,0 +1,13 @@
+{
+ "at": "2026-10-20T15:41:54.066Z",
+ "comments": [
+  {
+   "task": 337,
+   "status": 201,
+   "id": 368,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,13 @@
+{
+ "at": "2026-10-20T15:26:21.265Z",
+ "comments": [
+  {
+   "task": 337,
+   "status": 201,
+   "id": 367,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,13 @@
+{
+ "at": "2026-10-20T14:49:31.177Z",
+ "comments": [
+  {
+   "task": 337,
+   "status": 201,
+   "id": 366,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,20 @@
+{
+ "at": "2026-10-20T18:19:36.544Z",
+ "comments": [
+  {
+   "task": 337,
+   "status": 201,
+   "id": 372,
+   "readBack": 200,
+   "found": true
+  },
+  {
+   "task": 412,
+   "status": 201,
+   "id": 373,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,7 @@
+# Webby
+
+Reviewer seat, Claude Opus 5.5, started by Mos (mos-0981, thread 03086006). Reviews Case 2 designs and MVP T1 rows 192 and 194.
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `webby/*` branches
+through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1347,3 +1347,19 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T10:36:45Z | Sage (Opus 5.5, 1ef1e4f8) | Part B window file draft 2 (mos-0957 F1, F2) and row 188 brief (#1686, P19 409/410) | draft 2 blob 55da51c0462b (148a9503d); Mos A2 recheck passed (mos-0958, ruling: B6 (1) applies to whichever chief B0's launches list shows, id recorded at B0); brief 240f21650, row 188 added and briefed (revs 2207-2208, 525990ecb), pushed 742e98976..525990ecb; Darkwing launched (sage-1278); Vikunja comments 358 (P19 385), 359 (409), 360 (410); nothing live changed
 2026-10-20T11:08:34Z | Filbert (Opus 5.5, 048f3c63) | row 188 r1 review (#1686, manifest 86aa549bad75) | approve, comment 29433, rev 2212; stack-release 151/151 on my slot run; M8-M10 and my M11 killed by T54; N1 REPO logical-path gap in stack-release.sh and webui-service.sh (mos-0959, filed after Part B)
 2026-10-20T11:14:11Z | Sage (Opus 5.5, 1ef1e4f8) | row 188 landing (#1686, P19 409/410), N1 to P19 | landed 8fc0ee216 (patch-id c9a56b167c07, stack-release.sh blob 2586a2a37cd2 unchanged), queue 31e328958 revs 2209-2214, pushed b9c1c9fe2..31e328958 with Filbert's 23a609c5c; #1686 comment 29435, closed; P19 411 (N1, after Part B per mos-0959), comments 361-363, 409/410 done; my done update blanked 409/410 descriptions, restored 11:13Z (restore-409-410-desc.mjs), script fixed
+2026-10-20T13:14:25Z | Sage (Opus 5.5, 1ef1e4f8) | row 66 build (#1559), row 42 trigger (mos-0960), row 163 brief | row 66 r1 in review: candidate 8ec03b45a (sage/row66, base 5487ed39d), manifest e68c6bce5ec4, revs 2215-2217, request 29437, Dewey and Filbert told (sage-1286-1289); gate r1 failed cli 452/453 (thread-launch.test.mjs:179, <run>/session made for the log), fixed to <run>/unslop.jsonl, gate r2 GATE_PASSED; row 42 run log: trigger (a) met, mos-0960 first pm message is a reachability check; row 163 brief owner sage, lands after Part B (6020bb43a), revs 2218-2219 (263ea8a9a)
+2026-10-20T13:18:38Z | Filbert (Opus 5.5, 048f3c63) | row 66 (#1559) r1 review of 8ec03b45a (manifest e68c6bce5ec4) | changes, comment 29439, rev 2221: F1 note with broken+flagged parts overflows the 32768 bus limit (probe 32934), F2 mutant M2 sent-before-send survives; 402/402 suites, M1 and M3 killed
+2026-10-20T13:52:08Z | Dewey (Opus 5.5, 84fb346c) | row 66 (#1559) r1 review of 8ec03b45a (manifest e68c6bce5ec4) | changes, comment 29440, rev 2222: P1 stack copies lack tools/unslop-hook (12 paths missing at candidate, 0 at base); concur F1 (note 971, sum 33004 > 32768) and F2 (sent() before send survives); N1 stale session/ comments; M1 M2 M4 M5 killed; singles 109/109, harness 140/140, plugins 111/111
+2026-10-20T13:56:35Z | Filbert (Opus 5.5, 048f3c63) | row 66 (#1559) r2 review of 0f4a57956 (manifest cee63e06fdea) | approve, comment 29442, rev 2226: F1/F2/N1 fixed, P1 copy path checked; 427/427 suites, M1-M5 killed
+2026-10-20T14:11:02Z | Dewey (Opus 5.5, 84fb346c) | row 66 (#1559) r2 review of 0f4a57956 (manifest cee63e06fdea) | approve, comment 29443, rev 2227: P1/F1/F2/N1 fixed (copy probe 0 of 16 missing; note 600, sum 32633); mutants N1-N4 killed, N5 survives (copy test skips claude-code bundle sources, non-blocking follow-up); singles 285/285, harness 142, plugins 111, cli 454, webui 269 + 1 unrelated skip
+2026-10-20T14:49:39Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) D2 rehearse + bus --no-launch: build, gate, mutants, in-review r1 | in-review, Filbert reviewer: candidate 4be3f6aec on 580500699, manifest 430212299beb, gate passed, K1-K33 killed; request comment 29444, revs 2228-2229 (def677bc7); P19 337 comment 366; lands after Part B B7 (mos-0965)
+2026-10-20T15:06:03Z | Filbert (Opus 5.5, 048f3c63) | row 163 r1 review (D2 rehearse, candidate 4be3f6aec, manifest 430212299beb) | changes, comment 29445 rev 2230: 247/247 singles pass; my mutants M1-M6 survive (F1 backup/live-config after-checks, F2 env ref, data-root-scratch, launches dir, F3 signal trap); N1 Registry.remove read-only
+2026-10-20T15:26:33Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) r2 for Filbert's r1 changes (F1-F3, N1) | in-review r2, Filbert reviewer: candidate 2c090eefd on code 2a5f3a3a0, base 4f02486d5, manifest c6f4f4c12596; tests R14 R15 + R4/R9/R11 cases, read-only Registry #write() returns; gate passed, K34-K41 killed; Mos checked manifest (mos-0967); revs 2230 (Filbert) and 2231-2233 committed 92cc6011c c539995cf; request comment 29446; P19 337 comment 367; packet 7af166574; lands after B7
+2026-10-20T15:40:36Z | Filbert (Opus 5.5, 048f3c63) | row 163 r2 review (D2 rehearse, candidate 2c090eefd, manifest c6f4f4c12596) | approve, comment 29447 rev 2234: 249/249 singles pass; my M1-M6 and N1 mutants all killed (R14, R9, R11, R4, R15, session test)
+2026-10-20T15:42:00Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) r2 verdict intake | approved by Filbert (comment 29447, rev 2234 committed cd2b377bb); P19 337 comment 367 -> 368; candidate 2c090eefd manifest c6f4f4c12596 waits to land after B7, fresh gate if the base moves
+2026-10-20T18:19:06Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r1 (#412, DESIGN.md blob 91e5b1b5e737 at 7f57419b3), static read incl. oauth4webapi 3.8.8 | changes: B1 config in config.json not business file, B2 return-path backslash, B3 log redaction of library error causes, B4 login-record cap, B5 test 9 not 2 kills signature mutant, B6 phase 2 live forged-header probe; rulings Q-B start degraded, Q-C yes, Q-D 8h abs + idle ignores polls; step 5 reading confirmed; verdict sent to Sage, no Gitea/queue record
+2026-10-20T18:34:53Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r2 (DESIGN.md blob 3eb718b5e131 at 1a268249e), static | changes: C1 config.json console key fails old loaders (mosaic-config.mjs:113 rejects unknown keys; key add inside phase 2 window, rollback removes it, loader test), C2 app.js signs out only on opaqueredirect so 401 never shows sign-in; notes on tests 15/7/9a, Q-B 200-HTML classification, scratch Console flags; Q-E keep iss/sub escaped and capped; verdict sent to Sage, no Gitea/queue record
+2026-10-20T18:40:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r3 (DESIGN.md blob a152fd58e18e at 817e8f51b), static | approve on condition D1 (slot file checks stay out of shared loader, shape-only there) as a line edit; D2 notes: slot root from configDir, scratch dataRoot, name discovery GETs for Mos; C1/C2 and notes verified; Mos C1 sequence confirm still open; no Gitea/queue record
+2026-10-20T18:41:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design D1/D2 check (DESIGN.md blob eba861f5d2bb at d55d86bb0), static git diff 817e8f51b..d55d86bb0 | ack: D1 and D2 match; design approved; Mos C1 sequence confirm still open; no Gitea/queue record
+2026-10-20T18:57:10Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r2 (#1688, DESIGN.md sha256 5493c9df3ec0) | CHANGES to Darkwing, cc Sage: B1 claim check on MOSAIC_CONFIG-only selection, B2 shared prefix drop-in dirs; N1-N7 notes; static read, no slot, no Gitea or queue record
+2026-10-20T19:00:04Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r3 (#1688, DESIGN.md sha256 98236a1aff98) | APPROVE to Darkwing, cc Sage: B1 and B2 closed with M13 and M14, N7 settled by Sage's 48ebee0ff; static read, no slot; manifest round gets a queue review record (sage-1337)
@@ -368,7 +368,7 @@ reports checkout or copy identity and refactor drift, and writes nothing.
 ```
 scripts/stack-release.sh adopt BUSINESS
 scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-    [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
+    [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
 scripts/stack-release.sh status BUSINESS
@@ -480,6 +480,14 @@ copies. It checks the file with `stat` and `realpath` and never reads the value.
 or `off`. On the live copy it also notes that the run re-pins the pointer's copy
 and only the Console flags change.

+`activate ... --no-send` (row 189, mos-0972) drops `--send` from the pointer's
+Console flags and the unit, so the Console serves reads and no human sends. It
+may name the live copy while the pointer holds `--send`; once `--send` is gone a
+same-copy `--no-send` refuses `already-active`. Later activates, `pm-on` and
+rollbacks carry the pointer, so send stays off. No flag puts `--send` back.
+`--plan` prints one `send:` line: `dropped`, `off` with or without the
+`--no-send` note, or `carried`.
+
 #### A target past c216f47db: the PM after the harness kind

 From c216f47db on, the bus launches the PM only with a `harness` kind in the
@@ -528,6 +536,68 @@ on PATH; the checkout's `scripts/mosaic` exits 3 with `human-required` or
 `tester-required`, and queue writes stay on it ([packages/cli/README.md, One
 pinned copy](../packages/cli/README.md#one-pinned-copy-row-85-1579)).

+#### Rehearsal on a scratch root (D2, row 163)
+
+```
+scripts/stack-release.sh rehearse ID BUSINESS --backup ACTIVATION|PATH --port N [--timeout S]
+```
+
+`rehearse` starts the target copy's bus host and Console on a copy of a
+backup and runs `activate`'s gate checks on them, all but the PM's, while the
+live stack keeps running. It reads the live config and a backup of the live
+store, so Jason or Mos runs it, as a window's pre-step. No development seat
+runs it against live data. It stops and starts no unit and writes no pointer
+or log line.
+
+`--backup` takes an activation id under `<dataRoot>/backups/stack/` or an
+absolute path. `--port` is the scratch Console's loopback port, 1024 to
+65535. The run refuses `port-reserved` for 7332, 7333 and the pointer's
+`--port` and `--tester-port`, and `port-in-use` for a port something holds;
+it never picks another port. `--timeout` (default 60 seconds) bounds the
+gate and each stop.
+
+Before it makes anything, it checks the pointer, the copy (present,
+reachable from refactor, a readable schema, a bus host with `--no-launch`),
+the port and the backup's `SHA256SUMS`. Then it makes
+`<dataRoot>/rehearsals/<UTC second>-<copy's first 12>/`, mode 0700:
+
+- `data/bus/` holds a copy of the backup's store files, and
+  `data/notify/BUSINESS/notify.json` is `{"notifyVersion":1,"binding":null}`.
+- `config/config.json` is the live config with `dataRoot` set to `data/`.
+- `config/businesses/BUSINESS.json` is the live business file with every
+  `tracker.*` variable removed and every credential reference, the roles'
+  and `tracker.sync`'s, pointed at its own 0600 file under `placeholders/`
+  holding `rehearsal-placeholder-token`. `business.diff` shows the changes.
+  Roles come from the target copy's `roles/`, as the live bus reads them.
+- `steps.log` holds the same PASS and FAIL lines the run prints, with times;
+  `host.log`, `console.log` and, after a migration, `migrate.log` sit beside it.
+
+A guard then loads the scratch config with the target's code and refuses
+with a named check: `data-root-live` when the scratch data root resolves to
+the live one, `sessions-live` when a `sessions.json` there names a running
+pid (the run never deletes the file), `data-root-scratch`, `notify-off`,
+`tracker-configured` when `bootConfig` still sets a tracker, and
+`credential-ref-live` for an env reference or a file outside `placeholders/`.
+When the backup's schema differs from the target's, the run checks that the
+target refuses the store, migrates it, opens it, migrates it again as a
+no-op, and that the pointer's copy refuses the migrated store.
+
+It starts `scripts/mosaic bus start BUSINESS --no-launch` and the Console's
+`serve --port N --business BUSINESS` from the target copy, without `--send`.
+The gate needs the host's `launches disabled` line, a live `bus status` host
+with this run's pid and a boot from this start, the Console's address line,
+`/healthz` 200, and both command lines on the target copy. Then it checks
+that the host wrote no `sessions.json` and no `launches`, stops the Console
+and the host (SIGTERM, then SIGKILL and a FAIL after the timeout), checks that
+the host released `writer.lock`, and compares the backup and the live config
+and business files with sums it took before. The last line is
+`REHEARSAL_PASS` (exit 0) or `REHEARSAL_FAIL` (exit 1), then the directory.
+Usage exits 4. Nothing prunes rehearsal directories.
+
+`bus start --no-launch` refuses every launch with `launches-disabled`,
+starts no thread ticker, and leaves an earlier host's `sessions.json` and
+its runs alone. No unit passes it, and `--pm` with it is a usage error.
+
 ## Console service (`scripts/webui-service.sh`)

 ```bash
@@ -280,7 +280,7 @@ shows only at start is found with the live stack stopped.

 ### Owner and reviewer

- Owner: set when the row is briefed.
+- Owner: sage (row 163, briefed 2026-10-20).
 - Reviewer: filbert.

 ### Files owned
@@ -347,3 +347,8 @@ Mutants: one per behavior above.

 As D1. D2 lands after D1, because both edit `stack-release.sh` and its
 test file.
+
+D2 also lands after the Part B window (P19 385) has run. The Part B window
+file names the `stack-release.sh` blob, and any change to that blob means
+Mos checks the window again (mos-0958, mos-0959). The build and review can
+go ahead before then.
@@ -0,0 +1,73 @@
+# Brief: activate --no-send drops the Console's --send
+
+Sage, 2026-10-20, for Mos's ruling mos-0972 (Q175 interim, Vikunja #412). Owner Sage, reviewer Dewey, gate owner
+Sage. Base: refactor 9ae8c73ac (row 163 landed). Line numbers are at that commit. The candidate corrects them;
+the first draft took them before row 163.
+
+This row builds the tool only. The live restart without `--send` is a separate step afterwards, a same-copy
+activate under Q173 with a backup first and a STATE report after. No test here touches `~/.mosaic-dev`, the
+live units or a slot file. Every test uses the stand-in `systemctl`, units, stores and data root that
+`packages/cli/tests/stack-release.test.mjs` already builds.
+
+## Why
+
+Mos ruled that the Console runs without `--send` until Q175 phase 2, because with `--send` live any same-uid
+process can forge `X-authentik-username` on 127.0.0.1:7332 and send as Jason (design section 8). On the pinned
+stack, the Console flags live in the pointer (`~/.mosaic-dev/state/stack-active.json`):
+
+- `console_for_target` (scripts/stack-release.sh:664-693) carries the pointer's flags unchanged. Only
+  `--tester-port` and the row 187 proof pair can change.
+- `check_target` (:249-256) lets an activate name the pointer's copy only for a proof-pair change.
+- `adopt` refuses once a pointer exists (:828).
+- A hand `webui-service.sh install` without `--send` makes `flags_drift` (:646-657) refuse
+  `unit-flags-drift` on every later activate, pm-on and rollback.
+
+So the tool can't drop `--send` today. This row adds that one path.
+
+## The change
+
+1. `activate ID BUSINESS --no-send` drops `--send` from `RUN_CONSOLE`, so `install_stack` leaves it out of the
+   Console unit and `write_pointer` leaves it out of the pointer. Only `activate` takes it. It combines with
+   `--tester-port`, the proof pair and `--no-proof`.
+2. An activate with `--no-send` may name the pointer's copy when the pointer's Console flags hold `--send`. It
+   re-pins the live copy with only the Console flags changed, as row 187 does for the pair, including the
+   live-copy plan note and the backup of the stopped store. Without `--send` in the pointer, a same-copy
+   `--no-send` still refuses `already-active`.
+3. The steps log records `drop --send; --no-send was given`, or `--no-send was given and the pointer holds no
+   --send, so there is nothing to drop`.
+4. `--plan` prints one `send:` line for an activate or rollback: `send: dropped; --no-send was given`,
+   `send: off; --no-send was given and the pointer holds no --send`, `send: carried` when the pointer's
+   `--send` goes on unchanged, or `send: off`.
+5. `rollback` and `pm-on` don't change: they carry the pointer's flags. So once `--no-send` has run, a rollback
+   to an earlier copy keeps send off. There is no flag to turn send back on. Q175 phase 2 changes the Console
+   flags in its own row.
+6. `docs/TOOLS.md` "Pinned stack update" gets `--no-send` in the usage block and one sentence.
+
+## Tests (packages/cli/tests/stack-release.test.mjs)
+
+1. Seeded preview pointer with `--send` and `--tester-port 7333`: a same-copy `activate B acme --no-send`
+   passes. The pointer and the unit ExecStart lack `--send` and keep the preview flags and
+   `--tester-port 7333` in order. Status says `unit flags: match the pointer`. The steps log has the drop
+   line. The log line has from = to = B, and the stopped store was backed up.
+2. A plain same-copy activate still refuses `already-active`. So does a same-copy `--no-send` once `--send` is
+   gone.
+3. `--plan` prints the four `send:` lines in their cases, with the live-copy note on the same-copy run.
+4. After `--no-send`, a rollback to the earlier copy and `pm-on` both leave `--send` out of the pointer and
+   the unit.
+5. `--no-send` on `rollback`, `pm-on`, `status` or `adopt` is a usage error (exit 4).
+6. `--no-send` with the proof pair, and with `--no-proof`, on a pointer holding both: each drops what it
+   names and keeps the rest.
+
+## Mutants (each must fail at least one test)
+
+- M1: the same-copy exception ignores `--no-send`.
+- M2: the same-copy exception allows `--no-send` without `--send` in the pointer.
+- M3: `--no-send` drops `--send` from the pointer but not from the unit (it writes the pointer from
+  `P_CONSOLE`).
+- M4: rollback re-adds `--send`.
+- M5: the arg parser accepts `--no-send` for rollback.
+
+## Gate
+
+Dewey approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and the
+mutants are killed.
@@ -0,0 +1,57 @@
+# Brief: a credential store per agent, own git identity, pushes to a remote
+
+Sage, 2026-10-20, for mos-0974 (MVP T1 item 6) and the MVP plan
+(`jason-master-restart/projects/mosaic-mvp/PLAN.md` item 6, GAP-MAP G11 and G13; TARGET.md: "credentials store
+available for all agents; secrets protected with RLS equivalent" and "Agent uses own credentials for git and
+other actions"). Gitea #1697. Owner Megavolt (Opus 5.5, a new builder seat), reviewer Duckworth, gate owner
+Sage. Base: refactor at the brief commit. Design first. The first deliverable is
+`agents/megavolt/work/queue-ROW/DESIGN.md`.
+
+This row draws a security boundary. Sage reviews the design's authority model, and Mos rules on it before any
+code is written.
+
+## What exists today (GAP-MAP, measured at 9ae8c73ac)
+
+- G11. Credential references exist per instance for Gitea and Vikunja only
+  (`packages/business/src/credentials.mjs`, `packages/bus/src/credentials.mjs`, `vocabulary.mjs:103`). One
+  Claude env file is shared by every seat.
+- G13. Agents use their own Vikunja token (`packages/tasks/src/adapter.mjs`). Git goes through the host
+  socket (`packages/cli/src/git-socket.mjs`). Gitea tokens are loaded but never used.
+- The development repository's helper (`scripts/git-credential-mosaic.mjs`, wired in `.git/config` for
+  git.mosaicstack.dev) pushes as one identity. Until this row lands, seats push only their own `<seat>/*`
+  branches through it (mos-0981).
+
+## What the design must settle
+
+1. The store. Where each agent's credentials live, per instance, under the row 190 config canon. File modes,
+   ownership and the read path. Which process may read which entry, and how the bus enforces that (the "RLS
+   equivalent"). A process asking for another agent's entry is refused and logged.
+2. Kinds. Gitea (git over HTTPS, and the API), Vikunja, and the model provider. Say which kinds 10-27 needs
+   and which wait. The model provider entry must not copy jwoltje's `claude-session.env`. If it needs a new
+   provider account or subscription, flag it for Jason and don't pick one.
+3. Git identity and push. Each agent commits with its own name and email and pushes with its own token to a
+   remote it is granted. Which refs an agent may push (its own branches, never the default branch or another
+   agent's), and where that's enforced: the Gitea side (branch protection, token scopes) and our side. How
+   this fits the host git socket, or replaces it.
+4. Lifecycle. Issue, rotate (`rotateBy`, `expires`), revoke and delete, and what row 194 (agent lifecycle) calls
+   when an agent is hired or fired. A fired agent's credentials stop working at once.
+5. Who does what. Creating a Gitea user or token, or any account outside the fleet, is Jason's (Q173
+   exclusions). The design lists each such step as a command or UI action for Jason. Agents never mint
+   accounts.
+6. Migration. Today's seats (jarvis helper, seat tokens) keep working until each moves. The mos-0981 push
+   rule ends only when Mos says so.
+7. What this row closes in G11 and G13, and what stays open.
+
+## Boundaries
+
+- No credential value is read, printed, logged or committed. Tests use fake tokens in scratch roots and a
+  fake Gitea.
+- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, `~/.mosaic` or the live
+  `.git/config` of the canonical checkout.
+- No request to git.mosaicstack.dev, tasks.woltje.com or any provider from a test.
+
+## Gate
+
+Duckworth approves DESIGN.md, Mos rules on the authority model, then Duckworth approves the manifest. The bus,
+business, cli and tasks suites and every `scripts/test-*.sh` are green on Sage's gate, and the design's
+mutants are killed.
@@ -0,0 +1,47 @@
+# Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto
+
+Sage, 2026-10-20, for mos-0974 (MVP, DECISIONS Q176, Vikunja #414 "User and main agent can create and spawn
+agents" and "User maintains ability to terminate, regenerate, or create agents via WebUI or CLI ad-hoc", #415
+Case 1 "Chief of staff agent has hire/fire authority for agents as needed; unless user forbids per agent" and
+"User maintains ability to restructure organization at will"). Gitea #1692. T1 item 5. Owner Honker, reviewer Webby (mos-0981), gate
+owner Sage. Base: refactor at the brief commit.
+
+Design first. The first deliverable is `agents/honker/work/queue-194/DESIGN.md`. Webby reviews it before any
+code.
+
+## What exists today (GAP-MAP.md G8, G9, C1.5, C1.6, measured at 9ae8c73ac)
+
+- The chief launches only listed instances (`roles/chief-of-staff.json`, harness `tools.mjs` launch,
+  `broker.mjs:1968`). No user verb launches an arbitrary agent.
+- Terminate exists (`packages/cli/src/cli.mjs:447`, `instances.mjs:9-11`, webui `serve.mjs:288, 535`). There
+  is no regenerate, no delete and no Console launch.
+- Instance changes need a bus restart (`instance-settings.mjs:35,75`, `organization.mjs:83`). Add and change
+  only, no delete.
+- Human-only membership acts as a veto today, but there is no per-agent veto list.
+
+## What the design must settle
+
+1. The verbs: create (from a role and a name), launch, terminate, regenerate (a fresh session with the same
+   identity and role), and delete (with what happens to its sessions, workspace and run evidence, which
+   stays write-once). Each one is a human verb on the CLI and a Console action.
+2. Chief hire/fire. What the chief may do on its own, and the per-agent veto: the human marks an agent so
+   the chief can't fire or replace it, and marks roles the chief can't hire. Where the veto lives and how
+   the broker enforces it.
+3. Live changes. Which changes take effect without a bus restart, and how a running bus picks them up
+   safely.
+4. RBAC. Human roles come from row 193 (Morgana). Until it lands, these verbs are owner-only. The design
+   states the hook that row 193 fills.
+5. Per instance. Row 190 runs one instance per OS user. Lifecycle verbs act on their own instance only.
+6. The kill switch (row 191, Rocko) refuses every launch path. These new launch paths check it too.
+
+## Boundaries
+
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file.
+- Role authority is declared in `roles/` and changes only by reviewed commits (AGENTS.md invariant 7). This
+  row adds verbs, not new role authority. Any role file change is called out for review.
+- The build may chain on rows 190, 191 and 193 candidates (Q177).
+
+## Gate
+
+Webby approves DESIGN.md, then the manifest. The bus, cli, business and webui suites and every
+`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.
@@ -0,0 +1,120 @@
+# Federation build rows R1, R2 and R5 (#414)
+
+Sage, 2026-10-20, for Mos's orders mos-1023 item 1, mos-1028 item 2 and mos-1034 item 1. The design is
+Gizmoduck's `agents/gizmoduck/work/federation/DESIGN.md` at a1daa3c07 on `gizmoduck/federation-design` (r4.9,
+sha256 a31cbebd070f9e3a5ca4ccb158b1747c6f5a83c3469855705b0026a581fb5c6a). Duckworth approved r4.5
+(duckworth-0012), r4.6, r4.7 (duckworth-0020) and r4.8 (duckworth-0021, 8a22d0897 on `duckworth/reviews`),
+and acked r4.9 (duckworth-0024). r4.7 applies Jason's Q181 hosts, r4.8 adds N22's R8 checks and r4.9 names who
+runs them. None of them changes R1, R2 or R5. Section 7's table
+sets each row's scope and test gate. Vikunja P19 #414. Seats push only their own `<seat>/*` branches
+(mos-0981).
+
+The other R rows are filed when their parents have candidates: R3 after R1 and row 196, R4 after R3, R5 and
+row 193's viewer level (193a, mos-1019), R6 after #412 phase 1, R1, R2 and R3, R7 after R1-R6 and row 190.
+R8 is a live window, not a code row. Its brief is the last section here.
+
+## Brief: FED R1, the access.json loader and validator
+
+Owner Gizmoduck, reviewer Duckworth, gate owner Sage. Base: refactor at this brief's commit. No parent.
+
+`packages/business/src/access.mjs`: the access.json loader and validator from DESIGN.md section 3.5, and the
+pure `covers`. Providers, peers and businesses come in as arguments. One read plus the file checks. The
+exported interface is what R5 and row 193a build against, so the manifest names it, and any change to it in
+review goes to Sage before it lands. Section 7 names `covers` but not the loader and validator exports or
+the context shape. Morgana's 193a (508ee4d61 on `morgana/row193a`) assumes `checkAccess(doc, {providers,
+peers, businesses})`, with `businesses` mapping an id to `{human, instances}`, throwing a `BusinessError` that
+names the key path. Use those names, or tell Morgana and Quackerjack yours before the manifest goes to
+Duckworth. Row 193a later widens the level check to `viewer` on R1's candidate (mos-1019).
+
+Tests, in `packages/business/tests/`: every rule in 3.5 refuses with the key path named. That covers a
+symlink, a non-regular file, another owner, group or other write, expiry, `*`, a grant disjoint from the given
+subjects, `human` and `tester` ids, any level other than `collaborator`, and a project entry that isn't a
+UUID. For `covers`: `*` and listed ids match, while an unlisted project, instance or business doesn't, an
+expired grant doesn't, and a level filter rejects another level. One mutant per refusal, each killed.
+
+Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. Tests
+use scratch roots. Single test files run freely, and suites need Sage's slot.
+
+Gate: Duckworth approves the manifest. The business suite and every `scripts/test-*.sh` are green on Sage's
+gate, and the mutants are killed.
+
+## Brief: FED R5, mosaic access list, grant and revoke
+
+Owner Quackerjack, reviewer Duckworth, gate owner Sage. Chained on R1 (Q177). The build starts now against
+R1's exported interface as the R1 manifest names it, and R5 lands after R1 and rebases onto R1's landing.
+
+`mosaic access list`, `grant` and `revoke`: human proof, atomic write, revision bump, a receipt line. The help
+text states the `instances` limit and the provider-removal order (DESIGN.md section 7, row R5). R4 later makes
+these verbs call `access.reload`, so R5 leaves no other reload path.
+
+Context (sage-1419). `ssoSubjects` is row 192's `console.sso.providers[].subjects` flattened to `{provider,
+sub}` pairs; the design's "`console.sso.subjects`" in 3.5 is shorthand for it. `providers` is the list of
+`providers[].id`, read through `loadSystem` and row 192's `checkConsole`. `peers` is `[]` until R2 lands, so a grant
+naming a peer home refuses. R5 rebases onto row 192's landing as well as R1's.
+
+Tests, in `packages/cli/tests/`: tester and agent callers are refused, a concurrent write refuses on a
+revision conflict, the receipt line is appended, and a bad grant is refused before anything is written. One
+mutant per refusal, each killed.
+
+Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. The
+human proof in tests uses the scratch stand-in pattern (a scratch bus verifies its own human-cli path).
+Single test files run freely, and suites need Sage's slot.
+
+Gate: Duckworth approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate,
+and the mutants are killed.
+
+## Brief: FED R2, the federation key in the system config
+
+Owner Quackerjack, reviewer Webby, gate owner Sage. Chained on row 192 (#412 phase 1). The build starts when
+row 192 has a candidate, on that candidate.
+
+A `federation` key in `scripts/mosaic-config.mjs` with the shape in DESIGN.md section 3. A config with no
+`federation` key still loads as it does today. This changes the config schema, so the manifest lists every
+reader of the key.
+
+Tests, in `scripts/test-config.sh`: a valid key loads, an unknown sub-key and a bad origin refuse, and a
+config without the key loads. One mutant per refusal, each killed.
+
+Boundaries: `~/.config/mosaic-dev/config.json` is user-authored and is not touched. Tests use scratch config
+dirs only.
+
+Gate: Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and
+the mutants are killed.
+
+## Brief: FED R8, the hub window on 10.1.1.54
+
+A live window, not a code row (DESIGN.md section 7, row R8). The brief follows r4.11, b93f098f0 on
+`gizmoduck/federation-design` (sha256 1bcee8df0a3a8628a6646535b756c936ca6d9e7bcfa7e1dd2bf1d3f01715c8e6),
+which Duckworth acked with r4.10 (duckworth-0034). Mos closed design rounds there (mos-1072). Run by Jason and
+Mos. Nothing here authorizes a step on any host; each step waits for the window's go.
+
+What changed since r4.9 (DECISIONS Q182, Q183, mos-1055, mos-1063). R8 is a recorded acceptance. It starts
+with Jason's acceptance of the factory paths to .54 on record, quoted in section 8. The privilege and host
+checks still run, and each result goes into the R8 record with the name of whoever ran it. They report and
+don't refuse. The four functional checks named at the end of section 7's R8 row still stop R8 when they fail
+(mos-1066 item 1).
+
+Order (mos-1042 item 2). R8 runs after the Case 2 install on .54 (#416, due by 2026-10-27, Jason's latest-by
+date in Q176, mos-1069), after Bean and Chet are live in Case 2, and after both Hermes gateways on 10.1.1.54
+have stopped. Case 2 go-live doesn't wait on R8. The risk, stated for 10-27: federation between the two
+instances depends on Melanie's switch-over date.
+
+Entry checks, all before anything starts:
+- R7, #412 phase 2 and Jason's #419 answer, as section 7 lists.
+- The four hub user checks on 10.1.1.54 (N22, mos-1035 item 1): `sudo -l -U mosaic` grants nothing, `id
+  mosaic` shows only its own group, `~mosaic/.ssh/authorized_keys` is absent or empty, and no file under
+  `/etc/sudoers.d` names `mosaic`. An agent or Jason runs them as localadmin (mos-1055), and the output goes
+  into the R8 record with who ran them.
+- The factory privilege checks, the key fingerprint comparison and the section 8 privilege path table, each
+  as section 7's R8 row states them.
+
+Build notes:
+- N1 (Duckworth, duckworth-0034, mos-1072). A check that fails on a path Jason didn't name in Q182 or Q183 is
+  marked "not named in Q182 or Q183" in the record, not filed under the acceptance. Examples: a factory mount
+  of hub data, another agent on .54, a provider admin token. Mos takes each one to Jason.
+- N2 (Duckworth, doc-only). The Q183 and Q4 quotes in section 8 are excerpts. When the R8 record quotes them,
+  it marks each omission with "…" and checks the full text at DECISIONS.md:1535-1541 in jason-master-restart
+  (read only).
+
+Done when every entry check has its output recorded, Jason signs in to the hub and sends one message, Melanie
+revokes, and his next request is refused.
@@ -0,0 +1,81 @@
+# Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426)
+
+Sage, 2026-10-20, for Mos's order mos-1078 (Vikunja P19 #426) and its go mos-1083 item 1. Owner Rocko,
+reviewer Dewey, gate owner Sage. Base: refactor at this brief's commit. Starts after row 191.
+
+## Why
+
+Morgana force-pushed a seat branch on 2026-10-20 (morgana-0016). Mos took it to Jason. Force-push is a
+Q173 exclusion, and canon says never force-push, but nothing mechanical stops one. Mos: "Done means a
+force-push from a seat worktree is refused, with a test that shows it."
+
+Earlier the same day, a busy check chained as `| tail -1 &&` passed while the slot was BUSY. The script it
+called prints BUSY or CLEAR, but it exits 0 either way.
+
+The guard has two layers:
+- (a) Gitea protection with force-push off on seat branch patterns and on refactor, next and main. ops-01
+  sets it up, through Mos (mos-1082). That part isn't this row.
+- (b) The client hook below. It can be bypassed with `--no-verify`, so (a) is the real guard and (b) is the
+  early refusal.
+
+## What ships
+
+1. `scripts/git-hooks/pre-push` (new). For each ref line git passes on stdin:
+   - It refuses when the remote sha isn't all zeros and isn't an ancestor of the local sha (`git
+     merge-base --is-ancestor`). The refusal names the ref and both shas, and the hook exits 1.
+   - A new branch passes. A delete (local sha all zeros) is refused.
+   - Any failure of the check refuses too, for example an unknown remote object. The hook fetches nothing.
+     If the remote tip isn't present locally, it refuses and says to fetch first.
+2. Install, following `scripts/queue-commit.sh --install-hook`. Either add a `--install-push-hook` there or
+   ship a small `scripts/install-git-hooks.sh`, whichever fits the existing code better. Say which in BUILD.md.
+   - The install copies the hook into the common `.git/hooks`, which every seat worktree shares.
+   - It refuses when `core.hooksPath` is set (the husky trap, 2026-10-09). It refuses when an installed
+     pre-push differs from the repository copy, unless `--force-install` is given.
+   - It never edits the installed copy in place.
+3. `scripts/slot-busy.sh` (new), the shared busy check.
+   - It prints one BUSY line per matching process, or CLEAR.
+   - It exits 0 on CLEAR, 1 on BUSY and 2 on its own error.
+   - It matches `node --test`, `gate.sh`, `mutant`, `scripts/test-*.sh` and `docker compose` command lines.
+     It skips its own process and shell snapshots.
+   - It reads `/proc/<pid>/cmdline` and the cwd link only, never file contents under another seat's
+     directory.
+   - Usage in `docs/TOOLS.md`: `bash scripts/slot-busy.sh > LOG && gate`, with `set -o pipefail` in any
+     script that pipes it. Never `| tail -1 &&`.
+
+## Tests
+
+Add them to `scripts/test-land-work.sh` or a new `scripts/test-git-guard.sh` (say which). Run against a scratch
+bare remote and a scratch clone with a worktree, never against origin:
+- A rewritten branch pushed with `--force` from a worktree is refused, and the remote ref is unchanged.
+- A `+refspec` push is refused.
+- A fast-forward push passes.
+- A new branch passes.
+- A delete is refused.
+- A remote tip that's missing locally is refused.
+- The install refuses with `core.hooksPath` set, and refuses a differing installed hook.
+- `slot-busy.sh` exits 1 with a fake `node --test` process running (a sleeping stand-in with that argv),
+  and 0 without one.
+- `slot-busy.sh | tail -1 && false` doesn't apply here. The test runs `bash scripts/slot-busy.sh >/dev/null
+  && echo ran`, and asserts it doesn't print `ran` while BUSY.
+
+Mutants, each killed:
+- drop the ancestor check
+- treat an unknown remote object as passing
+- let a delete pass
+- install over a set `core.hooksPath`
+- `slot-busy.sh` exits 0 on BUSY
+
+## Boundaries
+
+- Install the hook in the canonical checkout only after landing, as its own step with Sage. Tests use
+  scratch repositories.
+- No push to origin from a test. No change to Gitea config. That's ops-01's.
+- Don't touch `~/.mosaic`, `~/.mosaic-dev` or `~/.config/mosaic-dev`.
+
+## Gate
+
+Dewey approves the manifest. The new or changed `scripts/test-*.sh` file and every other `scripts/test-*.sh`
+are green on Sage's gate, and the mutants are killed. Done when the hook is installed in the canonical
+checkout and a scripted force-push from a seat worktree to a scratch remote is refused there. ops-01's
+server proof (a refused force-push, plus a fast-forward push and a new branch that go through) is recorded
+in Vikunja #426 by Mos.
@@ -0,0 +1,70 @@
+# Brief: agent host access with sudo through the credential store (#424)
+
+Sage, 2026-10-20, for Jason's rulings Q183 and Q184 relayed by Mos (mos-1056 item 3, mos-1067). Gitea #1707, Vikunja P19
+#424, due 2026-10-27 (Q184: "Q5: by 10.27"). Owner Gizmoduck (design and build), reviewer Duckworth, gate owner
+Sage. Chained on row 199's candidate (Q177): row 199 design r6 (4d3007ec9 on `megavolt/row199`, approved in
+duckworth-0027) is not reopened. This row lands after 199 and rebases onto its landing.
+
+## What Jason asked for
+
+Q183, through Mos: "I envision a credential store within Mosaic Stack that works as some sort of variable for
+the agent to call. The system will enforce access to the credentials to keep the agents sandboxed with proper
+security... If we can utilize the credential store in Mosaic Stack and allow agents to perform their jobs with
+NOPASSWD sudo on various machines, I am a happy man." Q183 also says not every agent needs that access.
+
+Mos's requirements (mos-1067 item 1):
+- An agent asks for a host credential by name.
+- The stack checks a grant for that agent and that host, and does the ssh and sudo for it.
+- The agent never sees the key or any secret value.
+- Only agents with a grant can do it.
+
+The PRD text is REQ-CRED-3, drafted by Honker for PRD 1.7 (sage-1422). If it misses 1.7 it goes into 1.8, and
+this row lands only after the version that holds it is approved.
+
+## What row 199 gives and what it doesn't (megavolt-0019)
+
+It builds on 199 as 199 stands: the store layout under `<configDir>/secrets/agents/<business>/<agent>/`, the
+lifecycle verbs and their `changes.jsonl` receipts, `useFor(session, service, fn)` with the D5 allowlist test,
+`assertClean` on every result, and the grant shape of `publish` (a list on the role entry, checked by the
+broker, plus a hard-wait action that isn't routed).
+
+This row's own changes:
+- A host kind in the closed kind set (vocabulary.mjs `SERVICES`, credentials.mjs, the broker's service check,
+  the CLI date flag, the remove regex), with a naming rule for one credential per host or per agent.
+- A per-kind value check. An OpenSSH private key fails today's `TOKEN` pattern.
+- Handing the key to ssh without the agent seeing it: an ssh-agent on a private socket, or a 0600 temp file
+  removed on every path, the way publish's one-shot helper works.
+- Pinned host keys per host, and no trust on first use.
+- The command boundary: what an agent may run under sudo, and how output returns without echoing the secret.
+  This is the main design work.
+- The executor: a ticket and a host op running in the bus child, the same split row 199 uses for publish
+  (Megavolt's deviation in 199's BUILD.md).
+
+## Steps
+
+1. DESIGN.md first, in `agents/gizmoduck/work/queue-ROW/`. It answers each item above, names the grant shape
+   (`roles.<agent>.hosts` and a `host.sudo` action, or a reasoned alternative), says who grants (Jason, through
+   a reviewed role change, unless REQ-CRED-3 says otherwise), and lists tests and mutants. Duckworth approves it
+   before code. Sage reads it too, because it gives agents sudo on hosts.
+2. Build on 199's candidate. Single test files run freely. Suites and mutant batches need Sage's slot.
+3. The live part is not this row. Putting a key in the store and granting a host is a separate window with
+   Jason or Mos, after landing.
+
+## Hosts
+
+The first targets are `localadmin` with NOPASSWD sudo on 10.1.1.53 and 10.1.1.54 (#423 step 1, applied by
+ops-01 at 20:05:47Z), and the servers agents already reach as localadmin (Q172). ops-01 owns the host side.
+Tests use scratch sshd fixtures on 127.0.0.1 or fakes, never a real host.
+
+## Boundaries
+
+- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, slot files, the live units or `~/.mosaic`. No key is
+  read, copied or printed. No ssh to any real host from a test or a seat.
+- No widening of row 199's kinds or regex inside row 199. Both rows touch them, so this row rebases after 199
+  lands.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. The bus, business and cli suites and every
+`scripts/test-*.sh` are green on Sage's gate, and the mutants are killed (one per refusal, plus one that leaks
+the key into the agent's output and one that skips the host key pin).
@@ -0,0 +1,66 @@
+# Brief: the Case 1 install on 10.1.1.53 (row 195)
+
+Sage, 2026-10-20, third version, for Darkwing's rewrite request and sage-1439. Gitea #1693.
+
+Why it changed:
+- The first two versions put Melanie's hub on its own Linux user, then on its own host, Jason's choice under
+  #419.
+- Q181 settled the hosts: Case 1 (Jason's software factory) runs on 10.1.1.53 and Case 2 (Melanie's hub) on
+  10.1.1.54.
+- Q182 and Q183 made the hub's privilege checks a recorded acceptance. They report and don't refuse
+  (federation R8, mos-1055, mos-1063, mos-1066).
+- The Case 2 install on .54 is Gosalyn's C2-13 plus its window (#416, due by 2026-10-27). It is not this row.
+
+This row now installs Case 1 on .53. On the 10-27 MVP path (mos-0974, T1 item 1).
+
+Owner Darkwing (Opus 5.5), reviewer Duckworth, gate owner Sage. Chained on row 190's candidate (the config
+canon) and on C2-13's candidate (the install script), Q177. It reuses C2-13's `case2-install.sh`,
+`case2-precheck.sh` and `case2-unit.sh` by input, not by copy. A gap in them goes to Gosalyn as a C2-13
+change, or into this row's manifest as a named, reviewed change to those files. Design first:
+`agents/darkwing/work/queue-195/DESIGN.md`.
+
+## Goal
+
+Jason's software factory runs on 10.1.1.53 as `mosaic` under `/srv/mosaic`, in the same unit form as Case 2
+(design 9, Q181). It uses row 190's config canon and the model account the factory uses today (Q185,
+mos-1081 item 1). No new provider account.
+
+## Provision
+
+- ops-01 runs the root steps over ssh as `localadmin`: `useradd mosaic`, `/srv/mosaic` and the unit through
+  `case2-unit.sh` from a root-owned checkout. #423 step 1 (localadmin with NOPASSWD sudo on .53 and .54) was
+  applied at 20:05:47Z (mos-1066, mos-1077), and nothing else in #423 gates this row.
+- #423 step 4 (jarvis sudo) waits until Case 1 is live on .53.
+- The host list comes from Q181. Agents may run read-only checks on .53 as `localadmin`.
+
+## The design must state
+
+1. The install as input values to C2-13's scripts: user, home, business file, roles, the human id, the
+   token slot path. Which commands run as `mosaic` through `sudo -u mosaic -H`, and which as root through
+   ops-01.
+2. Where Case 1 differs from Case 2: the factory roles in place of the library business, no library sync,
+   and any precheck item that doesn't apply, each with a reason.
+3. Model access through the existing factory account (Q185). Placing the credential on .53 is a step under
+   the Q173 secrets rule, done in the window. It is never copied by the script, and its value is never
+   printed.
+4. Re-pin, rollback and backup on .53, and who runs them.
+5. The acceptance checks, as code Duckworth can read. Each check names a path and gives it one of three
+   marks: closed, accepted under Q182 or Q183, or "not named in Q182 or Q183". An accepted path doesn't
+   fail the row. An unnamed one is reported to Mos, who takes it to Jason (the R8 N1 rule). The functional
+   checks fail the row when they fail: the unit runs as `mosaic`, the Console answers on its port on the
+   internal network only, and one tester message gets a reply.
+
+## Boundaries
+
+- Infra and k3s changes, exposure outside the internal network, and spend stay Jason's (Q173 exclusions).
+- No change to dragon-lin's `~/.mosaic-dev`, `~/.config/mosaic-dev`, its live units or `~/.mosaic`.
+- No credential value is printed, logged or committed.
+- Tests use scratch roots and stand-ins. Nothing in a test reaches .53.
+- The run on .53 is a window with Jason's or Mos's go, a backup first where state exists, and a STATE report
+  after.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. Any repository change is green on Sage's gate (cli suite and
+every `scripts/test-*.sh`), with the design's mutants killed. The row is done when the window's acceptance
+run passes on .53, Duckworth reads its output, and Mos confirms.
@@ -0,0 +1,62 @@
+# Brief: the human boundary across uids and humans (P19 333)
+
+Sage, 2026-10-20, for Mos's order mos-0989 (P19 333, MOSAICSTA-173, is now on the 10-27 path: federation R3 and
+row 193 need it). Gitea #1694. Owner Gander (Codex gpt-6.1-sol, a new builder seat under mos-0977 item 5),
+reviewer Duckworth, gate owner Sage. Latest-by: DESIGN.md approved by 2026-10-22, landed by 2026-10-24, and in
+any case before federation R3 lands. R3 and row 193 may chain on this row's candidate (Q177). Base: refactor at
+the brief commit. Design first. The first deliverable is `agents/gander/work/queue-ROW/DESIGN.md`.
+
+## The problem, as filed and as it now matters
+
+P19 333 as filed (row 87, mos-0657): the Console listens on a loopback TCP port, and any host process that
+reaches it, under any uid, acts as Jason. Jason accepted that as a documented limit for a one-user host
+(mos-0787, row 161). Two things change that:
+
+- Row 190b (#1693, mos-0986) puts Melanie's hub under its own Linux user. Factory processes then sit on another
+  uid, on the same host, next to the hub's ports and socket. The other-uid reach is now the Case 2 threat.
+- Federation r2 (gizmoduck-0004, 60b9b112a) binds a bus user only from a user-cli whose proof passes the human
+  walk, whose direct parent is the bus's own Console, and which holds a live grant. That rule rests on the
+  path-bound human proof (#225): today a same-uid process that runs the tree's `human-cli.mjs` acts as the
+  human, without touching the Console. The Q175 design (section 8) names that limit and leaves it here.
+
+## What already settles part of it
+
+- Q175 phase 2 (#412) settles the Console-ingress part on the main port. Under `--sso`, 7332 answers any
+  non-public Host with 403 except `GET /healthz`, and every other request needs a verified OIDC session. A
+  process on another uid that reaches the port gets only `/healthz`. Phase 1 (row 192) builds it; it is live
+  only after the phase 2 window.
+- Row 189 (`--no-send`) is interim only. Until phase 2 the Console takes no human writes, so the reach is
+  read-only. It settles nothing.
+- Row 190b separates files and units by uid. Whether the hub's `broker.sock` refuses the factory uid depends on
+  its directory and socket modes, which this row checks and tests rather than assumes.
+
+## What the design must settle
+
+1. Inventory every listener and entry point per instance: the Console port, the tester listener (7333 today),
+   `broker.sock`, the human CLI wrapper, the Discord connector and anything row 190 adds. For each: who can
+   reach it today from the same uid and from another uid, with and without `--sso`.
+2. The tester listener. It serves reads and the row 175 tester writes to anything that reaches it, on any uid.
+   Close the other-uid reach (for example a unix socket with 0600 modes, or a peer-uid check on loopback), or
+   bring Mos a concrete reason it must stay open. bus.tester stays Jason's switch.
+3. The bus human boundary. How the bus tells the human's own verified call from a same-uid process that runs
+   `human-cli.mjs`. State what federation R3's direct-parent rule needs from the bus (peer credentials on
+   `broker.sock`, the parent check, how it can't be forged by a child of an agent), and what stays possible for
+   a same-uid process after this row. Say it plainly where a residual limit remains.
+4. Fit with row 193 (Morgana, human users and roles; Mos's B1 rule: a principal comes only from something the
+   bus verifies) and with federation R3. One mechanism, not three.
+5. Migration: the live single-user Console and bus keep working until each instance re-pins.
+6. Which parts of P19 333 this row closes, which parts Q175 phase 2 closes, and what P19 333 says when it is
+   closed.
+
+## Boundaries
+
+- Who can reach the Console from outside stays Jason's. This row changes what a host process can do once it
+  reaches a local port or socket.
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file. No test creates a real
+  second uid; use stand-ins as rows 190 and 190b do, and name any part only a Q173 window can prove.
+- No request to the live 127.0.0.1:7332 or 7333, mosaic.woltje.com or auth.diversecanvas.com.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. The bus, webui and cli suites and every `scripts/test-*.sh`
+are green on Sage's gate, and the design's mutants are killed.
@@ -0,0 +1,70 @@
+# Row 193 build rows: 193a, 193b1, 193b2, 193c and 193d (#1691)
+
+Sage, 2026-10-20, for Mos's go mos-1034 item 4. Row 193's design is Morgana's
+`agents/morgana/work/queue-193/DESIGN.md` at e2d161e2e on `morgana/row193` (r5, sha256
+dd7fcb419ed8510e9d8d74b569183386d0942af8b68eecc0bbb5e182e677b523), approved by Duckworth (duckworth-0018).
+Section 8 lists the tests and mutants, and section 9 the split. The brief behind them is
+`docs/plans/2026-10-20_human-users.md`. Vikunja P19 #414/#415, Gitea #1691.
+
+Owner Morgana for every row, reviewer Duckworth, gate owner Sage. Each row chains on its parent's candidate
+(Q177) and rebases onto the parent's landing. Seats push only their own `<seat>/*` branches (mos-0981).
+Single test files run freely, and suites and mutant batches need Sage's slot.
+
+Boundaries for every row: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, any
+live access.json or `~/.mosaic`. No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
+No user thread goes live before 193b1's message filter has landed (mos-1021 B2, FED R8).
+
+The owner-visible records are fixed by Mos (mos-1023 item 2) and named in one user sentence, which FED R6
+reuses word for word: "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks
+and project files, but not your messages."
+
+## Brief: 193a, the access level check widened to viewer
+
+Chained on FED R1. Started early on `morgana/row193a` (508ee4d61) against R1's interface as the FED brief
+names it, with Sage's go (sage-1373). R1's level check accepts `viewer` and still refuses any other new
+level. Tests in `packages/business/tests/` (section 8, Business), with the four mutants in Morgana's
+BUILD.md. FED R4 chains on this row.
+
+Duckworth's N1 on R1 (duckworth-0033, sage-1417): with viewer added, `covers` called with no level would let a
+viewer grant cover a collaborator ask. This row makes `level` required in `covers`, with a test and a mutant that
+makes it optional again. R3 and R4 call `covers` with a level.
+
+Gate: Duckworth approves the manifest. The business suite and every `scripts/test-*.sh` are green on Sage's
+gate, and the mutants are killed.
+
+## Brief: 193b1, viewer verbs, board refusals and the message filter
+
+Chained on FED R3, FED R4 and row 196's verifier. The bus gets the viewer verb list, per-grant level
+checks, board reads refused to users, and the section 5.7 `trail` and `replies` filter with `#readable`
+owner-only. No schema change. The governance pin test names each item in the user sentence above. Bus tests
+and mutants 1, 3, 6, 10, 11 and 12 from section 8.
+
+Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
+and the mutants are killed.
+
+## Brief: 193b2, thread shares (schema 3j)
+
+Chained on 193b1. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
+section 5.5 share filters. Schema 3i to 3j. The table is append-only, and row 181's restore guard and
+`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8.
+Going live needs a `--migrate` window with Jason. Sage takes it to Mos when this row is near.
+
+Gate: Duckworth approves the manifest. The bus suite, the cli suite and every `scripts/test-*.sh` are green on
+Sage's gate, and the mutants are killed.
+
+## Brief: 193c, mosaic access user verbs and --level viewer
+
+Chained on FED R5. `mosaic access user add/remove` and `grant --level viewer`, only where R5 lacks them. They
+refuse tester and agent callers, write a receipt line and call `access.reload` (section 8, CLI). If R5
+already has all of them, this row records that and closes with no code.
+
+Gate: Duckworth approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate,
+and the mutants are killed.
+
+## Brief: 193d, the Console's shared list, share controls and viewer read-only
+
+Chained on FED R6, row 192 and 193b2 (for share controls). A viewer has no composer or share control, and
+with each UI check removed the bus still refuses (section 8, Webui).
+
+Gate: Duckworth approves the manifest. The webui suite and every `scripts/test-*.sh` are green on Sage's
+gate, and the mutants are killed.
@@ -0,0 +1,56 @@
+# Brief: many humans per business, human roles, private and shared threads
+
+Sage, 2026-10-20, for mos-0974 and mos-0977 (MVP, DECISIONS Q176, Vikunja #414 "RBAC enforcement" and #415
+Case 1 "Additional users can be configured for access" and "Shared and private agent sessions available per
+user; RBAC"). Gitea #1691. T1 item 3. Owner Morgana, reviewer Duckworth, gate owner Sage. Base: refactor at the brief
+commit.
+
+Design first. The first deliverable is `agents/morgana/work/queue-193/DESIGN.md`. Duckworth reviews it before
+any code.
+
+## What exists today (GAP-MAP.md, measured at 9ae8c73ac)
+
+- One human per business: `packages/business/src/business.mjs:160`, and the broker's human check
+  (`packages/bus/src/broker.mjs:532-538`).
+- Threads have an owner field only (`packages/bus/schema.sql:247`, `broker.mjs:353-360`). Nothing is private
+  or shared.
+- RBAC covers agents only (`role.mjs`, `vocabulary.mjs`, `broker.mjs:769-799`, harness `gate.mjs`). Humans
+  have no roles.
+- The human proof is path-bound (#225, P19 333): any same-uid process that runs the tree's `human-cli.mjs` acts
+  as the human. That limit is real and the design must say how several humans change it.
+
+## What the design must settle
+
+1. The human model. How a business lists several humans, how each is identified, and how a Console SSO
+   session (#412, row 192: each session names a provider subject mapped to a name) and a CLI call each
+   become exactly one of them. Starting rule (Mos, mos-0985, from Duckworth's federation review B1 at
+   b402197ff on origin duckworth/reviews): the bus takes a human principal only from something it verifies,
+   such as the Console's OIDC session under #412. A process's own claim of who it is never counts.
+2. Human roles. A small fixed set to start (for example owner, member, viewer), what each may do on the
+   bus and in the Console, and who may add or remove humans and change roles. Restructuring stays with
+   the owner (Case 1).
+3. Threads. Private threads (visible to their owner and the agents in them) and shared threads (visible to
+   named humans or all members). Schema change, migration of existing rows (all become the current human's),
+   and every read path that must filter.
+4. One user and grant store. Gizmoduck's federation design (thread 9312a896, design 6925f78f0 on
+   gizmoduck/federation-design) proposes `access.json` for grants. Mos's reading (mos-0977): one model for
+   local and federated humans, because two stores drift. Lead decision (Sage, 2026-10-20, to gizmoduck-0002):
+   row 193 takes Gizmoduck's human-authored `<configDir>/access.json` (federation DESIGN.md section 3.5) as
+   the one user and grant store, and extends it with local humans, roles and shared threads. Federation adds
+   only a `home` field. The design confirms this or brings a concrete reason against it to Sage and
+   Gizmoduck before the build. Federation's R1 (the access.json loader) then comes before this row's build.
+5. The bus human boundary. With several humans, the human verbs must know which human calls. State what a
+   same-uid process can still do (P19 333) and whether row 190's one-instance-per-OS-user direction narrows
+   it.
+6. Migration and rollback. Existing businesses keep working with their one human as owner.
+
+## Boundaries
+
+- Changing who can reach the Console from outside is Jason's. This row changes who is allowed once inside.
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file.
+- The build may chain on rows 190 and 192 candidates (Q177). Each row keeps its own review and gate.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. The bus, business, cli and webui suites and every
+`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.
@@ -0,0 +1,65 @@
+# Brief: one kill switch for the bus, every run, Discord and new launches
+
+Sage, 2026-10-20, for Mos's order mos-0974 (MVP, DECISIONS Q176, Vikunja #414 "Kill switch is available to
+stop all processing immediately"). Gitea #1689. T1 item 4. Owner Rocko, reviewer Dewey, gate owner Sage. Base: refactor
+at the brief commit.
+
+Design first. The first deliverable is `agents/rocko/work/queue-191/DESIGN.md`, which Dewey reviews before
+any code. Then the build follows the design, with tests and mutants.
+
+## The goal
+
+One human command and one Console button stop all processing at once and keep it stopped until the human
+clears it:
+
+- The bus takes no new work. Agent verbs that start or continue work refuse with a fixed code while the
+  switch is on. Reads and the human's own verbs, including the clear, still work.
+- Every running managed session and task run is stopped (SIGTERM, then SIGKILL after a bounded wait), and
+  each stop is recorded as an event.
+- Discord stops (its existing STOP file and `stop` verb) and can't restart while the switch is on.
+- New launches refuse: the launcher, chief hire, `run-task.sh`, and any other path that starts an agent.
+- The switch survives a bus restart and a host reboot (it lives in the data root, not in memory).
+- Turning it on and clearing it are human-only verbs, through the bus human proof, and each leaves one
+  event with who and when.
+
+## What exists today (GAP-MAP.md G10, measured at 9ae8c73ac)
+
+These are pieces, with no single switch over them. The design inventories every path that starts or
+continues work and says how each one checks the switch:
+
+- `launch.revoke` and `launch.restore` in `packages/bus/src/broker.mjs` (around :2087), human-only.
+- The `mosaic launches off|on` verbs in `packages/cli/src/cli.mjs` (around :456-533) and
+  `packages/cli/src/launcher.mjs` (around :769).
+- The Discord STOP file (`packages/discord/src/cli.mjs:18-27`).
+
+## What the design must settle
+
+1. Where the switch state lives, its format, and how each process reads it (the broker checks on every
+   work verb; the launcher and Discord check before start). The race: a launch already past its check when
+   the switch goes on must still be stopped.
+2. The CLI verb names (for example `mosaic halt` and `mosaic resume`) and the Console button. The button
+   is a human write, so it goes through the same writer and same-origin checks as other Console writes, and
+   it works under the Q175 SSO session (#412) once phase 2 lands. Until then, test it with fixture servers
+   only.
+3. Per instance. Row 190 adds several instances per host. The switch is per instance, so it stops one
+   instance and never another. The design names how it finds the instance's data root. This row may build
+   on the row 190 candidate (Q177 merge-chaining).
+4. What a stopped run's record says, so run evidence stays write-once and honest.
+
+## Tests
+
+Each part of the goal gets a test: work verbs refuse, a running stand-in session and run are stopped,
+Discord refuses to start, every launch path refuses, the switch survives a restart, an agent can't set or
+clear it, and the clear lets work resume. Mutants: drop the check from one launch path, let an agent clear
+the switch, keep the switch in memory only, skip the SIGKILL after the wait. Each one must fail a test.
+
+## Boundaries
+
+- No test touches `~/.mosaic-dev`, the live units, a real Discord bot or a slot file. Use the stand-in
+  units, scratch data roots and fixture servers the suites already build.
+- Rocko has no git credentials. Sage commits the candidate and runs the queue moves Rocko can't.
+
+## Gate
+
+Dewey approves DESIGN.md, then the manifest. The cli suite, the bus, discord and webui package suites and
+every `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
@@ -0,0 +1,70 @@
+# Brief: several Mosaic Stack instances on one host
+
+Sage, 2026-10-20, for Mos's order mos-0974 (MVP, DECISIONS Q176-Q178, Vikunja #414). Gitea #1688. T1 item 1. Owner
+Darkwing, reviewer Filbert, gate owner Sage. Base: refactor at the brief commit. This row blocks both MVP
+cases: Case 1 (Jason's software factory) and Case 2 (Melanie's creative writing hub) run as two instances
+on one homelab host, beside the current mosaic-stack test instance.
+
+Design first. The first deliverable is `agents/darkwing/work/queue-190/DESIGN.md`. Filbert reviews it
+before any code, as Q175 did. Then the build follows the design, with tests and mutants.
+
+## The goal
+
+Two or more instances run side by side on dragon-lin. Each one has its own config file, data root (store,
+broker.sock, host.lock, state, runs, sessions, workspaces), businesses, bus unit, Console unit and port,
+tester port, Discord unit, Claude session env file, stack-active pointer and activation log. No instance's
+commands, units or tools address another instance's state by default or by mistake. On one uid this is
+addressing only, not a security boundary: a same-uid process can still read another instance's files.
+Isolation against that is row 190b (#1693, mos-0986), one Linux user per instance. The current instance keeps working unchanged: its
+config path, data root, unit names and ports stay as they are, and no re-pin is needed for it.
+
+## Known single-instance points (GAP-MAP.md, measured at 9ae8c73ac)
+
+The design starts with a full inventory. Grep every script and package, not only these:
+
+- `packages/cli/systemd/mosaic-bus.service.in`: `mosaic-bus@<business>` sets no `MOSAIC_CONFIG` and reads the
+  fixed `EnvironmentFile=-%h/.config/mosaic-dev/secrets/claude-session.env`.
+- `packages/webui/systemd/mosaic-webui.service.in` and `scripts/webui-service.sh`: one `mosaic-webui.service`.
+- `packages/discord/systemd/[email protected]` and `scripts/discord-service.sh`.
+- `scripts/stack-copy.sh:8` hardcodes `BUSINESS=mosaic-stack`, and `:95` reads `mosaic-webui.service`.
+- `scripts/stack-release.sh`: unit names, the Console port and the tester port default, `COPIES` (:28), the
+  pointer under `$DATA/state` (:1474), and `rehearse`.
+- `scripts/mosaic-config.mjs`, `scripts/bootstrap.sh`, `scripts/reset.sh`, `scripts/land-work.sh`,
+  `packages/webui/src/cli.mjs`, `packages/business/src/{business,vars}.mjs`, and
+  `packages/conversation/src/guard.mjs` each name the default config path or data root.
+
+## What the design must settle
+
+1. Instance identity. How a name maps to its config file and how every tool picks the instance (an
+   `--instance NAME` flag, `MOSAIC_CONFIG`, or both), and what happens with neither (the current default,
+   unchanged). Name rules, and refusal of a name that collides.
+2. Config canon. AGENTS.md invariant 2 says `~/.config/mosaic-dev/config.json` is the sole system config,
+   created only by `scripts/bootstrap.sh`. Several instances mean several config files. The design proposes
+   the exact wording change and how bootstrap creates an instance config without overwriting one. Mos rules
+   on the canon change before the build.
+3. Unit names and templates. The bus, Console and Discord units per instance, how `MOSAIC_CONFIG` and the
+   Claude env file reach each unit, and how the current unit names stay valid for the default instance.
+4. Ports. Each instance's Console and tester ports, with a refusal when two instances claim the same port.
+5. Stack copies and the pointer. Whether copies are shared between instances (read-only trees, so sharing
+   may be fine) and how the pointer, activation log, backups and `flags_drift` stay per instance.
+   `stack-release.sh` and `stack-copy.sh` take the instance.
+6. Secrets. The per-instance Claude session env file and the secrets slot root, resolved from the instance's
+   config dir (the Q175 design resolves its slot the same way: `<configDir>/secrets/mosaic-stack/<slot>`).
+7. Isolation proof. What the tests show: two instances started side by side on stand-in units and scratch
+   roots, each reads only its own config and data root, a command aimed at one never touches the other, and
+   the default instance's paths and unit names are byte-identical to today.
+
+## Boundaries
+
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file. Use the stand-in
+  systemctl, units and scratch roots that `packages/cli/tests/stack-release.test.mjs` already builds.
+- Standing up a real second instance on dragon-lin is a later window under Q173, with a backup first and a
+  STATE report after. Exposing a new Console through the tunnel or Traefik changes who can reach it from
+  outside, so it waits for Jason. SSO (Q175, #412) comes first for any instance a second user can reach.
+- Merge-chaining (Q177): rows that need instances (human users, kill switch, lifecycle) may build on this
+  row's candidate. This row keeps its own review and gate.
+
+## Gate
+
+Filbert approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on
+Sage's gate, and the design's mutants are killed.
@@ -0,0 +1,57 @@
+# Brief: retire the control board writer on 7331
+
+Sage, 2026-10-20, for Mos's ruling mos-1008 item 2. Gitea #1696. MVP 10-27 work. Owner Bushroot (Haiku 5.5, a
+low-level model under Q177), reviewer Webby, gate owner Sage. Base: refactor at the brief commit.
+
+## Why
+
+`packages/control-board/src/serve.mjs` is a loopback HTTP service on 7331 with no authentication. It reads
+transcripts and writes through `/api/reply`. Any host process that reaches the port can do both. That fails
+Q175 ("zero trust with verification"). Gander found it in the row 196 inventory (gander-0004). Nothing listens
+on 7331 now (`ss -ltnp`, 2026-10-20T19:05:09Z), so retiring it costs the least.
+
+## Steps, in order
+
+1. Inventory first. List every reference to the control board and to 7331: scripts, units, `scripts/mosaic`
+   and other CLI dispatch, docs (AGENTS.md, READMEs, TOOLS.md), package.json scripts, tests, and the Console
+   (`packages/webui`). For each, say whether it starts the writer, reads its code, or only mentions it.
+   Commit the list as `agents/bushroot/work/queue-ROW/INVENTORY.md` and send it to Sage and Webby.
+2. Stop if something depends on it. If a reference shows a live dependency (the Console or another package
+   imports code that only the control board has, or a unit or script still starts it), stop. Sage takes it to
+   Mos before anything is removed.
+3. Otherwise retire the writer. Either remove the `serve` entry point, or make it refuse to start with a
+   message that points to the Console. Keep any read-only code another package imports, and say which.
+   Update the docs that tell people to start it. The AGENTS.md text about the control-board reply convention
+   is a separate matter. Change it only if it tells someone to start 7331.
+
+## Mos's call on the Console dependency (mos-1019)
+
+The inventory (004f133bd) found that the Console proxies `/api/board`, `/api/seen`, `/api/reply` and the
+conversation routes to `DEFAULT_BOARD` on 7331 (`packages/webui/src/serve.mjs:12`), so the board view returns
+502 today. Mos took Sage's recommendation: retire the 7331 listener and its README start commands, and have
+the Console call the board's read code in-process, behind the Console's own auth (Q175 SSO on 7332).
+`/api/reply` stays only under `--send`. The DESIGN.md for that change comes before code, and Webby approves
+it.
+
+## Acceptance
+
+Nothing in the stack can start a writer on 7331. A test proves it: the entry point refuses (or is gone), no
+script or unit starts it, and a grep check finds no starter. Each change gets a mutant that brings the writer
+back and the test kills it. Mos added three items (mos-1019):
+
+- The board view answers from the Console with nothing listening on 7331.
+- Every board route sits behind the Console's auth.
+- A test proves `/api/reply` refuses without `--send`.
+
+Test fixtures that bind port 0 may stay if they only test the code in-process.
+
+## Boundaries
+
+- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev`, slot files or `~/.mosaic`.
+- No request to any live port.
+- Single test files run freely. Suites need Sage's slot.
+
+## Gate
+
+Webby approves INVENTORY.md, then DESIGN.md, then the manifest. The control-board and webui package suites, the cli suite and
+every `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
@@ -0,0 +1,42 @@
+# Brief: a second gate lane, two full gates at once on dragon-lin
+
+Sage, 2026-10-20, for Mos's order mos-0977 item 6 ("put the design for a second gate lane on the list now")
+and the MVP push (mos-0974). Gitea #1695. Owner Herb (Codex gpt-6.1-sol, a new builder seat), reviewer
+Webby, gate owner Sage. Base: refactor at the brief commit. Design first. The first deliverable is
+`agents/herb/work/queue-ROW/DESIGN.md`.
+
+## Why
+
+Every full run shares one slot today. A full gate (cli suite plus every `scripts/test-*.sh`) takes about 13
+minutes or more, reviewers' runs and mutants take the same slot, and with eight or more seats building for
+10-27 the slot is the bottleneck. The slot exists because concurrent runs broke each other. The busy check is
+`agents/sage/work/gate-lane/busy-now.sh` (a copy of Sage's), and the gate is
+`agents/sage/work/gate-lane/gate-template.sh` (a copy of Sage's template). The host has 16 cores and 62 GB.
+
+## What the design must settle
+
+1. Every shared resource two concurrent runs can collide on, found from the code and tests, not guessed:
+   Docker compose project names and networks (`scripts/test-task.sh` and others), fixed TCP ports in tests,
+   unix socket paths and their 107-byte limit under TMPDIR, the sandbox's private `/tmp`, shared caches,
+   scratch and worktree paths, the queue lock, and any test that reads host-wide state (process lists,
+   `pgrep`, `/proc`). For each: how a lane gets its own copy, or why it is safe to share.
+2. Timing. Which tests have time limits that a doubled CPU load could break, measured, and what changes (a
+   bound, or a lane rule that keeps those suites apart).
+3. The lane mechanism: lane ids, a lock per lane that a run takes and releases even on a crash, the busy
+   check that reports per lane, and how a seat asks for a lane. Sage still grants it.
+4. The gate template takes a lane id and isolates everything from point 1 by it.
+5. Proof: two full gates on different candidates at once, three times, with zero cross-failures, plus the
+   wall time of each against a single-lane run. Any flake found is named with its cause.
+
+## Boundaries
+
+- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev` or slot files. The proof runs use
+  scratch roots only, and it needs Sage's grant of the whole slot while it runs.
+- Test code changes that only isolate a resource are in scope. A change to what a test checks is not, and
+  goes to its owner.
+- Docker networks and containers a run makes are removed by the run (trap), and nothing else is touched.
+
+## Gate
+
+Webby approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's
+gate, both singly and in the two-lane proof.
@@ -0,0 +1,47 @@
+# Brief: Q175 phase 1, the Console verifies SSO itself (--sso)
+
+Sage, 2026-10-20, for Q175 (Jason's ruling), mos-0971/0973/0977 and Vikunja #412. Gitea #1690. MVP T1 item 2. Owner
+Launchpad, reviewer Webby (mos-0981), gate owner Sage. Base: refactor at the brief commit.
+
+The design is approved: `agents/sage/work/q175-sso/DESIGN.md` at d55d86bb0 (blob eba861f5d2bb), Filbert r3
+approve plus the D1/D2 ack, Mos C1 confirmation in mos-0977, whose straggler-check condition is in the phase 2 window at b416d2ede. Build phase 1 exactly as the design says. If
+the code shows the design is wrong somewhere, stop and tell Sage, Webby and Filbert before building around it.
+
+## Scope (phase 1 only, design section 5 item 1)
+
+- oauth4webapi 3.8.8, pinned exactly (design section 2). No other new dependency.
+- The OIDC relying party in the Console: `/auth/login`, `/auth/callback`, `/auth/logout`, `/auth/signed-out`,
+  the callback steps 1-7, our own checks on top of the library, and sessions, cookies and Host rules
+  (design sections 1 and 3).
+- The shared loader, `scripts/mosaic-config.mjs`, accepts an optional `console` key and checks only its
+  shape. The slot file checks and the read run in the Console's `--sso` start, and the slot resolves from
+  the config dir (section 4, D1, D2).
+- The degraded start for an unreachable provider, and the unreachable/refused classes (Q-B, section 4).
+- `--sso` for `cli.mjs serve` and `webui-service.sh`, with its refusals against the old flags.
+- The tester listener rules (section 6).
+- The page: both fetch paths in `packages/webui/src/public/app.js` (:111 and :305) treat a 401
+  `sign-in required` as signed out, and the notice links to `/auth/login?return=<path>` (C2).
+- Logging as the design says, including the Q-E `subject-unknown` line.
+
+Out of scope: the phase 2 window, the live config.json key, phase 3 removals, the proxy-forwarded token
+(section 7), and any change to the live Console.
+
+## Tests and mutants
+
+Design section 9: tests 1-25, the positive paths, and every listed mutant, each killed by its named test.
+All tests run against the fake OP in `packages/webui/tests/helpers/fake-oidc.mjs`. No test reaches a real
+provider or Authentik, and no test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a
+slot file. Test 25 goes in `scripts/test-config.sh`.
+
+## Boundaries
+
+- No request of any kind to auth.diversecanvas.com, mosaic.woltje.com or the live 127.0.0.1:7332 (mos-0971,
+  design section 8).
+- No credential value is read, printed or logged.
+- `npm install` runs only inside the worktree that has its own package.json, never in a directory that would
+  walk up to home.
+
+## Gate
+
+Webby approves the manifest. Filbert approved the design and answers design questions. The webui and cli suites, `scripts/test-config.sh` and every
+`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.
@@ -0,0 +1,39 @@
+# Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite)
+
+Sage, 2026-10-20, for Launchpad's finding F3 on row 192 (launchpad-0001) and Q175 (#412). Gitea #1698. Owner
+Launchpad, reviewer Webby, gate owner Sage. Chained on row 192's candidate (Q177): it lands after row 192 and
+before the phase 2 window. Base: row 192's candidate.
+
+## Why
+
+The phase 2 window re-pins the Console to the phase 1 commit with `--sso --send --tester-port 7333`
+(`agents/sage/work/q175-sso/DESIGN.md`, section 5). `scripts/stack-release.sh` doesn't know `--sso` today.
+Its `proof_checks` (`:751`) requires `--public-host`, `--auth-header` and `--allow-user` whenever a proof pair is
+carried, and the pointer's Console flags still hold the forward-auth pair (`--auth-header X-authentik-username
+--allow-user jason.woltje`) that `--sso` refuses to start with. So the window can't run through the script, and
+a hand-edited pointer is not an option.
+
+## What the row does
+
+1. `activate ID BUSINESS --sso` writes Console flags with `--sso` and without `--auth-header`, `--allow-user`
+   and any proof pair, and `--plan` names each flag it drops and carries, in the style of row 189's `send:`
+   line. The design names the full flag set the phase 2 Console starts with and checks it against row 192's
+   refusals.
+2. Before anything stops, the script refuses a target copy whose Console doesn't support `--sso`, and refuses
+   when the config's `console` key or its slot file fails the checks row 192's `--sso` start runs. It reads
+   neither value and only uses the same stat and shape checks.
+3. Rollback from an `--sso` pointer to a pre-phase-1 copy follows the design's phase 2 rollback order (remove
+   the `console` key first). The script refuses a rollback that would start a Console on a config it can't
+   read, and says which step comes first.
+4. `docs/TOOLS.md` gets the flag.
+
+## Boundaries
+
+- No change to the live pointer, units, `~/.mosaic-dev` or `~/.config/mosaic-dev`. Tests use scratch roots
+  and seeded pointers, as rows 187 and 189 do.
+- No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
+
+## Gate
+
+Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and the
+mutants are killed (one per refusal, and one that keeps `--auth-header` in the written flags).
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 2214 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 2361 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -102,7 +102,7 @@ Generated from `docs/plans/queue.json` revision 2214 by `queue render`. Do not e
 | 63 | Multi-project verbs: task verbs across the tree | darkwing; reviewers dewey, filbert | #1556 | done | 62 done | dewey and filbert approve on the issue naming the candidate manifest; tasks, harness and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_multi-project-sync.md` § Multi-project verbs: task verbs across the tree (row B) | lands before row 90 (decision 125): both share packages/tasks/README.md and tests/verbs.test.mjs, so row 90 rebases after this lands |
 | 64 | Managed sessions get their role's skills on both harnesses | sage; reviewers darkwing, filbert | #1557 | done | 65 done | darkwing and filbert approve on #1557 naming the candidate manifest; business, harness, cli and every test-*.sh green on Sage's gate rerun; Sage's landing session on each harness shows the role's skills (sage) | `docs/plans/2026-10-11_managed-session-config.md` § Managed sessions get their role's skills on both harnesses | Landed (mos-0863/0864): 9f0039711 = c6d7d538f (range-diff =, patch-id 7e1948e2f2e9), F1 doc 6b6567b8b, packet ebfc23c43; gate-land GATE_PASSED 2384/0 on 6b6567b8b. D2 on #1557 comment 29228: claude-code coder rc13bcd555652 replied with its 4 skills, pi coder r3455505dd5da launch only (no pi credential on host, to Mos); both manifests list the 4 coder skills, sha256 = landed files. D3 window step 46de60893, D4 #1672 row 174. |
 | 65 | Model routing table: sessions resolve harness, model and thinking from one table | sage; reviewers darkwing, dewey | #1558 | done | 49 done, 131 done | Mos clears the routing table's public/ diff (decision 123, mos-0840) before in-review; darkwing and dewey approve on #1558; plugins, bus, business, harness, seat, cli, webui, test-*.sh green on Sage's rerun; landing session shows module, route, counted model, thinking; report names the mos-0840 view (sage) | `docs/plans/2026-10-11_managed-session-config.md` § Model routing table: sessions resolve harness, model and thinking from one table | Decision 94 hold ended (cutover live 17:21Z); restarted under decision 111 and Mos sage-0091. |
-| 66 | Managed sessions run the unslop check on both harnesses | sage; reviewers dewey, filbert | #1559 | briefed | 64 done | dewey and filbert approve on #1559 naming the candidate manifest; unslop, harness, cli and every test-*.sh green on Sage's gate rerun; Sage's landing session on each harness shows the notice, the correction and the counts (sage) | `docs/plans/2026-10-11_managed-session-config.md` § Managed sessions run the unslop check on both harnesses | Decision 94 hold ended (cutover live 17:21Z); restarted under decision 111 and Mos sage-0091. |
+| 66 | Managed sessions run the unslop check on both harnesses | sage; reviewers dewey, filbert | #1559 | in-review, round 2, request posted | 64 done | dewey and filbert approve on #1559 naming the candidate manifest; unslop, harness, cli and every test-*.sh green on Sage's gate rerun; Sage's landing session on each harness shows the notice, the correction and the counts (sage) | `docs/plans/2026-10-11_managed-session-config.md` § Managed sessions run the unslop check on both harnesses | Decision 94 hold ended (cutover live 17:21Z); restarted under decision 111 and Mos sage-0091. |
 | 67 | Decisions read follow-up: seen-then-resolve, list-before-503 and full-row tests | filbert; reviewers darkwing, dewey | #1560 | done | — | darkwing and dewey approve on #1560 naming the candidate manifest; bus, webui and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_decisions-read-follow-up.md` § Decisions read follow-up: seen-then-resolve, list-before-503 and full-row tests | — |
 | 68 | Bus host runs an explicit Claude Code binary | sage; reviewers dewey, filbert | #1561 | done | — | Filbert and Dewey approve; cli, seat, harness suites and every scripts/test-*.sh green on Sage's gate rerun; unit reinstalled and opus probe through MOSAIC_CLAUDE_BIN (sage) | `docs/plans/2026-10-11_bus-claude-binary.md` § Bus host runs an explicit Claude Code binary | — |
 | 69 | Terminal app follow-up: narrow-terminal guard test, hidden-box way out and width tests | darkwing; reviewers dewey, filbert | #1562 | done | 55 done | dewey and filbert approve on the issue naming the candidate manifest; cli and queue node suites plus every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_terminal-app-follow-up.md` § Terminal app follow-up: narrow-terminal guard test, hidden-box way out and width tests | Sage accepts the two shortened texts in round 1 (hidden box way out, status line), both forced by the 40x10 frame. Follow-up at landing: when help is cut to fit, draw() points at mosaic inbox --json though help has no whole text; open it as its own row (build.md Found, not fixed) |
@@ -199,7 +199,7 @@ Generated from `docs/plans/queue.json` revision 2214 by `queue render`. Do not e
 | 160 | I5 managed sessions as containers | researcher; reviewers dewey, filbert | #1655 | queued | 158 done | Filbert and Dewey approve on #1655 naming the candidate manifest; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I5 managed sessions as containers | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet; the goal order sets priority |
 | 161 | I6 install mode, the pi worker's move and the documented limits | dewey; reviewers darkwing, filbert | #1656 | queued | 159 done, 160 done | Filbert and Darkwing approve on #1656 naming the candidate manifest; Sage's full gate green on the landing tree (sage) | `docs/plans/2026-10-18_containerized-install-rows.md` § I6 install mode, the pi worker's move and the documented limits | Decision 96 orders I2-I6 after D1 and D2, which have no rows yet. B2 is decision 148. The documented-limits section waits on Jason's answer to P19 333 (mos-0657) |
 | 162 | D1: health-gated stack activate and rollback (stack-release.sh) | darkwing; reviewers filbert | #1659 | done | — | Filbert approves the candidate manifest; cli, bus and webui suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-18_stack-release.md` § Stack activate and rollback, health-gated (D1) | P19 task 336 (agents/sage/work/vikunja-setup/d1-d2-rows-2026-10-18.json) |
-| 163 | D2: stack rehearsal on a scratch root (stack-release.sh rehearse) | sage; reviewers filbert | #1660 | queued | 162 done | Filbert approves the candidate manifest; cli, bus and webui suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-18_stack-release.md` § Stack rehearsal on a scratch root (D2) | P19 task 337 (agents/sage/work/vikunja-setup/d1-d2-rows-2026-10-18.json) |
+| 163 | D2: stack rehearsal on a scratch root (stack-release.sh rehearse) | sage; reviewers filbert | #1660 | done | 162 done | Filbert approves the candidate manifest; cli, bus and webui suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-18_stack-release.md` § Stack rehearsal on a scratch root (D2) | Landed 8ecc7a239 (author Sage) on 7f57419b3; patch-id b8d5f8a37c24 matches candidate c6f4f4c12596 and eaa0f2666, the commit the gate ran on (base 4ca8d6e94; 7f57419b3 adds only agents/sage/work/q175-sso/DESIGN.md, which no test reads). Sage gate passed 18:16Z on eaa0f2666: cli 472/472 and every package and scripts/test-*.sh green. Filbert approve 29447, rev 2234. Not live until a re-pin; Q173 backup and STATE apply there (mos-0971). |
 | 164 | Channel plug-in kind: cli and webui as its first modules (Q156 item 4, decision 149) | rocko; reviewers dewey | #1661 | done | 129 done | Dewey approves the candidate manifest; plugins, cli, bus and webui suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-18_channel-kind.md` § The channel kind, with cli and webui as its first modules | Design packet first, Sage sends it to Mos (human proof adjacent). Nothing goes between row 129 and this row (Mos mos-0726). |
 | 165 | The human adds and changes role instances: a CLI command and a Console view (P19 332) | darkwing; reviewers dewey, filbert | #1662 | done | 155 done | Mos relays Jason's confirmation before briefed; Dewey and Filbert approve on #1662 naming the candidate manifest; Mos's decision 123 go on the public/ diff; business, cli and webui suites and every scripts/test-*.sh green on Sage's gate (sage) (sage) | `docs/plans/2026-10-18_role-instance-verb.md` § The human adds and changes role instances | Briefed after 155 (b2f57ca70); hold lifted by mos-0805. Chief of staff stays out (mos-0787). sage-0918: lead approved file expansion (bus broker/runtime, webui cli.mjs, scripts/mosaic, commented channel-proof pin bump); new verbs human-only. Credentials/tracker stay out; second-reviewer gap with Mos (sage-0920). Acceptance 314 keeps the hand edit until this lands. Mos's decision 123 go on public/. |
 | 166 | stack-release.sh hardening after D1: drop-in precheck, is-active race, copy check against the target, quoted Environment= (row 162 follow-up) | darkwing; reviewers filbert | #1663 | done | 162 done | Filbert approves the candidate manifest; cli suite and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-18_stack-release-hardening.md` § Brief: stack-release.sh hardening after D1 | Landed 4b738e2da on 64922106d (pushed). It is Darkwing r2 build.patch, manifest 4fc0613f OK, patch-id 7a4fdc3bf53b equal to build.patch. Sage gate GATE_PASSED: 15 pkg suites 2399/0 (cli 364), 10 script suites green. Mos R1 (mos-0867): no quotes or drop-ins on live units. stack-release.sh blob now ed5b41d4677e; Window B P3 reruns on it (mos-0867 R2). Row 169 rebases onto 4b738e2da. |
@@ -225,6 +225,29 @@ Generated from `docs/plans/queue.json` revision 2214 by `queue render`. Do not e
 | 186 | stack-release --plan: the backup line says what the run will do (P19 404, row 185 N1/N2) | darkwing; reviewers filbert | #1684 | done | — | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the three brief mutants killed (sage) | `docs/plans/2026-10-20_plan-backup-line.md` § Brief: the activate plan's backup line says what the run will do | Landed 269134d8d (author Darkwing) on 3c5da3a91. Patch-id c97b9f6e25cd matches the r1 candidate (manifest 449e9121, Filbert approve 29419). Sage gate on b367f5730+patch 09:00:20Z-09:08:59Z: node 2681/0, scripts 422/0, queue 156, network removed; 3c5da3a91 adds only a SESSIONS line. Not live: the stack runs copy 490e2771d3d0. Follow-ups on P19 404: Filbert M6 gap, store-unclean reading. |
 | 187 | stack-release activate carries the row 178 proof pair (mos-0928 Part B A0) | darkwing; reviewers filbert | #1685 | done | 186 done | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-proof-pair.md` § Brief: activate carries the row 178 proof pair | Landed 9a71e4e80 (author Darkwing) on d17328a55; patch-id 6b57c47bc661 matches candidate 52a5ecc1d143 and Filbert's r1 reading. Sage gate passed 10:21:55Z: cli 446/446 and every package and scripts/test-*.sh green. Filbert approve 29424, rev 2204; follow-ups N1-N4 filed on P19. |
 | 188 | stack-release tests: a carried proof pair and a proof file inside the repository (P19 409, 410; gates Part B) | darkwing; reviewers filbert | #1686 | done | 187 settled | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_proof-test-gaps.md` § Brief: tests for the two proof-file paths row 187 left open | Landed 8fc0ee216 (author Darkwing) on 23a609c5c; patch-id c9a56b167c07 matches candidate 86aa549bad75 and Filbert's r1 reading; stack-release.sh blob 2586a2a37cd2 unchanged. Sage gate passed 10:58Z: cli 453/453 and every package and scripts/test-*.sh green. Filbert approve 29433, rev 2212; N1 (REPO logical path) to P19 after Part B (mos-0959). |
+| 189 | stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413) | sage; reviewers dewey | #1687 | done | 163 done | Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-no-send.md` § Brief: activate --no-send drops the Console's --send | Landed ace27dc5e on refactor (cherry-pick of candidate d6116771f onto a4a42dbac). Gate GATE_PASSED on 0c177e9ef (base 0217b71c8), 2026-10-20T19:09:37Z-19:20:36Z, 25 suites rc=0. patch-id ce89378718f6 for both 0c177e9ef and ace27dc5e; range-diff differs only in the message. Landed manifest hashes to 67af69bd (Dewey approve 29485). Base drift 0217b71c8..a4a42dbac: 7 doc/README files, none on manifest paths, no test reads them. Brief re-pinned to blob 29a9e6d2d. |
+| 190 | several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414) | darkwing; reviewers filbert | #1688 | in-review, round 1, request posted | — | Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed (sage) | `docs/plans/2026-10-20_multi-instance.md` § Brief: several Mosaic Stack instances on one host | — |
+| 191 | one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414) | rocko; reviewers dewey | #1689 | in-progress | — | Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_kill-switch.md` § Brief: one kill switch for the bus, every run, Discord and new launches | — |
+| 192 | Q175 phase 1: the Console verifies SSO itself (--sso), OIDC RP with oauth4webapi 3.8.8, no live change (MVP T1.2, #412) | launchpad; reviewers webby | #1690 | in-review, round 2, request posted | — | Webby approves the manifest; webui and cli suites, scripts/test-config.sh and every scripts/test-*.sh green on Sage's gate; design section 9 mutants killed (sage) | `docs/plans/2026-10-20_sso-phase1.md` § Brief: Q175 phase 1, the Console verifies SSO itself (--sso) | — |
+| 193 | many humans per business, human roles, private and shared threads, one access.json store (MVP T1.3, Vikunja #414/#415) | morgana; reviewers duckworth | #1691 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, business, cli and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users.md` § Brief: many humans per business, human roles, private and shared threads | — |
+| 194 | agent lifecycle from the Console and the CLI (create, launch, terminate, regenerate, delete) with a per-agent hire/fire veto (MVP T1.5, Vikunja #414/#415) | honker; reviewers webby | #1692 | in-progress | — | Webby approves DESIGN.md then the manifest; bus, cli, business and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto | — |
+| 195 | row 195: the Case 1 install on 10.1.1.53 as mosaic under /srv/mosaic, reusing C2-13's scripts by input under row 190's canon (Q181, Q182/Q183, Q185; ops-01 root steps under #423 step 1) | darkwing; reviewers duckworth | #1693 | briefed | 190 done | Duckworth approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_hub-own-uid.md` § Brief: the Case 1 install on 10.1.1.53 (row 195) | sage-1439: rewritten to Case 1 on .53 (f24f2cd40). Chains on C2-13's candidate too once C2-13 is queued. Darkwing starts DESIGN.md after row 190's mutants. |
+| 196 | the human boundary across uids and humans: Console, tester listener, broker.sock and the path-bound human proof (P19 333, before federation R3, mos-0989) | gander; reviewers duckworth | #1694 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-boundary.md` § Brief: the human boundary across uids and humans (P19 333) | — |
+| 197 | a second gate lane: two full gates at once on dragon-lin, design first (mos-0977 item 6) | herb; reviewers webby | #1695 | in-progress | — | Webby approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate, singly and in the two-lane proof (sage) | `docs/plans/2026-10-20_second-gate-lane.md` § Brief: a second gate lane, two full gates at once on dragon-lin | Order with row 198 (Sage, mos-1040 N1): 197 lands first. After B1 the shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. Row 198 rebases onto 197's landing before its manifest review. |
+| 198 | retire the control board writer on 7331 (unauthenticated loopback writer, Q175; mos-1008) | bushroot; reviewers webby | #1696 | in-progress | 192 done, 197 done | Webby approves INVENTORY.md then the manifest; control-board, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_retire-control-board.md` § Brief: retire the control board writer on 7331 | Order with row 197 (Sage, mos-1040 N1): 197 lands first. Row 198 rebases onto 197's landing before its manifest review; shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. |
+| 199 | MVP T1 item 6: a credential store per agent, own git identity, pushes to a remote (G11, G13; mos-0974) | megavolt; reviewers duckworth | #1697 | in-progress | — | Duckworth approves DESIGN.md; Mos rules on the authority model; Duckworth approves the manifest; bus, business, cli and tasks suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: a credential store per agent, own git identity, pushes to a remote | — |
+| 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | in-review, round 2, request posted | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | — |
+| 201 | FED R1: access.json loader and validator, and covers (#414) | gizmoduck; reviewers duckworth | #1699 | in-review, round 1, request posted | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R1, the access.json loader and validator | — |
+| 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | in-review, round 1, request posted | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
+| 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
+| 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | in-review, round 1, request posted | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
+| 205 | 193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed) | morgana; reviewers duckworth | #1703 | queued | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1, viewer verbs, board refusals and the message filter | — |
+| 206 | 193b2: thread shares, schema 3j (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3j) | — |
+| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
+| 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
+| 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
+| 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | in-progress | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Design runs before 199 lands (Q177 chain on 199's candidate). after cleared so Gizmoduck can claim; lands only after 199 and rebases onto it. |
+| 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | rocko; reviewers dewey | #1709 | briefed | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |

 <!-- mosaic-queue:end -->

@@ -57,7 +57,7 @@ export const USAGE = `usage:
  mosaic stop <run>
  mosaic launches off|on [--business <id>]
  mosaic launches list [--json]
-  mosaic bus start <business> [--pm]
+  mosaic bus start <business> [--pm | --no-launch]
  mosaic bus stop
  mosaic bus status [--json]`;

@@ -482,8 +482,11 @@ async function launches(rest, io, deps) {
 async function bus(rest, io, deps) {
  const [sub, ...args] = rest;
  if (sub === "start") {
-    const parsed = parse(args, { flags: ["--pm"] });
+    const parsed = parse(args, { flags: ["--pm", "--no-launch"] });
    if (parsed.positional.length !== 1) throw usage("bus start takes one business");
+    // Row 163: --no-launch is the D2 rehearsal's host. No unit passes it.
+    const launches = !parsed.flags.has("--no-launch");
+    if (!launches && parsed.flags.has("--pm")) throw usage("bus start takes --pm or --no-launch, not both");
    const businessId = parsed.positional[0];
    const system = deps.system ?? loadSystem({ env: io.env });
    // Fail closed, and say so (vikunja:19/302): a refused load is recorded where the Console and
@@ -500,9 +503,9 @@ async function bus(rest, io, deps) {
    const binding = readNotifyConfig(system.dataRoot, businessId);
    const host = await startHost({ boot, business: businessId, notifier: binding ? { binding } : null });
    try {
-      const launcher = createLauncher({ host, system, env: io.env, tracker: Boolean(boot.trackers?.[businessId]), ...(deps.launcher ?? {}) });
+      const launcher = createLauncher({ host, system, env: io.env, tracker: Boolean(boot.trackers?.[businessId]), launches, ...(deps.launcher ?? {}) });
      await launcher.listen();
-      io.stdout.write(`bus host up: business ${businessId}, socket ${host.path}, notifier ${binding ?? "off"}\n`);
+      io.stdout.write(`bus host up: business ${businessId}, socket ${host.path}, notifier ${binding ?? "off"}${launches ? "" : ", launches disabled"}\n`);
      if (parsed.flags.has("--pm")) {
        const pm = await launcher.launchPm();
        io.stdout.write(`launched ${pm.instance}: run ${pm.run}, ${pm.harness} ${pm.model}\n`);
@@ -153,7 +153,11 @@ function call(name, what, fn) {
 }

 // host: startHost()'s handle. tracker: true when the broker has task verbs for
-// the business. makeLoader (the plug-in loader's factory, which tests point at a
+// the business. launches: false for `bus start --no-launch` (row 163, the D2
+// rehearsal): start() refuses launches-disabled, listen() starts no ticker, a
+// session's launch request is refused, recover() kills and ends nothing, and
+// sessions.json stays as it was.
+// makeLoader (the plug-in loader's factory, which tests point at a
 // scratch tree), bwrap, readOnly, sessionDefaults, harnessVersion,
 // stopTimeoutMs, threadTickMs and git (createGitSocket options) exist for
 // the tests; the command line never sets them.
@@ -162,6 +166,7 @@ export function createLauncher({
  system,
  env = process.env,
  tracker = false,
+  launches = true,
  makeLoader = createLoader,
  bwrap = BWRAP,
  readOnly = [],
@@ -187,7 +192,7 @@ export function createLauncher({
  } catch (e) {
    throw new CliError(`${e.message}; check which sessions still run, then move the file aside`, 3);
  }
-  const registry = new Registry(dataRoot);
+  const registry = new Registry(dataRoot, { readOnly: !launches });
  const children = new Map();
  let chain = Promise.resolve();
  let closed = false;
@@ -323,6 +328,8 @@ export function createLauncher({

  // Bundle, spawn, bind, register, hand over the capability.
  async function start({ instance, launchedBy, resolved, model, account = null, thread = null }) {
+    // Every launch path ends here, so a --no-launch host spawns nothing whichever path asked.
+    if (!launches) throw new Refusal("launches-disabled", "this host was started with --no-launch");
    // A thread's store is checked first, so a bad id or an unsafe directory
    // launches nothing.
    let store = null;
@@ -627,6 +634,11 @@ export function createLauncher({
        await host.op({ op: "refuse", cap, code: "not-a-role" }).catch(() => {});
        return { ok: false, error: "not-a-role" };
      }
+      if (!launches) {
+        await host.op({ op: "refuse", cap, code: "launches-disabled" }).catch(() => {});
+        record({ event: "refused", by: who.role, instance, code: "launches-disabled" });
+        return { ok: false, error: "launches-disabled" };
+      }
      let checked;
      try {
        if (typeof instance !== "string") throw new Refusal("invalid-request");
@@ -675,6 +687,13 @@ export function createLauncher({
  // This broker never bound those runs, so each is bound again first with
  // its identical launch record, which the broker accepts.
  async function recover() {
+    // Row 163 (mos-0961): a --no-launch host never signals or ends an earlier host's session. Its
+    // data root may hold a sessions.json that names live processes, so it only says what it left.
+    if (!launches) {
+      for (const s of leftover) log(`run ${s.run} (${s.instance}) from an earlier host: left as it is, this host was started with --no-launch`);
+      leftover = [];
+      return;
+    }
    for (const s of leftover) {
      if (startTimeOf(s.pid) === s.startTime && (cmdlineOf(s.pid) ?? [])[0] === bwrap) {
        try {
@@ -744,7 +763,7 @@ export function createLauncher({
    });
    chmodSync(path, 0o600);
    await gitSocket.listen();
-    if (b.launch) ticker = setInterval(() => tick().catch((e) => log(`thread tick: ${e.message}`)), threadTickMs);
+    if (b.launch && launches) ticker = setInterval(() => tick().catch((e) => log(`thread tick: ${e.message}`)), threadTickMs);
  }

  // SIGTERM every runner, wait, then end what's left. Runs before the host
@@ -811,6 +811,29 @@ test("bus start runs until bus stop; status reports it while it runs", async (t)
  assert.match(again.stdout, /no host runs/);
 });

+// Row 163 (mos-0961): the D2 rehearsal's host.
+test("bus start --no-launch says launches are disabled in its host-up line and stops cleanly; with --pm it is a usage error", async (t) => {
+  const f = fixture(tmp(t));
+  notifyConfig(f.dataRoot, "acme", null);
+  const both = spawnSync(process.execPath, [CLI, "bus", "start", "acme", "--pm", "--no-launch"], { env: f.env, encoding: "utf8", timeout: 40000 });
+  assert.equal(both.status, 4, both.stderr);
+  assert.match(both.stderr, /bus start takes --pm or --no-launch, not both/);
+  assert.equal(existsSync(join(f.dataRoot, "bus", "writer.lock")), false);
+  const child = spawn(process.execPath, [CLI, "bus", "start", "acme", "--no-launch"], { env: f.env, stdio: ["ignore", "pipe", "pipe"] });
+  t.after(() => child.exitCode === null && child.kill("SIGKILL"));
+  let out = "";
+  child.stdout.on("data", (b) => (out += b));
+  child.stderr.on("data", (b) => (out += b));
+  await until(() => /bus host up: business acme.*\n/.test(out), 30000);
+  assert.match(out, /bus host up: business acme, socket \S+, notifier off, launches disabled\n/);
+  // The launcher got launches false: its Registry is read-only, so no sessions.json appears.
+  assert.equal(existsSync(join(f.dataRoot, "bus-host", "sessions.json")), false);
+  const exit = once(child, "exit");
+  const stop = spawnSync(process.execPath, [CLI, "bus", "stop"], { env: f.env, encoding: "utf8", timeout: 70000 });
+  assert.equal(stop.status, 0, stop.stderr);
+  assert.equal((await exit)[0], 0, out);
+});
+
 test("bus-service.sh renders the unit and installs it into a given directory", (t) => {
  const dir = tmp(t);
  const script = join(REPO, "scripts", "bus-service.sh");
@@ -818,6 +841,8 @@ test("bus-service.sh renders the unit and installs it into a given directory", (
  assert.equal(render.status, 0, render.stderr);
  assert.match(render.stdout, new RegExp(`ExecStart=${REPO.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/scripts/mosaic bus start %i`));
  assert.match(render.stdout, /RestartPreventExitStatus=2 3 4/);
+  // Row 163: --no-launch is for the D2 rehearsal's own host only; no unit starts a bus with it.
+  assert.doesNotMatch(render.stdout, /--no-launch/);
  // One session credential file, optional so Pi sessions start without it.
  // The README's paragraph names the same file; nothing else does.
  const files = render.stdout.match(/^EnvironmentFile=.*$/gm);
@@ -15,11 +15,12 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Client } from "../../bus/src/client.mjs";
-import { gitSocketPath, launchLogFile, launchSocketPath, readSessions, Registry, SESSION_CREDENTIALS, sessionsFile, workspaceDir } from "../../seat/src/session.mjs";
-import { sandboxProblem } from "../../seat/src/sandbox.mjs";
+import { gitSocketPath, launchLogFile, launchSocketPath, readSessions, Registry, runsDir, SESSION_CREDENTIALS, sessionsFile, workspaceDir } from "../../seat/src/session.mjs";
+import { BWRAP, sandboxProblem } from "../../seat/src/sandbox.mjs";
+import { childrenOf } from "../../seat/src/proc.mjs";
 import { gitEnv } from "../../seat/src/checkout.mjs";
 import { bootConfig, loadSystem } from "../src/config.mjs";
-import { startHost, startTimeOf } from "../src/host.mjs";
+import { cmdlineOf, startHost, startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { mockAnthropic, REPO } from "../../harness/tests/helpers.mjs";
 import { fakeHarnesses, fixture, tmp } from "./helpers.mjs";
@@ -901,6 +902,56 @@ for (const exited of [false, true]) {
  });
 }

+// Row 163 (mos-0961): the D2 rehearsal host. A live bwrap process the test owns stands in for an
+// earlier host's session; its outer bwrap is what recover() would kill, and its child stands in
+// for the runner that close() would signal.
+test("bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was", { skip, timeout: 30000 }, async (t) => {
+  const given = prepare(t);
+  const { f } = given;
+  const box = spawn(BWRAP, ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc", "--unshare-pid", "--die-with-parent", "sleep", "60"], { stdio: "ignore" });
+  t.after(() => box.kill("SIGKILL"));
+  const pid = box.pid;
+  const startTime = await until(() => startTimeOf(pid));
+  const runnerPid = await until(() => childrenOf(pid)[0]);
+  const runnerStartTime = await until(() => startTimeOf(runnerPid));
+  assert.equal(cmdlineOf(pid)[0], BWRAP, "recover() would take it for a session");
+  new Registry(f.dataRoot).add({ business: "acme", instance: "chief", run: "run-left", harness: "pi", pid, startTime, runnerPid, runnerStartTime });
+  const before = readFileSync(sessionsFile(f.dataRoot), "utf8");
+
+  const s = await setup(t, undefined, given, { launches: false });
+  assert.ok(s.logs.includes("run run-left (chief) from an earlier host: left as it is, this host was started with --no-launch"), s.logs.join("\n"));
+  assert.equal(startTimeOf(pid), startTime, "listen() sent no signal");
+  assert.equal(readFileSync(sessionsFile(f.dataRoot), "utf8"), before);
+  assert.deepEqual((await s.client.call("trail", { subject: "run-left" })).filter((r) => r.kind === "session.ended"), []);
+  assert.equal(await s.close(), 0);
+  assert.equal(startTimeOf(pid), startTime, "close() sent no signal either");
+  assert.equal(startTimeOf(runnerPid), runnerStartTime);
+  assert.equal(readFileSync(sessionsFile(f.dataRoot), "utf8"), before);
+});
+
+test("bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned", { skip, timeout: 30000 }, async (t) => {
+  const s = await setup(t, undefined, undefined, { launches: false });
+  await assert.rejects(s.launcher.launchPm(), (e) => e.exitCode === 3 && /^PM launch refused: launches-disabled/.test(e.message));
+  const sock = launchSocketPath(s.f.dataRoot);
+  assert.deepEqual(await ask(sock, `${JSON.stringify({ cap: s.cto.cap, instance: "coder" })}\n`), { ok: false, error: "launches-disabled" });
+  assert.deepEqual(log(s.f).map((e) => [e.event, e.instance, e.code]), [["refused", "chief", "launches-disabled"], ["refused", "coder", "launches-disabled"]]);
+  assert.deepEqual(readSessions(s.f.dataRoot), []);
+  const runs = runsDir(s.f.dataRoot, "acme");
+  assert.deepEqual(existsSync(runs) ? readdirSync(runs) : [], [], "no run directory");
+  assert.equal(await s.close(), 0);
+});
+
+test("bus start --no-launch starts no thread tick; the same host with launches runs it", { skip, timeout: 30000 }, async (t) => {
+  for (const launches of [false, true]) {
+    const asked = [];
+    const wrap = (host) => Object.create(host, { op: { value: async (m) => (["threadsState", "landHolders"].includes(m.op) && asked.push(m.op), host.op(m)) } });
+    const s = await setup(t, undefined, undefined, { launches, threadTickMs: 50, wrap });
+    await new Promise((r) => setTimeout(r, 400));
+    assert.equal(asked.length > 0, launches, `launches ${launches}: ${asked.join(", ")}`);
+    assert.equal(await s.close(), 0);
+  }
+});
+
 test("a malformed sessions.json refuses the host start with exit 3 and stays as it was", { timeout: 30000 }, async (t) => {
  const given = prepare(t);
  const file = sessionsFile(given.f.dataRoot);
@@ -381,7 +381,7 @@ async function seed(e,{copy=B,pm=false,store='3g',pointer:how='adopt'}={}){
 const rolledBack=(code,to=B)=>`stack-release: ${code}; rolled back to ${to}, which passed the gate\n`;
 const planBackup=(e)=>`backup: the run backs up the stopped store to ${e.data}/backups/stack/<activation>/ before any migration`;
 const planNoBackup='backup: none; the run rolls back before the backup';
-const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];
+const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off','send: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];

 // --- The T table ---

@@ -1030,17 +1030,17 @@ test('T36 --plan shows the pending state and lists the row 169 refusals it can s
  return r.out.split('\n');
 };
 let out=await quiet(0,'activate',C1,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-6),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
+ assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
 biz(e,HARNESS);
 out=await quiet(3,'activate',A,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
+ assert.deepEqual(out.slice(-8),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
 out=await quiet(3,'activate',C1,'acme','--pm-after-harness','--plan');
 assert.equal(out.at(-2),'refuses pm-after-harness-set: the business file already sets harness ["claude-code"]; use --pm');
 biz(e);assert.equal((await run(e,'activate',C1,'acme','--pm-after-harness')).code,0);
 out=await quiet(3,'activate',C,'acme','--plan');
- assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
+ assert.deepEqual(out.slice(-8),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
 out=await quiet(0,'rollback','acme','--plan');
- assert.deepEqual(out.slice(-6),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
+ assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
 });

 // Row 176 test 11: supported and older Console copies deliberately differ from the checkout.
@@ -1705,3 +1705,489 @@ test('T54 row 188: a carried pair gets the proof file checks, and a proof file i
  await noLeak(e);
 });
 });
+
+// Row 189 (#1687, mos-0972/0973): activate --no-send drops the pointer's --send; nothing turns it back on.
+const sendLines=(out)=>out.filter((l)=>l.startsWith('send:'));
+const noSend=(c)=>c.filter((x)=>x!=='--send');
+const LIVE_NOTE=`note: ${B} is the pointer's copy; the run re-pins it and only the Console flags change`;
+test('T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off',async(t)=>{
+ await t.test('test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']),want=noSend(base);
+  assert.deepEqual(want.slice(-2),['--tester-port','7333']);
+  const sum=createHash('sha256').update(readFileSync(e.store)).digest('hex'),n=calls(e).length;
+  let r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,want);
+  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
+  const act=pointer(e).activation,l=logLines(e).at(-1);
+  assert.deepEqual([l.op,l.from,l.to,l.result,l.backup],['activate',B,B,'ok',act]);assert.equal(backupSum(e,act),sum);
+  assert.deepEqual(startsStops(e,n),[`stop ${CON}`,`stop ${BUS}`,`start ${BUS}`,`start ${CON}`]);
+  await noLeak(e);
+ });
+ await t.test('test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);
+  await refused(e,['activate',B,'acme'],'already-active',`${B} is the pointer's copy`);
+  await refused(e,['activate',B,'acme','--tester-port','7333'],'already-active',`${B} is the pointer's copy`);
+  await refused(e,['activate',B,'acme','--no-proof'],'already-active',`${B} is the pointer's copy`);
+  const r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  await refused(e,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
+  const g=await mk(t);await seedPreview(g);
+  await refused(g,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
+  for(const x of [e,g])await noLeak(x);
+ });
+ await t.test('test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
+  let out=await planOnly(e,0,'activate',B,'acme','--no-send');
+  assert.deepEqual(sendLines(out),['send: dropped; --no-send was given']);
+  assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[LIVE_NOTE]);
+  assert.equal(out[out.indexOf('send: dropped; --no-send was given')+1],`Console: scripts/webui-service.sh install --copy ${B} --copies ${COPIES} ${noSend(base).join(' ')}`);
+  out=await planOnly(e,0,'activate',C1,'acme');
+  assert.deepEqual(sendLines(out),['send: carried']);assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[]);
+  assert.ok(out.find((l)=>l.startsWith('Console: ')).endsWith(' --send'));
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',C1,'acme','--no-send')),['send: dropped; --no-send was given']);
+  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,noSend(base));assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme','--no-send')),['send: off; --no-send was given and the pointer holds no --send']);
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme')),['send: off']);
+  assert.deepEqual(sendLines(await planOnly(e,0,'rollback','acme')),['send: off']);
+  r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.match(stepText(e),/Z --no-send was given and the pointer holds no --send, so there is nothing to drop\n/);
+  assert.doesNotMatch(stepText(e),/drop --send/);
+  await noLeak(e);
+ });
+ await t.test('test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
+  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  assert.doesNotMatch(stepText(e),/--send/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('test 4: pm-on after --no-send keeps --send off',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,{pm:true},['--send']);
+  let r=await prun(e,'activate',C1,'acme','--pm-after-harness','--no-send');assert.equal(r.code,0,r.out+r.err);
+  biz(e,HARNESS);
+  r=await prun(e,'pm-on','acme');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).pm,true);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);
+  const usageText=(await prun(e,'--help')).err,n=calls(e).length,logs=logLines(e).length,before=fp(e);
+  for(const args of [['rollback','acme','--no-send'],['rollback','acme','--plan','--no-send'],['pm-on','acme','--no-send'],['status','acme','--no-send'],['adopt','acme','--no-send'],
+   ['rehearse','acme','--backup','/tmp/x','--port','7400','--no-send']]){
+   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
+  }
+  assert.match(usageText,/\| --no-proof\] \[--no-send\]/);
+  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
+  await noLeak(e);
+ });
+ await t.test('test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']),pre=noSend(base),f=await proofFile(e),g=await proofFile(e,'proof2.189',0o400);
+  let r=await prun(e,'activate',B,'acme',...pair(f));assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(f),'--send']);
+  let out=await planOnly(e,0,'activate',C1,'acme','--no-proof');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: carried']);
+  out=await planOnly(e,0,'activate',C1,'acme','--no-send');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: carried, header x-console-proof','send: dropped; --no-send was given']);
+  out=await planOnly(e,0,'activate',B,'acme','--no-send','--no-proof');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: dropped; --no-send was given']);
+  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(f)]);
+  r=await prun(e,'activate',C1,'acme','--no-send',...pair(g,'X-Proof-Two'));assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(g,'X-Proof-Two')]);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  const h=await mk(t),hbase=await seedPreview(h,undefined,['--send']),hpre=noSend(hbase),k=await proofFile(h);
+  r=await prun(h,'activate',B,'acme',...pair(k));assert.equal(r.code,0,r.out+r.err);
+  r=await prun(h,'activate',C1,'acme','--no-proof');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(h).console,[...hpre,'--send']);
+  r=await prun(h,'activate',C1,'acme','--no-send','--no-proof');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(h).console,hpre);assert.doesNotMatch(conExec(h),/--proof-| --send( |$)/);
+  const steps=stepText(h);
+  assert.match(steps,/Z --no-proof was given and the pointer holds no proof pair, so there is nothing to drop\n/);assert.match(steps,/Z drop --send; --no-send was given\n/);
+  r=await prun(h,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  for(const x of [e,h])await noLeak(x);
+ });
+});
+
+// --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
+// Copies of their own in RCOPIES: the real scripts/mosaic, config loader, business loader, roles and
+// mosaic-config.mjs, with stand-ins for the bus host (cli.mjs), the Console, the Store and
+// migrate-schema.mjs. A rehearsal starts its processes with only HOME, PATH and MOSAIC_CONFIG, so
+// the stand-ins take their faults from $HOME/faults and record what they did in $HOME.
+
+// The bus host. bus start writes the store's writer.lock, a meta row in the store, and its state
+// beside the scratch store, and prints the host-up line; without --no-launch it starts the PM, which here means a line in
+// $HOME/starts.log and a sessions.json. bus status --json answers from that state.
+function rHost(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path');
+ const id=path.basename(path.resolve(import.meta.dirname,'..','..','..')),home=process.env.HOME,a=process.argv.slice(2);
+ const fault=(n)=>fs.existsSync(path.join(home,'faults',n));
+ const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,'utf8');return s[s.lastIndexOf(')')+2]!=='Z'}catch{return false}};
+ const data=JSON.parse(fs.readFileSync(process.env.MOSAIC_CONFIG,'utf8')).dataRoot,state=path.join(data,'fixture-host.json');
+ const flags=["--pm","--no-launch"];
+ if(a.join(' ')==='bus status --json'){
+  if(fault(`status-${id}`))process.exit(1);
+  let s={host:null,boot:null};try{s=JSON.parse(fs.readFileSync(state,'utf8'));s.host.live=alive(s.host.pid)}catch{}
+  if(fault('status-other-host')&&s.host)s.host.pid=process.ppid;
+  console.log(JSON.stringify(s));process.exit(0);
+ }
+ if(a[0]!=='bus'||a[1]!=='start'||!a.slice(3).every((f)=>flags.includes(f))){console.error(`fixture host: ${a.join(' ')}`);process.exit(4)}
+ fs.appendFileSync(path.join(home,'host-args.log'),`${a.join(' ')}\n`);
+ if(fault(`host-fails-${id}`)){console.error('fixture host: refused');process.exit(1)}
+ const b=a[2],off=a.includes('--no-launch'),lock=path.join(data,'bus','writer.lock'),at=new Date().toISOString();
+ fs.writeFileSync(lock,String(process.pid),{flag:'wx'});
+ const db=new (process.getBuiltinModule('node:sqlite').DatabaseSync)(path.join(data,'bus','bus.sqlite'));
+ db.prepare("INSERT OR REPLACE INTO meta(key,value) VALUES('fixture_host_start',?)").run(at);db.close();
+ fs.writeFileSync(state,JSON.stringify({host:{business:b,pid:process.pid,live:true,startedAt:at,notifier:'off'},boot:{ok:true,business:b,at}}));
+ if(fault('host-launches-dir'))fs.mkdirSync(path.join(data,'launches'));
+ // host-touches lists files a careless host would write: the live config, business file or backup.
+ if(fault('host-touches'))for(const f of fs.readFileSync(path.join(home,'faults','host-touches'),'utf8').split('\n').filter(Boolean))fs.appendFileSync(f,'x');
+ if(!off||fault('host-launches')){
+  fs.appendFileSync(path.join(home,'starts.log'),`pm-${b}\n`);
+  fs.mkdirSync(path.join(data,'bus-host'),{recursive:true});
+  fs.writeFileSync(path.join(data,'bus-host','sessions.json'),JSON.stringify({sessionsVersion:1,sessions:[{pid:process.pid}]}));
+ }
+ console.log(`bus host up: business ${b}, socket ${path.join(data,'bus','broker.sock')}, notifier off${off?', launches disabled':''}`);
+ process.on('SIGTERM',()=>{if(fault('host-ignores-term'))return;if(!fault('host-keeps-lock'))fs.rmSync(lock,{force:true});process.exit(0)});
+ setInterval(()=>{},1<<30);
+}
+
+// The Console: serve on the given loopback port; /healthz answers 200 unless healthz-<copy> is set.
+function rConsole(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),http=process.getBuiltinModule('node:http');
+ const id=path.basename(path.resolve(import.meta.dirname,'..','..','..')),home=process.env.HOME,a=process.argv.slice(2);
+ const fault=(n)=>fs.existsSync(path.join(home,'faults',n));
+ fs.appendFileSync(path.join(home,'console-args.log'),`${a.join(' ')}\n`);
+ if(a[0]!=='serve'){console.error('fixture Console: refused');process.exit(1)}
+ const s=http.createServer((q,r)=>{r.writeHead(q.url==='/healthz'&&!fault(`healthz-${id}`)?200:500);r.end()});
+ s.listen(Number(a[a.indexOf('--port')+1]),'127.0.0.1',()=>console.log(`Mosaic Console: http://127.0.0.1:${s.address().port}/\nBoard: fixture`));
+ process.on('SIGTERM',()=>process.exit(0));
+}
+
+// migrate-schema.mjs: sets its copy's SCHEMA_VERSION, or exit 1 under migrate-fails.
+function rMigrate(){
+ const fs=process.getBuiltinModule('node:fs'),path=process.getBuiltinModule('node:path'),{DatabaseSync}=process.getBuiltinModule('node:sqlite');
+ const home=process.env.HOME,data=process.argv[2];
+ const v=/^export const SCHEMA_VERSION = '([A-Za-z0-9]+)';$/m.exec(fs.readFileSync(path.join(import.meta.dirname,'store.mjs'),'utf8'))[1];
+ fs.appendFileSync(path.join(home,'migrate.log'),`${data}\n`);
+ if(fs.existsSync(path.join(home,'faults','migrate-fails'))){console.error('fixture migrate: failed');process.exit(1)}
+ const db=new DatabaseSync(path.join(data,'bus','bus.sqlite'));db.prepare("UPDATE meta SET value=? WHERE key='schema_version'").run(v);db.close();
+ console.log(`bus schema ${v} ready`);
+}
+
+// The copy's Store: refuses a store at another version with schema-mismatch, as the real one does.
+const rStore=(v,froms)=>`${storeText(v,froms)}import {DatabaseSync} from 'node:sqlite';
+import {join} from 'node:path';
+export class Store {
+  constructor(root) {
+    this.db = new DatabaseSync(join(root, 'bus', 'bus.sqlite'));
+    if (this.db.prepare("SELECT value FROM meta WHERE key='schema_version'").get()?.value !== SCHEMA_VERSION) { this.db.close(); throw Error('schema-mismatch'); }
+  }
+  get(sql, ...args) { return this.db.prepare(sql).get(...args); }
+  close() { this.db.close(); }
+}
+`;
+
+// B (3g) and C (3h) have --no-launch. A is a copy from before row 163, whose host has no such flag.
+// C1's scripts/mosaic runs B's host, as a copy-check failure needs.
+const RCOPIES=join(base,'rcopies');mkdirSync(RCOPIES);
+for(const [id,v,froms] of [[B,'3g',['3f']],[C,'3h',['3f','3g']],[A,'3g',['3f']],[C1,'3g',['3f']]]){
+ const d=join(RCOPIES,id);
+ for(const p of ['scripts/mosaic','scripts/mosaic-config.mjs','packages/cli/src/config.mjs','packages/cli/src/errors.mjs','packages/bus/src/business.mjs','packages/plugins/src/kinds.mjs','packages/business/src','roles'])cpSync(join(repo,p),join(d,p),{recursive:true});
+ if(id===C1)writeFileSync(join(d,'scripts','mosaic'),`#!/usr/bin/env bash\nexec node "${join(RCOPIES,B,'packages','cli','src','cli.mjs')}" "$@"\n`,{mode:0o755});
+ for(const [f,text] of [['packages/cli/src/cli.mjs',id===A?'// fixture host from before row 163\nprocess.exit(1);\n':script(rHost)],['packages/webui/src/cli.mjs',script(rConsole)],['packages/bus/src/store.mjs',rStore(v,froms)],['packages/bus/src/migrate-schema.mjs',script(rMigrate)],['packages/bus/src/broker.mjs','export class BusError extends Error { constructor(code) { super(code); this.code = code; } }\n']]){mkdirSync(dirname(join(d,f)),{recursive:true});writeFileSync(join(d,f),text)}
+ execFileSync('chmod',['-R','a-w',d]);
+}
+
+const TESTER='7499';
+const freePort=async()=>{const s=createServer();s.listen(0,'127.0.0.1');await once(s,'listening');const p=String(s.address().port);await new Promise((r)=>s.close(r));return p};
+const rh=(e,...p)=>join(e.env.HOME,...p);
+const rfault=(e,name)=>{mkdirSync(rh(e,'faults'),{recursive:true});writeFileSync(rh(e,'faults',name),'')};
+
+// A root for one rehearsal: a stopped live store at `store`, a pointer by hand on `copy` with the
+// Console on e.port and the tester listener on TESTER, and a backup as backup_store writes one.
+// A rehearsal's leftovers, found by their scratch MOSAIC_CONFIG, are killed after the test.
+async function rmk(t,{copy=B,store='3g'}={}){
+ const e=await mk(t);
+ t.after(()=>{
+  for(const pid of readdirSync('/proc').filter((n)=>/^\d+$/.test(n)))
+   try{if(readFileSync(`/proc/${pid}/environ`,'utf8').includes(`MOSAIC_CONFIG=${e.data}/rehearsals/`))process.kill(Number(pid),'SIGKILL')}catch{}
+ });
+ const db=new DatabaseSync(e.store);
+ db.exec('PRAGMA journal_mode=WAL');
+ db.exec('CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)');
+ db.exec('CREATE TABLE events (id INTEGER PRIMARY KEY, at TEXT NOT NULL)');
+ db.prepare("INSERT INTO meta VALUES ('schema_version', ?)").run(store);
+ for(let i=0;i<3;i++)db.prepare('INSERT INTO events (at) VALUES (?)').run(`2000-01-01T00:00:0${i}.000Z`);
+ db.close();
+ mkdirSync(e.state,{recursive:true});
+ writeFileSync(e.pointer,JSON.stringify({copy,business:'acme',pm:true,claude:e.claude,console:['--port',e.port,'--business','acme','--tester-port',TESTER],schema:store,activation:'manual',at:'2026-10-20T00:00:00Z'})+'\n');
+ e.act=`20261020T000000Z-${copy.slice(0,12)}`;e.backup=join(e.data,'backups','stack',e.act);
+ mkdirSync(join(e.backup,'bus'),{recursive:true,mode:0o700});
+ cpSync(e.store,join(e.backup,'bus','bus.sqlite'));
+ writeFileSync(join(e.backup,'SHA256SUMS'),`${sha(e.store)}  bus.sqlite\n`);
+ for(const [f,text] of [['DATA_ROOT',e.data],['SCHEMA',store],['STAMP','2026-10-20T00:00:00.000Z']])writeFileSync(join(e.backup,f),`${text}\n`);
+ e.biz=join(dirname(e.cfg),'businesses','acme.json');
+ return e;
+}
+
+// What a rehearsal may never change: the live store, config, business file, pointer and log, and
+// the backup, by sha256 of every file.
+const untouched=(e)=>JSON.stringify([...[e.store,e.cfg,e.biz,e.pointer].map((f)=>[f,sha(f)]),existsSync(e.log),...readdirSync(e.backup,{recursive:true}).sort().map((f)=>join(e.backup,f)).filter((f)=>statSync(f).isFile()).map((f)=>[f,sha(f)])]);
+
+async function rehearse(e,id,...args){
+ const ch=spawn('bash',[e.sr??SR,'rehearse',id,'acme',...args,'--copies',RCOPIES,'--bin',e.bin],{env:e.env,stdio:['ignore','pipe','pipe']});
+ let out='',err='';ch.stdout.on('data',(d)=>{out+=d});ch.stderr.on('data',(d)=>{err+=d});
+ e.during?.(ch);
+ const timer=setTimeout(()=>ch.kill('SIGKILL'),120000);
+ const [code]=await once(ch,'close');clearTimeout(timer);
+ const m=/\nrehearsal directory: (.*)\n$/.exec(out);
+ return {code,out,err,dir:m?m[1]:null,names:out.split('\n').filter((l)=>/^(PASS|FAIL) /.test(l)).map((l)=>l.replace(/^(PASS|FAIL) ([^:]*).*/,'$1 $2'))};
+}
+// A script of its own whose text has `from` replaced, for the guard tests. The replacement is a
+// function so a shell "$$" in `to` stays as written.
+function ownScript(e,from,to){
+ const own=join(e.root,'repo');cpSync(repo,own,{recursive:true});
+ e.sr=join(own,'scripts','stack-release.sh');
+ const s=readFileSync(e.sr,'utf8');assert.ok(s.includes(from),`${e.sr} has no ${from}`);writeFileSync(e.sr,s.replace(from,()=>to));
+}
+const rDirs=(e)=>existsSync(join(e.data,'rehearsals'))?readdirSync(join(e.data,'rehearsals')):[];
+const PRE=['PASS copy','PASS port','PASS backup','PASS scratch-root','PASS data-root-live','PASS sessions-live','PASS data-root-scratch','PASS notify-off','PASS tracker-configured','PASS credential-ref-live'];
+const POST=['PASS console-stopped','PASS host-stopped','PASS host-released-store','PASS backup-unchanged','PASS live-config-unchanged'];
+
+test('R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical',async(t)=>{
+ const e=await rmk(t),before=untouched(e),port=await freePort();
+ const r=await rehearse(e,B,'--backup',e.act,'--port',port,'--timeout','10');
+ assert.equal(r.code,0,r.out+r.err);
+ assert.deepEqual(r.names,[...PRE,'PASS migration','PASS gate','PASS no-session',...POST]);
+ assert.ok(r.out.endsWith(`REHEARSAL_PASS\nrehearsal directory: ${r.dir}\n`),r.out);
+ assert.equal(r.err,'');
+ assert.equal(untouched(e),before);
+ const R=r.dir;assert.equal(dirname(R),join(e.data,'rehearsals'));assert.match(basename(R),new RegExp(`^\\d{8}T\\d{6}Z-${B.slice(0,12)}$`));
+ for(const d of [dirname(R),R,join(R,'placeholders'),join(R,'config')])assert.equal(statSync(d).mode&0o777,0o700,d);
+ for(const f of ['steps.log','backup.before','live.before','business.diff','host.log','console.log','config/config.json','data/bus/bus.sqlite'])assert.ok(existsSync(join(R,f)),f);
+ // The host wrote the scratch store, a copy: the backup has no such row.
+ const metaOf=(f)=>{const db=new DatabaseSync(f,{readOnly:true});try{return db.prepare("SELECT value FROM meta WHERE key='fixture_host_start'").get()?.value}finally{db.close()}};
+ assert.match(metaOf(join(R,'data','bus','bus.sqlite')),/^\d{4}-/);assert.equal(metaOf(join(e.backup,'bus','bus.sqlite')),undefined);
+ // The scratch config differs from the live one only in dataRoot.
+ assert.deepEqual(JSON.parse(readFileSync(join(R,'config','config.json'),'utf8')),{...JSON.parse(readFileSync(e.cfg,'utf8')),dataRoot:join(R,'data')});
+ // The notifier config: binding null at 0600.
+ const nf=join(R,'data','notify','acme','notify.json');
+ assert.deepEqual(JSON.parse(readFileSync(nf,'utf8')),{notifyVersion:1,binding:null});assert.equal(statSync(nf).mode&0o777,0o600);
+ // The scratch business: no tracker.* variable, and every reference a 0600 placeholder with its date kept.
+ const live=JSON.parse(readFileSync(e.biz,'utf8')),sb=JSON.parse(readFileSync(join(R,'config','businesses','acme.json'),'utf8'));
+ assert.ok(Object.keys(live.vars).some((k)=>k.startsWith('tracker.')));
+ assert.deepEqual(Object.keys(sb.vars).filter((k)=>k.startsWith('tracker.')),[]);
+ const refs=[...Object.entries(sb.roles).flatMap(([n,r])=>Object.entries(r.credentials??{}).map(([s,ref])=>[`${n}-${s}`,ref,live.roles[n].credentials[s]])),...Object.entries(sb.tracker.sync.credentials).map(([s,ref])=>[`@sync-${s}`,ref,live.tracker.sync.credentials[s]])];
+ assert.ok(refs.length>=2);
+ for(const [name,ref,old] of refs){
+  const f=join(R,'placeholders',name);
+  assert.deepEqual(ref,{...old,file:f});assert.equal(readFileSync(f,'utf8'),'rehearsal-placeholder-token');assert.equal(statSync(f).mode&0o777,0o600);
+ }
+ assert.deepEqual(readdirSync(join(R,'placeholders')).sort(),refs.map(([n])=>n).sort());
+ // Everything else in the business is as it was.
+ const strip=(b)=>{const c=structuredClone(b);for(const k of Object.keys(c.vars))if(k.startsWith('tracker.'))delete c.vars[k];for(const r of Object.values(c.roles))delete r.credentials;delete c.tracker.sync.credentials;return c};
+ assert.deepEqual(strip(sb),strip(live));
+ const diff=readFileSync(join(R,'business.diff'),'utf8');assert.match(diff,/^-.*"tracker\.baseUrl"/m);assert.match(diff,/^\+.*placeholders\/pm-/m);
+ // The host ran with launches disabled and started no PM; the Console got no --send.
+ assert.deepEqual(lines(rh(e,'host-args.log')),['bus start acme --no-launch']);
+ assert.deepEqual(lines(rh(e,'console-args.log')),[`serve --port ${port} --business acme`]);
+ assert.equal(existsSync(rh(e,'starts.log')),false);
+ assert.equal(existsSync(join(R,'data','bus','writer.lock')),false);
+ assert.deepEqual(lines(join(R,'steps.log')).map((l)=>l.replace(/^\S+ /,'')),r.out.split('\n').filter((l)=>/^(PASS|FAIL) |^REHEARSAL_/.test(l)));
+});
+
+test('R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g',async(t)=>{
+ const e=await rmk(t),before=untouched(e),port=await freePort();
+ const r=await rehearse(e,C,'--backup',e.backup,'--port',port,'--timeout','10');
+ assert.equal(r.code,0,r.out+r.err);
+ assert.deepEqual(r.names,[...PRE,'PASS new-refuses-old-store','PASS migrate','PASS new-opens-migrated','PASS migrate-again','PASS old-refuses-migrated','PASS gate','PASS no-session',...POST]);
+ assert.ok(r.out.includes('PASS migrate: 3g to 3h\n'),r.out);
+ assert.equal(untouched(e),before);assert.equal(storeVersion(e.store,false),'3g');
+ assert.equal(storeVersion(join(r.dir,'data','bus','bus.sqlite'),false),'3h');
+ assert.equal(storeVersion(join(r.dir,'refuse','bus','bus.sqlite'),false),'3g');
+ assert.deepEqual(lines(rh(e,'migrate.log')),[join(r.dir,'data'),join(r.dir,'data')]);
+});
+
+test('R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing',async(t)=>{
+ const e=await rmk(t),before=untouched(e);rfault(e,'migrate-fails');
+ const r=await rehearse(e,C,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.deepEqual(r.names,[...PRE,'PASS new-refuses-old-store','FAIL migrate','PASS backup-unchanged','PASS live-config-unchanged']);
+ assert.ok(r.out.includes('FAIL migrate: migrate-schema.mjs exit 1: fixture migrate: failed\n'),r.out);
+ assert.ok(r.out.endsWith(`REHEARSAL_FAIL\nrehearsal directory: ${r.dir}\n`),r.out);
+ assert.equal(existsSync(rh(e,'host-args.log')),false);assert.equal(existsSync(rh(e,'console-args.log')),false);
+ assert.equal(untouched(e),before);
+});
+
+test('R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name',async(t)=>{
+ for(const [f,name,why] of [[`host-fails-${B}`,'host-up','exited'],[`status-${B}`,'bus-status','bus status failed'],['status-other-host','bus-status','the host this run started'],['host-launches','no-session','bus-host/sessions.json'],['host-launches-dir','no-session','found launches under'],['host-keeps-lock','host-released-store','writer.lock is still there']]){
+  const e=await rmk(t),before=untouched(e);rfault(e,f);
+  const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+  assert.equal(r.code,1,f+r.out+r.err);
+  assert.ok(r.names.includes(`FAIL ${name}`),f+r.out);assert.equal(r.names.filter((n)=>n.startsWith('FAIL')).length,1,f+r.out);
+  assert.ok(r.out.split('\n').some((l)=>l.startsWith(`FAIL ${name}: `)&&l.includes(why)),f+r.out);
+  assert.ok(r.names.includes('PASS console-stopped')&&r.names.includes('PASS backup-unchanged'),f+r.out);
+  assert.ok(r.out.endsWith(`REHEARSAL_FAIL\nrehearsal directory: ${r.dir}\n`),r.out);
+  assert.equal(untouched(e),before);
+ }
+});
+
+test('R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped',async(t)=>{
+ const e=await rmk(t);rfault(e,'host-ignores-term');
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','2');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(/^FAIL host-stopped: pid \d+ was still running 2s after SIGTERM; sent SIGKILL$/m.test(r.out),r.out);
+});
+
+test('R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz',async(t)=>{
+ const e=await rmk(t);rfault(e,`healthz-${B}`);
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes('FAIL healthz: no answer within 3s\n'),r.out);
+ assert.deepEqual(r.names.filter((n)=>n.startsWith('FAIL')),['FAIL healthz']);
+});
+
+test('R7 a host on another copy fails copy-match',async(t)=>{
+ const e=await rmk(t);
+ const r=await rehearse(e,C1,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes(`FAIL copy-match: the host's command line is not ${join(RCOPIES,C1)}'s cli.mjs bus start acme --no-launch\n`),r.out);
+});
+
+test('R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port',async(t)=>{
+ const e=await rmk(t),before=untouched(e);
+ const held=createServer();held.listen(0,'127.0.0.1');await once(held,'listening');t.after(()=>held.close());
+ const p=String(held.address().port);
+ const r=await rehearse(e,B,'--backup',e.act,'--port',p);
+ assert.equal(r.code,1,r.out+r.err);
+ assert.equal(r.out,`PASS copy: ${B}, schema 3g\nFAIL port-in-use: 127.0.0.1:${p} is in use; the rehearsal takes no other port\nREHEARSAL_FAIL\n`);
+ for(const q of ['7332','7333',e.port,TESTER]){
+  const s=await rehearse(e,B,'--backup',e.act,'--port',q);
+  assert.equal(s.code,1,s.out+s.err);
+  assert.equal(s.out,`PASS copy: ${B}, schema 3g\nFAIL port-reserved: --port ${q} is a live Console port (7332, 7333 and the pointer's: ${e.port} ${TESTER})\nREHEARSAL_FAIL\n`);
+ }
+ assert.deepEqual(rDirs(e),[]);assert.equal(existsSync(rh(e,'host-args.log')),false);assert.equal(existsSync(rh(e,'console-args.log')),false);
+ assert.equal(untouched(e),before);
+});
+
+test('R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts',async(t)=>{
+ const e=await rmk(t);
+ // The live pm gitea reference names a file that is there, as a live token would be.
+ const tok=join(e.root,'live-gitea.token');writeFileSync(tok,'live-token-value',{mode:0o600});
+ const b=JSON.parse(readFileSync(e.biz,'utf8'));b.roles.pm.credentials.gitea.file=tok;writeFileSync(e.biz,JSON.stringify(b,null,2)+'\n',{mode:0o600});
+ const before=untouched(e);
+ ownScript(e,'for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);swap(name,r?.credentials)}','for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);if(name!=="pm")swap(name,r?.credentials)}');
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes(`FAIL credential-ref-live: pm gitea is ${tok}, not a file in ${join(r.dir,'placeholders')}\n`),r.out);
+ assert.deepEqual(r.names.slice(-3),['FAIL credential-ref-live','PASS backup-unchanged','PASS live-config-unchanged']);
+ assert.equal(existsSync(rh(e,'host-args.log')),false);assert.equal(existsSync(rh(e,'console-args.log')),false);
+ assert.equal(untouched(e),before);
+ // An env reference names no file at all; the guard says which variable it is.
+ const f=await rmk(t);
+ const fb=JSON.parse(readFileSync(f.biz,'utf8'));const {file,...rest}=fb.roles.pm.credentials.gitea;fb.roles.pm.credentials.gitea={...rest,env:'REHEARSAL_GITEA_TOKEN'};writeFileSync(f.biz,JSON.stringify(fb,null,2)+'\n',{mode:0o600});
+ ownScript(f,'for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);swap(name,r?.credentials)}','for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);if(name!=="pm")swap(name,r?.credentials)}');
+ const s=await rehearse(f,B,'--backup',f.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(s.code,1,s.out+s.err);
+ assert.ok(s.out.includes('FAIL credential-ref-live: pm gitea is env REHEARSAL_GITEA_TOKEN\n'),s.out);
+ assert.equal(existsSync(rh(f,'host-args.log')),false);
+});
+
+test('R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured',async(t)=>{
+ const e=await rmk(t);
+ const proj=join(e.root,'project');mkdirSync(join(proj,'.mosaic'),{recursive:true});
+ writeFileSync(join(proj,'.mosaic','project.json'),JSON.stringify({projectVersion:1,id:'stack',vars:{'tracker.project':7}}),{mode:0o600});
+ const b=JSON.parse(readFileSync(e.biz,'utf8'));b.projects.stack.root=proj;writeFileSync(e.biz,JSON.stringify(b,null,2)+'\n',{mode:0o600});
+ ownScript(e,'if(k.startsWith("tracker."))delete vars[k]','if(k.startsWith("tracker-kept."))delete vars[k]');
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes('FAIL tracker-configured: bootConfig sets trackers for acme\n'),r.out);
+ assert.equal(existsSync(rh(e,'host-args.log')),false);
+});
+
+test('R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name',async(t)=>{
+ // mosaic-config already refuses the live path itself, which contains the scratch config directory;
+ // the guard catches a path that reaches the live data root through a link.
+ const e=await rmk(t),link=join(e.root,'live-link');symlinkSync(e.data,link);
+ ownScript(e,'c.dataRoot=data;',`c.dataRoot=${JSON.stringify(link)};`);
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes(`FAIL data-root-live: the scratch config names dataRoot ${link}, which resolves to the live data root ${e.data}\n`),r.out);
+ assert.equal(existsSync(rh(e,'host-args.log')),false);
+ // A root that is neither live nor this rehearsal's, and one that is not there.
+ for(const [dir,made,msg] of [['other-root',true,(d,R)=>`the scratch config resolves to ${d}, not ${join(R,'data')}`],['no-root',false,(d)=>`${d} does not exist`]]){
+  const g=await rmk(t),d=join(g.root,dir);if(made)mkdirSync(d);
+  ownScript(g,'c.dataRoot=data;',`c.dataRoot=${JSON.stringify(d)};`);
+  const q=await rehearse(g,B,'--backup',g.act,'--port',await freePort(),'--timeout','3');
+  assert.equal(q.code,1,dir+q.out+q.err);
+  assert.ok(q.out.includes(`FAIL data-root-scratch: ${msg(d,q.dir)}\n`),dir+q.out);
+  assert.equal(existsSync(rh(g,'host-args.log')),false);
+ }
+ const f=await rmk(t);
+ ownScript(f,`printf '{"notifyVersion":1,"binding":null}\\n' > "$R/data/notify/$BUSINESS/notify.json"`,`printf '{"notifyVersion":1,"binding":null}\\n' > "$R/data/notify/$BUSINESS/notify.json" && mkdir "$R/data/bus-host" && printf '{"sessionsVersion":1,"sessions":[{"pid":%s}]}\\n' "$$" > "$R/data/bus-host/sessions.json"`);
+ const s=await rehearse(f,B,'--backup',f.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(s.code,1,s.out+s.err);
+ assert.ok(/^FAIL sessions-live: \S+\/bus-host\/sessions\.json names running pid\(s\) \d+$/m.test(s.out),s.out);
+ // The file is left as it was: the rehearsal never deletes it and retries.
+ assert.ok(existsSync(join(s.dir,'data','bus-host','sessions.json')));
+ assert.equal(existsSync(rh(f,'host-args.log')),false);
+});
+
+test('R12 mos-0962: a notifier config with a binding fails notify-off',async(t)=>{
+ const e=await rmk(t);
+ ownScript(e,`printf '{"notifyVersion":1,"binding":null}\\n'`,`printf '{"notifyVersion":1,"binding":"discord"}\\n'`);
+ const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
+ assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.out.includes('FAIL notify-off: '),r.out);
+ assert.equal(existsSync(rh(e,'host-args.log')),false);
+});
+
+test('R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage',async(t)=>{
+ const e=await rmk(t),before=untouched(e),port=await freePort();
+ const old=await rehearse(e,A,'--backup',e.act,'--port',port);
+ assert.equal(old.code,1);assert.equal(old.out,`FAIL copy-without-no-launch: ${A}'s bus host has no --no-launch flag\nREHEARSAL_FAIL\n`);
+ const none=await rehearse(e,B,'--backup','20261020T000000Z-000000000000','--port',port);
+ assert.equal(none.code,1);assert.ok(none.out.includes(`FAIL backup-missing: ${join(e.data,'backups','stack','20261020T000000Z-000000000000')} has no bus/bus.sqlite and SHA256SUMS\n`),none.out);
+ const f=await rmk(t);appendFileSync(join(f.backup,'bus','bus.sqlite'),'x');
+ const bad=await rehearse(f,B,'--backup',f.act,'--port',port);
+ assert.equal(bad.code,1);assert.ok(bad.out.includes(`FAIL backup-sums: ${f.backup}/bus does not match its SHA256SUMS\n`),bad.out);
+ const g=await rmk(t);rmSync(g.pointer);
+ const np=await rehearse(g,B,'--backup',g.act,'--port',port);
+ assert.equal(np.code,1);assert.match(np.out,/^FAIL no-pointer: /);
+ for(const args of [['--port',port],['--backup',e.act],['--backup',e.act,'--port','80'],['--backup',e.act,'--port','70000'],['--backup','relative/dir','--port',port],['--backup',e.act,'--port',port,'--pm'],['--backup',e.act,'--port',port,'--plan']]){
+  const u=await rehearse(e,B,...args);assert.equal(u.code,4,args.join(' ')+u.out+u.err);assert.match(u.err,/^usage: /);
+ }
+ assert.deepEqual([...rDirs(e),...rDirs(f),...rDirs(g)],[]);
+ assert.equal(untouched(e),before);
+});
+
+test('R14 a host that writes the live config, the live business file or the backup fails the end check by name',async(t)=>{
+ for(const [pick,name] of [[(e)=>e.cfg,'live-config-unchanged'],[(e)=>e.biz,'live-config-unchanged'],[(e)=>join(e.backup,'bus','bus.sqlite'),'backup-unchanged']]){
+  const e=await rmk(t),f=pick(e);rfault(e,'host-touches');writeFileSync(rh(e,'faults','host-touches'),`${f}\n`);
+  const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','10');
+  assert.equal(r.code,1,f+r.out+r.err);
+  assert.deepEqual(r.names.filter((n)=>n.startsWith('FAIL')),[`FAIL ${name}`],f+r.out);
+  assert.ok(r.names.includes('PASS gate')&&r.names.includes('PASS host-stopped'),f+r.out);
+  assert.ok(r.out.endsWith(`REHEARSAL_FAIL\nrehearsal directory: ${r.dir}\n`),r.out);
+ }
+});
+
+test('R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks',async(t)=>{
+ for(const sig of ['SIGTERM','SIGINT','SIGHUP']){
+  // The Console never answers /healthz, so the gate is still waiting when the signal comes.
+  const e=await rmk(t);rfault(e,`healthz-${B}`);
+  e.during=async(ch)=>{for(let i=0;i<200&&!existsSync(rh(e,'console-args.log'));i++)await new Promise((r)=>setTimeout(r,50));ch.kill(sig)};
+  const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','30');
+  assert.equal(r.code,1,sig+r.out+r.err);
+  assert.deepEqual(r.names,[...PRE,'PASS migration','FAIL signal','PASS console-stopped','PASS host-stopped','PASS host-released-store','PASS backup-unchanged','PASS live-config-unchanged'],sig+r.out);
+  assert.ok(r.out.includes('FAIL signal: the rehearsal was interrupted\n'),r.out);
+  assert.ok(r.out.endsWith(`REHEARSAL_FAIL\nrehearsal directory: ${r.dir}\n`),r.out);
+  const pid=JSON.parse(readFileSync(join(r.dir,'data','fixture-host.json'),'utf8')).host.pid;
+  assert.equal(existsSync(`/proc/${pid}`),false,`${sig}: host pid ${pid} is still there`);
+ }
+});
@@ -186,17 +186,22 @@ export function endReason(code, signal) {

 // The host's view of its running sessions, kept in memory and mirrored to
 // sessions.json for `mosaic stop` and `mosaic launches list`.
+// readOnly (row 163, a --no-launch host): sessions.json stays as an earlier host left it, so a
+// later host still finds and ends those runs. add() refuses, and nothing writes the file.
 export class Registry {
  #dataRoot;
  #sessions = [];
-  constructor(dataRoot) {
+  #readOnly;
+  constructor(dataRoot, { readOnly = false } = {}) {
    this.#dataRoot = dataRoot;
+    this.#readOnly = readOnly;
    this.#write();
  }
  get sessions() {
    return this.#sessions.map((s) => ({ ...s }));
  }
  add(entry) {
+    if (this.#readOnly) throw new SeatError("this host keeps no sessions (--no-launch)", 2);
    this.#sessions.push({ ...entry });
    this.#write();
  }
@@ -213,6 +218,7 @@ export class Registry {
    return this.#sessions.find((s) => s.business === business && s.instance === instance && (s.thread ?? null) === thread) ?? null;
  }
  #write() {
+    if (this.#readOnly) return;
    const file = sessionsFile(this.#dataRoot);
    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
    const tmp = `${file}.${process.pid}.tmp`;
@@ -133,6 +133,23 @@ test("Registry mirrors to sessions.json; readSessions marks live entries; bad fi
  assert.throws(() => readSessions(root), (e) => e instanceof SeatError && /malformed/.test(e.message));
 });

+// Row 163: a --no-launch host's registry leaves an earlier host's sessions.json as it was.
+test("a read-only Registry never writes sessions.json, refuses add() and leaves the file on remove()", (t) => {
+  const root = scratch(t);
+  new Registry(root).add({ business: "acme", instance: "chief", run: "r1", runnerPid: process.pid, runnerStartTime: startTimeOf(process.pid) });
+  const before = readFileSync(sessionsFile(root), "utf8");
+  const r = new Registry(root, { readOnly: true });
+  assert.equal(readFileSync(sessionsFile(root), "utf8"), before);
+  assert.deepEqual(r.sessions, []);
+  assert.throws(() => r.add({ business: "acme", instance: "coder", run: "r2" }), (e) => e instanceof SeatError && /keeps no sessions/.test(e.message));
+  assert.equal(readFileSync(sessionsFile(root), "utf8"), before);
+  r.remove("acme", "r1");
+  assert.equal(readFileSync(sessionsFile(root), "utf8"), before);
+  const empty = scratch(t);
+  new Registry(empty, { readOnly: true });
+  assert.equal(existsSync(sessionsFile(empty)), false);
+});
+
 // Row 121 (#1615): a thread instance runs once per thread, so the registry
 // keys a thread run by its thread too.
 test("REQ-THREAD-1 Registry.running keys a thread run by business, instance and thread", (t) => {
@@ -3,7 +3,7 @@
 # Moves the bus, the Console and the human CLI from the pointer's copy to another copy together,
 # behind a health gate, and puts the old stack back inside the same run when the gate fails.
 # Console tester listener flags follow target support (row 176, #1674); so does the row 178 proof
-# pair, which activate sets or drops (row 187, #1685).
+# pair, which activate sets or drops (row 187, #1685). activate --no-send drops --send (row 189, #1687).
 # Design and tests: agents/darkwing/work/queue-162/BUILD.md.
 #
 # Who runs it. Decision 96 (Mos, mos-0716) lets this script stop and start the live units under
@@ -15,6 +15,8 @@
 #   4. this script never prunes backups, rollback sets, post-attempt directories or copies.
 # Decisions 94 and 102 still decide who starts the Console; webui-service.sh keeps having no start
 # or stop verb. status and --plan only read, and every seat may run them.
+# rehearse (D2, row 163) stops and starts no unit and writes only its own rehearsal directory, but
+# it reads the live config and a backup of the live store, so Jason or Mos runs it.
 #
 # Most functions below run as `f || handler`, and bash ignores set -e inside such a call, so
 # every step that can fail carries its own `|| return 1`.
@@ -28,16 +30,17 @@ BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 CONSOLE_UNIT=mosaic-webui.service
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT=""
-PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0
+PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 R_BACKUP="" R_PORT=""

 usage() {
    cat >&2 <<'USAGE'
 usage: stack-release.sh adopt BUSINESS
       stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-           [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
+           [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
       stack-release.sh pm-on BUSINESS [--timeout S]
       stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
       stack-release.sh status BUSINESS
+       stack-release.sh rehearse ID BUSINESS --backup ACTIVATION|PATH --port N [--timeout S]
 common options: --copies DIR, --bin DIR
 --events N is the total of the per-table counts the post-backup-events refusal prints: events and
 every table in COUNTED.
@@ -82,13 +85,17 @@ parse_opts() {
            --proof-header) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_HEADER="$2"; shift 2 ;;
            --proof-file) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_FILE="$2"; shift 2 ;;
            --no-proof) [ "$OP" = activate ] || usage; NO_PROOF=1; shift ;;
+            --no-send) [ "$OP" = activate ] || usage; NO_SEND=1; shift ;;
            --migrate) [ "$OP" = activate ] || usage; MIGRATE=1; shift ;;
            --restore) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || usage; RESTORE="$2"; shift 2 ;;
+            --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
+            --port) [ "$OP" = rehearse ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{1,5}$ ]] && [ "$((10#$2))" -ge 1024 ] && [ "$((10#$2))" -le 65535 ] || usage; R_PORT="$((10#$2))"; shift 2 ;;
            --events) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^(0|[1-9][0-9]*)$ ]] || usage; EVENTS="$2"; shift 2 ;;
            *) usage ;;
        esac
    done
    [ -z "$EVENTS" ] || [ -n "$RESTORE" ] || usage
+    [ "$OP" != rehearse ] || { [ -n "$R_BACKUP" ] && [ -n "$R_PORT" ]; } || usage
    # A bad tester port is a usage error; --plan lists it as tester-port-invalid instead (row 180).
    [ -z "$TESTER_PORT" ] || [ "$PLAN" = 1 ] || valid_tester_port "$TESTER_PORT" 7332 || usage
    # --pm-after-harness replaces --pm (row 169 item 1), so the two never go together.
@@ -238,14 +245,16 @@ target_schema() {
 in_chain() { local v; for v in "${T_CHAIN[@]}"; do [ "$v" != "$1" ] || return 0; done; return 1; }

 # The item 3 checks on the target copy, in order: copy, schema, already-active. An activate that
-# sets a proof pair, or drops the pointer's pair with --no-proof, may name the pointer's copy: it
-# re-pins the live copy with new Console flags (row 187, Part B's B3 and B-R1).
+# sets a proof pair, drops the pointer's pair with --no-proof, or drops the pointer's --send with
+# --no-send, may name the pointer's copy: it re-pins the live copy with new Console flags (row 187,
+# Part B's B3 and B-R1; row 189, mos-0972).
 check_target() {
    copy_exists "$TO" 2>/dev/null || refuse copy-missing "no copy $TO in $COPIES"
    copy_ok "$TO" 2>/dev/null || refuse copy-unreachable "$TO is not reachable from refactor and origin/refactor"
    target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] ||
        { [ "$NO_PROOF" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --proof-header "* ]]; } ||
+        { [ "$NO_SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --send "* ]]; } ||
        refuse already-active "$TO is the pointer's copy"
 }

@@ -684,6 +693,33 @@ console_for_target() {
        DROP_TESTER="--tester-port $inherited"
    fi
    proof_for_target
+    send_for_target
+}
+
+# Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
+# it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
+# they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
+send_for_target() {
+    local had=0 i
+    local -a without_send=()
+    for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
+        if [ "${RUN_CONSOLE[i]}" = --send ]; then had=1; else without_send+=("${RUN_CONSOLE[i]}"); fi
+    done
+    SEND_STEP=""
+    if [ "$NO_SEND" = 1 ]; then
+        RUN_CONSOLE=("${without_send[@]}")
+        if [ "$had" = 1 ]; then
+            SEND_PLAN="send: dropped; --no-send was given"
+            SEND_STEP="drop --send; --no-send was given"
+        else
+            SEND_PLAN="send: off; --no-send was given and the pointer holds no --send"
+            SEND_STEP="--no-send was given and the pointer holds no --send, so there is nothing to drop"
+        fi
+    elif [ "$had" = 1 ]; then
+        SEND_PLAN="send: carried"
+    else
+        SEND_PLAN="send: off"
+    fi
 }

 # Row 187: the row 178 proof pair in RUN_CONSOLE. A new pair replaces the pointer's and goes last;
@@ -937,6 +973,7 @@ plan() {
    echo "bus: scripts/bus-service.sh install --copy $TO --copies $COPIES$([ "$RUN_PM" = 0 ] || echo ' --pm') --claude $P_CLAUDE"
    [ -z "$DROP_TESTER" ] || echo "drop $DROP_TESTER; the target Console does not support it"
    echo "$PROOF_PLAN"
+    echo "$SEND_PLAN"
    echo "Console: scripts/webui-service.sh install --copy $TO --copies $COPIES${RUN_CONSOLE[*]:+ ${RUN_CONSOLE[*]}}"
    echo "CLI: scripts/stack-copy.sh wrapper $TO --copies $COPIES --bin $BIN"
    local r
@@ -950,6 +987,7 @@ run_steps() {
    capture || refuse capture-failed "could not write the rollback set $RS; nothing was stopped"
    [ -z "$DROP_TESTER" ] || say "drop $DROP_TESTER; the target Console does not support it"
    [ -z "$PROOF_STEP" ] || say "$PROOF_STEP"
+    [ -z "$SEND_STEP" ] || say "$SEND_STEP"
    trap 'after_fail signal' INT TERM HUP
    stop_both || rollback_in_run stop-timeout
    if [ -e "$STORE" ]; then
@@ -1155,13 +1193,307 @@ do_status() {
    fi
 }

+# --- The rehearsal (D2, row 163) ---
+
+# rehearse runs the new copy's bus host (--no-launch) and Console on a scratch root built from a
+# backup, under <dataRoot>/rehearsals/<stamp>/, and gates them as activate does. It never writes the
+# live store, the live config files, the backup, the pointer, the log or a unit. Nothing prunes
+# the rehearsal directory. Design, rulings (mos-0961, mos-0962, mos-0963) and the deviations from
+# the brief: agents/sage/work/queue-163/BUILD.md.
+
+# One PASS or FAIL line per check, on stdout and in steps.log. Lines from before the directory
+# exists wait in R_EARLY and go in first.
+r_line() {
+    echo "$*"
+    if [ -z "$STEPS" ]; then R_EARLY+=("$(now) $*"); else echo "$(now) $*" >> "$STEPS" || true; fi
+}
+r_pass() { r_line "PASS $1${2:+: $2}"; }
+r_fail() { r_line "FAIL $1${2:+: $2}"; R_RC=1; }
+r_abort() { r_fail "$@"; r_end; }
+
+r_alive() { local s; s="$(cat "/proc/$1/stat" 2>/dev/null)" || return 1; s="${s##*) }"; [ "${s:0:1}" != Z ]; }
+r_gone() {
+    local deadline=$((SECONDS + TIMEOUT))
+    while r_alive "$1"; do [ "$SECONDS" -lt "$deadline" ] || return 1; sleep 1; done
+}
+
+# Stops the Console, then the host, with SIGTERM within --timeout; one still there gets SIGKILL
+# and a FAIL line. The host has to leave the store's writer.lock behind it.
+r_stop() {
+    local name pid
+    for name in console host; do
+        if [ "$name" = console ]; then pid="$R_CONSOLE_PID"; R_CONSOLE_PID=""; else pid="$R_HOST_PID"; R_HOST_PID=""; fi
+        [ -n "$pid" ] || continue
+        kill -TERM "$pid" 2>/dev/null || true
+        if r_gone "$pid"; then r_pass "$name-stopped" "pid $pid"
+        else kill -KILL "$pid" 2>/dev/null || true; r_fail "$name-stopped" "pid $pid was still running ${TIMEOUT}s after SIGTERM; sent SIGKILL"
+        fi
+        wait "$pid" 2>/dev/null || true
+    done
+    [ -n "$R_STARTED" ] || return 0
+    R_STARTED=""
+    if [ -e "$R/data/bus/writer.lock" ]; then r_fail host-released-store "$R/data/bus/writer.lock is still there"; else r_pass host-released-store; fi
+}
+
+r_tree_sums() { (cd "$1" && find . -type f -print0 | sort -z | xargs -0 -r sha256sum); }
+
+# The last checks, then the last line. The backup and the live config files are compared with the
+# sums taken before the rehearsal directory was made.
+r_end() {
+    trap - INT TERM HUP
+    r_stop
+    if [ -n "$R" ]; then
+        if [ "$(r_tree_sums "$R_BK")" = "$(cat "$R/backup.before")" ]; then r_pass backup-unchanged; else r_fail backup-unchanged "$R_BK differs from $R/backup.before"; fi
+        if [ "$(sha256sum "$LIVE_CFG" "$LIVE_BIZ" 2>&1)" = "$(cat "$R/live.before")" ]; then r_pass live-config-unchanged; else r_fail live-config-unchanged "$LIVE_CFG or $LIVE_BIZ differs from $R/live.before"; fi
+    fi
+    if [ "$R_RC" = 0 ]; then r_line REHEARSAL_PASS; else r_line REHEARSAL_FAIL; fi
+    [ -z "$R" ] || echo "rehearsal directory: $R"
+    exit "$R_RC"
+}
+
+r_port_free() {
+    node -e 'const s=require("node:net").createServer();s.once("error",()=>process.exit(1));s.listen(Number(process.argv[1]),"127.0.0.1",()=>s.close(()=>process.exit(0)));' -- "$1"
+}
+
+# The scratch config: the live one with dataRoot set to the scratch data root.
+R_CONFIG_JS='
+const fs=require("node:fs");const [file,data]=process.argv.slice(1);
+const c=JSON.parse(fs.readFileSync(file,"utf8"));c.dataRoot=data;process.stdout.write(JSON.stringify(c,null,2)+"\n");'
+
+# The scratch business file (mos-0962, mos-0963): the live file without its tracker.* variables,
+# business and role, and with every credential reference, the roles and tracker.sync, moved to its
+# own 0600 placeholder file. The service and its rotateBy or expires date stay. The tracker key
+# stays because the loader requires it. Mode `normalize` prints the live file as this writes it,
+# for the diff.
+R_BUSINESS_JS='
+const fs=require("node:fs"),path=require("node:path");const [mode,live,out,ph]=process.argv.slice(1);
+const b=JSON.parse(fs.readFileSync(live,"utf8"));
+if(mode==="normalize"){process.stdout.write(JSON.stringify(b,null,2)+"\n");process.exit(0)}
+const DATE={gitea:"rotateBy",vikunja:"expires"};
+const strip=(vars)=>{if(vars&&typeof vars==="object")for(const k of Object.keys(vars))if(k.startsWith("tracker."))delete vars[k]};
+const swap=(name,refs)=>{
+  if(!refs||typeof refs!=="object")return;
+  for(const s of Object.keys(refs)){
+    const file=path.join(ph,`${name}-${s}`),old=refs[s],ref={file};
+    fs.writeFileSync(file,"rehearsal-placeholder-token",{mode:0o600,flag:"wx"});
+    if(old&&typeof old==="object"&&Object.hasOwn(DATE,s)&&old[DATE[s]]!==undefined)ref[DATE[s]]=old[DATE[s]];
+    refs[s]=ref;
+  }
+};
+strip(b.vars);
+for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);swap(name,r?.credentials)}
+swap("@sync",b.tracker?.sync?.credentials);
+fs.writeFileSync(out,JSON.stringify(b,null,2)+"\n",{mode:0o600,flag:"wx"});'
+
+# The guard, before the host starts. It reads the scratch config through the new copy's own
+# loadSystem and bootConfig, as the host will, and prints one line per check:
+#   data-root-live       the data root is not the live one (mos-0961)
+#   sessions-live        no sessions.json there names a running process (mos-0961)
+#   data-root-scratch    the data root is the scratch one
+#   notify-off           the notifier config is {"notifyVersion":1,"binding":null}, 0600 (mos-0962)
+#   tracker-configured   bootConfig sets no trackers (mos-0962)
+#   credential-ref-live  every credential reference is a file under placeholders/ (mos-0963)
+# Exit 0 when all pass, 1 on the first FAIL.
+R_GUARD_JS='
+const fs=require("node:fs"),path=require("node:path");const {pathToFileURL}=require("node:url");
+const [copy,id,live,scratch,ph]=process.argv.slice(1);
+const real=(p)=>{try{return fs.realpathSync(p)}catch{return null}};
+const alive=(pid)=>{try{const s=fs.readFileSync(`/proc/${pid}/stat`,"utf8");return s[s.lastIndexOf(")")+2]!=="Z"}catch{return false}};
+const pass=(n,w)=>console.log(`PASS ${n}${w?": "+w:""}`);
+const fail=(n,w)=>{console.log(`FAIL ${n}: ${w}`);process.exit(1)};
+(async()=>{
+  let c,system,config;
+  try{c=await import(pathToFileURL(`${copy}/packages/cli/src/config.mjs`).href);system=c.loadSystem({env:process.env})}
+  catch(e){fail("scratch-config",String(e?.message??e).split("\n")[0])}
+  const root=real(system.dataRoot);
+  if(root===null)fail("data-root-scratch",`${system.dataRoot} does not exist`);
+  if(root===real(live))fail("data-root-live",`the scratch config names dataRoot ${system.dataRoot}, which resolves to the live data root ${live}`);
+  pass("data-root-live",`${system.dataRoot} is not the live data root`);
+  const sf=path.join(root,"bus-host","sessions.json");
+  if(fs.existsSync(sf)){
+    let doc;try{doc=JSON.parse(fs.readFileSync(sf,"utf8"))}catch{fail("sessions-live",`${sf} is unreadable`)}
+    if(!Array.isArray(doc?.sessions))fail("sessions-live",`${sf} is malformed`);
+    const running=doc.sessions.flatMap((s)=>[s?.pid,s?.runnerPid]).filter((p)=>Number.isSafeInteger(p)&&p>0&&alive(p));
+    if(running.length)fail("sessions-live",`${sf} names running pid(s) ${running.join(", ")}`);
+  }
+  pass("sessions-live","no running session named in the data root");
+  if(root!==real(scratch))fail("data-root-scratch",`the scratch config resolves to ${system.dataRoot}, not ${scratch}`);
+  pass("data-root-scratch");
+  const nf=path.join(root,"notify",id,"notify.json");
+  let st,doc;try{st=fs.lstatSync(nf);doc=JSON.parse(fs.readFileSync(nf,"utf8"))}catch{fail("notify-off",`${nf} is missing or not JSON`)}
+  if(!st.isFile()||(st.mode&0o777)!==0o600||JSON.stringify(doc)!==JSON.stringify({notifyVersion:1,binding:null}))fail("notify-off",`${nf} is not {"notifyVersion":1,"binding":null} at mode 0600`);
+  pass("notify-off","binding null, so no Discord bridge");
+  try{config=c.bootConfig({system,businessId:id,env:process.env})}catch(e){fail("boot-config",String(e?.message??e).split("\n")[0])}
+  if(config.trackers!==undefined)fail("tracker-configured",`bootConfig sets trackers for ${Object.keys(config.trackers).join(", ")}`);
+  pass("tracker-configured","bootConfig sets no trackers");
+  const b=config.businesses?.[id],phr=real(ph),refs=[];
+  for(const [role,r] of Object.entries(b?.roles??{}))for(const [s,ref] of Object.entries(r?.credentials??{}))refs.push([`${role} ${s}`,ref]);
+  for(const [s,ref] of Object.entries(b?.tracker?.sync?.credentials??{}))refs.push([`@sync ${s}`,ref]);
+  for(const [what,ref] of refs){
+    if(ref?.env!==undefined)fail("credential-ref-live",`${what} is env ${ref.env}`);
+    const f=typeof ref?.file==="string"?real(ref.file):null;
+    if(f===null||phr===null||path.dirname(f)!==phr)fail("credential-ref-live",`${what} is ${ref?.file}, not a file in ${ph}`);
+  }
+  pass("credential-ref-live",`${refs.length} reference(s), each a placeholder`);
+})().catch((e)=>fail("guard",String(e?.message??e).split("\n")[0]));'
+
+# Opens a data root's store with a copy's Store, as the bus does at start, with no migration
+# (de352dfaf's verify-open.mjs). Prints OPEN_OK <version> or REFUSED <message>.
+R_OPEN_JS='
+const {pathToFileURL}=require("node:url");const [copy,root]=process.argv.slice(1);
+(async()=>{
+  const {Store}=await import(pathToFileURL(`${copy}/packages/bus/src/store.mjs`).href);
+  let s;
+  try{s=new Store(root);process.stdout.write(`OPEN_OK ${s.get("SELECT value FROM meta WHERE key=?","schema_version").value}\n`)}
+  catch(e){process.stdout.write(`REFUSED ${e.message}\n`)}
+  finally{s?.close()}
+})();'
+r_open() { node -e "$R_OPEN_JS" -- "$1" "$2" 2>&1 || true; }
+
+# Every process this rehearsal starts gets only HOME, PATH and the scratch MOSAIC_CONFIG.
+r_env() { env -i HOME="$HOME" PATH="$PATH" MOSAIC_CONFIG="$R/config/config.json" "$@"; }
+
+# The de352dfaf checks, when the backup's schema is not the new copy's.
+r_migration() {
+    local copy="$COPIES/$TO" old="$COPIES/$P_COPY" v out rc
+    v="$(node -e "$STORE_JS" -- version "$R/data/bus/bus.sqlite" 2>&1)" || r_abort store-unreadable "$v"
+    if [ "$v" = "$T_SCHEMA" ]; then r_pass migration "not needed: the backup is already $v"; return 0; fi
+    in_chain "$v" || r_abort store-newer "the backup is $v, which $TO's migration chain does not start from"
+    (umask 077; mkdir "$R/refuse" "$R/refuse/bus" && cp "$R_BK"/bus/* "$R/refuse/bus/") || r_abort scratch-build "cannot copy the backup to $R/refuse"
+    out="$(r_open "$copy" "$R/refuse")"
+    [ "$out" = "REFUSED schema-mismatch" ] || r_abort new-refuses-old-store "$TO opened the $v store: $out"
+    r_pass new-refuses-old-store "$TO refuses the $v store at a normal open"
+    rc=0; out="$(r_env node "$copy/packages/bus/src/migrate-schema.mjs" "$R/data" 2>&1)" || rc=$?
+    printf '%s\n' "$out" >> "$R/migrate.log"
+    [ "$rc" = 0 ] && [ "$(tail -n 1 <<< "$out")" = "bus schema $T_SCHEMA ready" ] || r_abort migrate "migrate-schema.mjs exit $rc: $(tail -n 1 <<< "$out")"
+    r_pass migrate "$v to $T_SCHEMA"
+    out="$(r_open "$copy" "$R/data")"
+    [ "$out" = "OPEN_OK $T_SCHEMA" ] || r_abort new-opens-migrated "$out"
+    r_pass new-opens-migrated
+    rc=0; out="$(r_env node "$copy/packages/bus/src/migrate-schema.mjs" "$R/data" 2>&1)" || rc=$?
+    printf '%s\n' "$out" >> "$R/migrate.log"
+    [ "$rc" = 0 ] && [ "$(tail -n 1 <<< "$out")" = "bus schema $T_SCHEMA ready" ] || r_abort migrate-again "second migrate-schema.mjs exit $rc: $(tail -n 1 <<< "$out")"
+    r_pass migrate-again "a second run is a no-op"
+    out="$(r_open "$old" "$R/data")"
+    [ "$out" = "REFUSED schema-mismatch" ] || r_abort old-refuses-migrated "the pointer's copy $P_COPY opened the $T_SCHEMA store: $out"
+    r_pass old-refuses-migrated "$P_COPY refuses the $T_SCHEMA store"
+}
+
+# One pass of D1's gate checks but the PM's, against the processes this run started. Sets R_GATE
+# to the first failing check and R_WHY to what it saw.
+r_gate_once() {
+    local copy="$COPIES/$TO" out
+    R_GATE=host-up R_WHY=""
+    r_alive "$R_HOST_PID" || { R_WHY="the host (pid $R_HOST_PID) exited; see $R/host.log"; return 1; }
+    grep -q "^bus host up: business $BUSINESS, .*, launches disabled\$" "$R/host.log" || { R_WHY="no \"bus host up ... launches disabled\" line in $R/host.log"; return 1; }
+    R_GATE=bus-status
+    out="$(r_env "$copy/scripts/mosaic" bus status --json 2>/dev/null)" || { R_WHY="bus status failed"; return 1; }
+    R_WHY="$(node -e '
+const [b,main,since]=process.argv.slice(2),s=JSON.parse(process.argv[1]);
+const why=!s.host?"no host":s.host.business!==b?`host for ${s.host.business}`:s.host.live!==true?"host not live":String(s.host.pid)!==main?`host pid ${s.host.pid} is not ${main}, the host this run started`:!s.boot||s.boot.ok!==true?"boot status not ok":s.boot.business!==b?`boot status for ${s.boot.business}`:!(Date.parse(s.boot.at)>=Number(since))?"boot status is from before this start":"";
+process.stdout.write(why);' -- "$out" "$BUSINESS" "$R_HOST_PID" "$START_MS" 2>&1)" || { R_WHY="bus status unreadable"; return 1; }
+    [ -z "$R_WHY" ] || return 1
+    R_GATE=console-up
+    r_alive "$R_CONSOLE_PID" || { R_WHY="the Console (pid $R_CONSOLE_PID) exited; see $R/console.log"; return 1; }
+    grep -qxF "Mosaic Console: http://127.0.0.1:$R_PORT/" "$R/console.log" || { R_WHY="no \"Mosaic Console: http://127.0.0.1:$R_PORT/\" line in $R/console.log"; return 1; }
+    R_GATE=healthz
+    node -e '
+fetch(`http://127.0.0.1:${process.argv[1]}/healthz`,{signal:AbortSignal.timeout(5000)}).then((r)=>process.exit(r.status===200?0:1),()=>process.exit(1));' -- "$R_PORT" || return 1
+    R_GATE=copy-match
+    tr '\0' ' ' < "/proc/$R_HOST_PID/cmdline" | grep -qF " $copy/packages/cli/src/cli.mjs bus start $BUSINESS --no-launch" || { R_WHY="the host's command line is not $copy's cli.mjs bus start $BUSINESS --no-launch"; return 1; }
+    tr '\0' ' ' < "/proc/$R_CONSOLE_PID/cmdline" | grep -qF " $copy/packages/webui/src/cli.mjs serve " || { R_WHY="the Console's command line is not $copy's webui cli.mjs serve"; return 1; }
+    R_GATE=""
+}
+
+r_gate() {
+    local deadline=$((SECONDS + TIMEOUT))
+    until r_gate_once; do
+        [ "$SECONDS" -lt "$deadline" ] || { r_fail "$R_GATE" "${R_WHY:-no answer within ${TIMEOUT}s}"; return 1; }
+        sleep 1
+    done
+    r_pass gate "host-up, bus-status, console-up, healthz and copy-match on $TO"
+}
+
+# No role session: the host wrote no sessions.json and no launches directory or log.
+r_no_session() {
+    local found=""
+    [ ! -e "$R/data/bus-host/sessions.json" ] || found+=" bus-host/sessions.json"
+    [ ! -e "$R/data/launches" ] || found+=" launches"
+    if [ -z "$found" ]; then r_pass no-session "no sessions.json and no launches under $R/data"; else r_fail no-session "found$found under $R/data"; fi
+}
+
+do_rehearse() {
+    TO="$ID"
+    trap 'r_fail signal "the rehearsal was interrupted"; r_end' INT TERM HUP
+    read_pointer || r_abort no-pointer "no $POINTER; the pointer's copy is the old copy the checks use"
+    [ "$P_BUSINESS" = "$BUSINESS" ] || r_abort business-mismatch "the pointer is for $P_BUSINESS"
+    copy_exists "$TO" 2>/dev/null || r_abort copy-missing "no copy $TO in $COPIES"
+    copy_ok "$TO" 2>/dev/null || r_abort copy-unreachable "$TO is not reachable from refactor and origin/refactor"
+    target_schema "$TO" || r_abort copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
+    # mos-0961: an older copy's host has no --no-launch and would start the PM on its own.
+    grep -qF -- '"--no-launch"' "$COPIES/$TO/packages/cli/src/cli.mjs" 2>/dev/null || r_abort copy-without-no-launch "$TO's bus host has no --no-launch flag"
+    r_pass copy "$TO, schema $T_SCHEMA"
+    local i
+    local -a reserved=(7332 7333 "$(console_port)")
+    for ((i = 0; i < ${#P_CONSOLE[@]}; i++)); do [ "${P_CONSOLE[i]}" != --tester-port ] || reserved+=("${P_CONSOLE[i + 1]:-}"); done
+    for i in "${reserved[@]}"; do [ "$((10#$R_PORT))" != "$i" ] || r_abort port-reserved "--port $R_PORT is a live Console port (7332, 7333 and the pointer's: ${reserved[*]:2})"; done
+    r_port_free "$R_PORT" || r_abort port-in-use "127.0.0.1:$R_PORT is in use; the rehearsal takes no other port"
+    r_pass port "127.0.0.1:$R_PORT is free"
+    case "$R_BACKUP" in /*) R_BK="$R_BACKUP" ;; *) R_BK="$DATA/backups/stack/$R_BACKUP" ;; esac
+    [ -f "$R_BK/bus/bus.sqlite" ] && [ -f "$R_BK/SHA256SUMS" ] || r_abort backup-missing "$R_BK has no bus/bus.sqlite and SHA256SUMS"
+    (cd "$R_BK/bus" && sha256sum -c --quiet ../SHA256SUMS) >/dev/null 2>&1 || r_abort backup-sums "$R_BK/bus does not match its SHA256SUMS"
+    r_pass backup "$R_BK matches its SHA256SUMS"
+    LIVE_CFG="$(realpath -m "${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}")"
+    LIVE_BIZ="$(dirname "$LIVE_CFG")/businesses/$BUSINESS.json"
+    [ -f "$LIVE_BIZ" ] || r_abort business-missing "no $LIVE_BIZ"
+
+    local stamp before live
+    before="$(r_tree_sums "$R_BK")" && live="$(sha256sum "$LIVE_CFG" "$LIVE_BIZ" 2>&1)" || r_abort sums "cannot read $R_BK or the live config files"
+    stamp="$(date -u +%Y%m%dT%H%M%SZ)-${TO:0:12}"
+    (umask 077; mkdir -p "$DATA/rehearsals" && mkdir "$DATA/rehearsals/$stamp") || r_abort rehearsal-dir "cannot make $DATA/rehearsals/$stamp (one rehearsal per second and copy)"
+    R="$DATA/rehearsals/$stamp" STEPS="$DATA/rehearsals/$stamp/steps.log"
+    printf '%s\n' "${R_EARLY[@]}" > "$STEPS" && printf '%s\n' "$before" > "$R/backup.before" && printf '%s\n' "$live" > "$R/live.before" ||
+        r_abort scratch-build "cannot write the sums to $R"
+    (
+        umask 077
+        mkdir "$R/config" "$R/config/businesses" "$R/placeholders" "$R/data" "$R/data/bus" "$R/data/notify" "$R/data/notify/$BUSINESS" &&
+        cp "$R_BK"/bus/* "$R/data/bus/" &&
+        node -e "$R_CONFIG_JS" -- "$LIVE_CFG" "$R/data" > "$R/config/config.json" &&
+        node -e "$R_BUSINESS_JS" -- write "$LIVE_BIZ" "$R/config/businesses/$BUSINESS.json" "$R/placeholders" &&
+        printf '{"notifyVersion":1,"binding":null}\n' > "$R/data/notify/$BUSINESS/notify.json"
+    ) 2>> "$STEPS" || r_abort scratch-build "cannot build the scratch root under $R; see $STEPS"
+    local rc=0
+    diff -u --label "$LIVE_BIZ (as JSON.stringify writes it)" --label "$R/config/businesses/$BUSINESS.json" \
+        <(node -e "$R_BUSINESS_JS" -- normalize "$LIVE_BIZ") "$R/config/businesses/$BUSINESS.json" > "$R/business.diff" || rc=$?
+    [ "$rc" -le 1 ] || r_abort scratch-build "cannot write $R/business.diff"
+    r_pass scratch-root "$R/data from the backup, config and business file under $R/config, business.diff beside them"
+
+    local out
+    rc=0; out="$(r_env node -e "$R_GUARD_JS" -- "$COPIES/$TO" "$BUSINESS" "$DATA" "$R/data" "$R/placeholders" 2>&1)" || rc=$?
+    while IFS= read -r i; do r_line "$i"; done <<< "$out"
+    [ "$rc" = 0 ] || { R_RC=1; r_end; }
+
+    r_migration
+
+    START_MS="$(date +%s%3N)"
+    R_STARTED=1
+    # env, not r_env: a function in the background is a subshell, and $! has to be the process
+    # itself (env execs scripts/mosaic, which execs node), for the bus-status pid check and the stop.
+    env -i HOME="$HOME" PATH="$PATH" MOSAIC_CONFIG="$R/config/config.json" "$COPIES/$TO/scripts/mosaic" bus start "$BUSINESS" --no-launch > "$R/host.log" 2>&1 &
+    R_HOST_PID=$!
+    env -i HOME="$HOME" PATH="$PATH" MOSAIC_CONFIG="$R/config/config.json" node "$COPIES/$TO/packages/webui/src/cli.mjs" serve --port "$R_PORT" --business "$BUSINESS" > "$R/console.log" 2>&1 &
+    R_CONSOLE_PID=$!
+    if r_gate; then r_no_session; fi
+    r_end
+}
+
 # --- Dispatch ---

 [ $# -gt 0 ] || usage
 OP="$1"; shift
 ID=""
 case "$OP" in
-    activate) [ $# -ge 2 ] || usage; ID="$1"; BUSINESS="$2"; shift 2; [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || usage ;;
+    activate|rehearse) [ $# -ge 2 ] || usage; ID="$1"; BUSINESS="$2"; shift 2; [[ "$ID" =~ ^[0-9a-f]{40}$ ]] || usage ;;
    adopt|pm-on|rollback|status) [ $# -ge 1 ] || usage; BUSINESS="$1"; shift ;;
    -h|--help) usage 0 ;;
    *) usage ;;
@@ -1178,11 +1510,13 @@ STORE="$DATA/bus/bus.sqlite"
 BUS_UNIT="mosaic-bus@$BUSINESS.service"
 FROM="" TO="" ACT="" RS="" POST="" BACKUP="" TAKEN="" RESTORED="" STEPS="" COUNT="" UNCLEAN="" FAIL=""
 STORE_SCHEMA="" START_EPOCH="" START_MS=0 GATE="" GATE_WHY="" S_CHANGED=""
-P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" PLAN_REFUSE=()
+P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" SEND_PLAN="" SEND_STEP="" PLAN_REFUSE=()
+R="" R_RC=0 R_EARLY=() R_BK="" R_HOST_PID="" R_CONSOLE_PID="" R_STARTED="" LIVE_CFG="" LIVE_BIZ=""
 case "$OP" in
    adopt) do_adopt ;;
    activate) do_activate ;;
    pm-on) do_pm_on ;;
    rollback) do_rollback ;;
    status) do_status ;;
+    rehearse) do_rehearse ;;
 esac
Author	SHA1	Message	Date
jason.woltje	b7239bb66e	agents: row 195 Case 1 install design r6 (#1693 ): Duckworth r5 B1 (confirm's result lines carry the activation's op, from, to and the rollback set's BACKUP, so from_log reads .53's log; sequence 7), B2 (MIGRATING recorded after backup_store and before migrate-schema.mjs, as TAKEN today; sequence 8), N1 marker step makes $RS, N2 gate --since, N3 apparmor.d word grep baseline, N4 item 4 under systemd-run with NoNewPrivileges, N5 plan --expect-from OLD	2026-10-20 16:53:53 -05:00
jason.woltje	0b6d29e909	agents: row 195 Case 1 install design r5 (#1693 ): Duckworth r4 B1 (one result line per activation, FAILED file and --cause, marker written first, refusals log no activation, real-sequence tests), B2 per mos-1098/mos-1101 (case1-pins.sh and case1-hostcheck.sh, seven-item drift stop with apt hook and boot unit, ops-01 owner, bwrap closed on drift), N1-N4; Console on 127.0.0.1:732 with CAP_NET_BIND_SERVICE, tester 7333 as P10; chains on row 190 r3 and row 230 (C2-13a), node under /opt, four factory profile items for Gosalyn	2026-10-20 16:46:21 -05:00
jason.woltje	0075be3581	agents: row 195 Case 1 install design r4 (#1693 ): Duckworth B1 (root holds only the go's values and the unit files; confirm and revert find the one open activation, AWAITING-UNITS; rollback --to checked against from_log previous; A2 failure path; root step log), B2 (confirm runs gate with --timeout; .53 runs the PM; external PM check reads launches list with ActiveEnterTimestamp, no journal; pm-on refuses), N1-N5; mos-1096 bwrap-userns-restrict from the pinned deb, dpkg-statoverride root:mosaic 0750, P9 accepted by Mos; gosalyn-0046 two units and args file; managed settings for DISABLE_AUTOUPDATER; sage-1481 C2-13a	2026-10-20 16:08:53 -05:00
jason.woltje	9a16d7795d	agents: row 195 Case 1 install design r3 (#1693 ): Duckworth B1, one ordered .53 activate with a runner per step (case1-repin.sh, stack-release --units external with confirm and revert), stopped-store backup under $DATA/backups/stack; N1-N6; mos-1091 4a-4c with the bwrap AppArmor profile; gosalyn-0034 C2-13 items	2026-10-20 15:56:54 -05:00
jason.woltje	818b79696d	agents: row 195 Case 1 install design r2 (#1693 , brief blob `45be7f09af`, Sage rulings sage-1451)	2026-10-20 15:38:55 -05:00
jason.woltje	088087ac96	queue: revs 2248-2361+. Sage: rows 210 (#424 host access, Gizmoduck) and 211 (#426 force-push guard, Rocko) added and briefed; row 195 re-briefed to the Case 1 install on .53; review requests for 200 r1/r2 and 202; plus earlier Sage revs. Other seats' revs: Launchpad 2254, 2283-2284, 2286, 2311-2313, 2328-2329, 2344, 2347-2348 (rows 192/200); Honker 2255; Morgana 2257, 2320, 2326-2327 (row 204); Gander 2262; Herb 2265; Dewey 2268; Bushroot 2273; Megavolt 2276; Webby 2303, 2316, 2339, 2355 (row 192/200 verdicts); Gizmoduck 2304, 2318-2319 and the row 210 claim (rows 201/210); Quackerjack 2317, 2341-2342 (row 202); Duckworth 2323, 2335, 2353 (rows 201/204/202 verdicts); Darkwing 2354, 2357 (row 190 in-review)	2026-10-20 15:34:55 -05:00
jason.woltje	a0fbefd48d	plans: pre-push force-push hook and failing busy check brief (Vikunja #426 , mos-1078, mos-1083; owner Rocko, reviewer Dewey)	2026-10-20 15:31:17 -05:00
jason.woltje	f24f2cd40d	plans: row 195 brief becomes the Case 1 install on 10.1.1.53 (Q181 hosts, Q182/Q183 recorded acceptance, Q185 existing account, chained on rows 190 and C2-13; ops-01 root steps under #423 step 1; sage-1439)	2026-10-20 15:24:33 -05:00
jason.woltje	9ba31b5b3f	agents: Honker's PRD 1.7 draft r2 on refactor for the prd.approve raise (`11cb0423b`, sha256 e896746df595d1b5155130ca163fbf63b0dc38a87a8dd154af77f1a6d1328647, Duckworth approved duckworth-0039, Vikunja #420 )	2026-10-20 15:20:37 -05:00
jason.woltje	9db578ff54	plans: agent host access with sudo through the credential store brief (#1707 , Vikunja #424 , Q183/Q184, chained on row 199)	2026-10-20 15:09:59 -05:00
jason.woltje	8eb9ddd12c	plans: FED R8 brief to r4.11 (`b93f098f0`, recorded acceptance, Duckworth N1/N2, #416 date), R5 context source (sage-1419), 193a makes covers level required (duckworth-0033 N1)	2026-10-20 15:06:22 -05:00
jason.woltje	ae3c36f248	agents: Gizmoduck seat dir and roster row (FED R1 owner, #414 )	2026-10-20 14:42:15 -05:00
jason.woltje	a2af7ab495	plans: FED R1, R5, R2 and R8 briefs (#414 , r4.9 `a1daa3c07`) and row 193a-d build briefs (#1691 ); Quackerjack seat dir and roster row	2026-10-20 14:41:03 -05:00
jason.woltje	aa1bd209e3	gate-lane: row 189 gate timing table for row 197 (Herb)	2026-10-20 14:25:17 -05:00
jason.woltje	ace27dc5eb	row 189 (#1687 ): stack-release.sh activate --no-send drops the Console's --send (Sage; Dewey approve 29485; Sage gate passed)	2026-10-20 14:21:56 -05:00
jason.woltje	a4a42dbac2	plans: stack-release --sso brief (#1698 , Launchpad, reviewer Webby, row 192 F3; chained on 192)	2026-10-20 14:18:08 -05:00
jason.woltje	a31f1a0f8b	plans: row 198 brief records Mos's call, in-process board reads behind the Console's auth (mos-1019)	2026-10-20 14:17:03 -05:00
jason.woltje	992650232f	plans: agent credentials and git identity brief (MVP T1 item 6, #1697 , Megavolt, reviewer Duckworth); Megavolt seat dir	2026-10-20 14:14:33 -05:00
jason.woltje	a7661ada06	plans: row 195 acceptance script takes Gizmoduck's gate item list; B8 issuer and TLS front end (mos-1011)	2026-10-20 14:12:19 -05:00
jason.woltje	f871cb3096	plans: retire the control board writer on 7331 brief (#1696 , Bushroot, reviewer Webby, mos-1008 item 2); Bushroot seat dir	2026-10-20 14:11:21 -05:00
jason.woltje	0bbd23c619	plans: row 195 brief adds the identity provider check and flags any new model account for Jason (mos-1008)	2026-10-20 14:10:28 -05:00
jason.woltje	0217b71c8f	plans: row 195 brief rewritten as the hub on its own host, host left to Jason (#1693 , mos-0998, mos-1005)	2026-10-20 14:07:57 -05:00
jason.woltje	c6f528a32f	plans: second gate lane brief (#1695 , Herb, reviewer Webby, mos-0977 item 6); Herb seat dir; gate template and busy check copies for the row	2026-10-20 14:03:36 -05:00
jason.woltje	96f243fafc	plans: human boundary row brief (P19 333, #1694 , Gander, reviewer Duckworth, mos-0989); Gander seat dir; seat READMEs name the credentials row, not row 195 (now 190b)	2026-10-20 14:00:58 -05:00
jason.woltje	c862699352	sessions: Filbert row 190 design review r3, approved	2026-10-20 14:00:05 -05:00
jason.woltje	48ebee0ffe	plans: row 190 brief scopes isolation to addressing on one uid, points to row 190b (Filbert N7, mos-0986)	2026-10-20 13:58:07 -05:00
jason.woltje	66bdd84b8f	sessions: Filbert row 190 design review r2, changes requested	2026-10-20 13:57:10 -05:00
jason.woltje	6966164f0c	plans: row 190b brief, Melanie's hub under its own Linux user (#1693 , Darkwing, reviewer Duckworth), mos-0986	2026-10-20 13:56:34 -05:00
jason.woltje	53bb594621	sage: common start for MVP T1 builder seats (mos-0974, mos-0977, mos-0981)	2026-10-20 13:55:47 -05:00
jason.woltje	5e01c36833	agents: seat dirs and roster rows for Launchpad, Morgana, Honker (Sage's T1 builders) and Webby, Duckworth (Mos's reviewers); row 193 brief takes Mos's B1 starting rule (mos-0985)	2026-10-20 13:52:28 -05:00
jason.woltje	9f56d2098d	plans: rows 192 and 194 review by Webby, not Filbert or Dewey (mos-0981)	2026-10-20 13:51:25 -05:00
jason.woltje	0599b119f4	plans: MVP T1 briefs, SSO phase 1 (#1690 , Launchpad), human users (#1691 , Morgana), agent lifecycle (#1692 , Honker), mos-0974/0977	2026-10-20 13:49:15 -05:00
jason.woltje	b416d2ede9	sage: Q175 SSO design, Mos C1 condition (mos-0977): straggler check before Jason step 4 in the phase 2 window	2026-10-20 13:49:15 -05:00
jason.woltje	5fc73a729c	revs 2237-2247: row 189 added, briefed, started, in-review round 1 (Dewey, comment 29457); rows 190 (Darkwing) and 191 (Rocko) added and briefed for MVP T1 (mos-0974); darkwing-190-start (rev 2245, Darkwing's) and rocko-191-start (rev 2244, made for Rocko)	2026-10-20 13:47:51 -05:00
jason.woltje	99772421ab	sage: row 189 candidate manifest for Dewey's review (`d6116771f`)	2026-10-20 13:46:35 -05:00
jason.woltje	da230ca489	plans: MVP T1 briefs, several instances per host (#1688 , Darkwing) and the kill switch (#1689 , Rocko), mos-0974	2026-10-20 13:42:33 -05:00
jason.woltje	4f2d1be68a	sessions: Filbert Q175 SSO design D1/D2 ack	2026-10-20 13:41:20 -05:00
jason.woltje	d55d86bb04	sage: Q175 SSO design r3 fix, Filbert r3 D1 (loader checks slot shape only) and D2 (slot from config dir, scratch Console dataRoot and unreachable issuer)	2026-10-20 13:40:49 -05:00
jason.woltje	c56ccf916e	sessions: Filbert Q175 SSO design review r3, approve with D1	2026-10-20 13:40:20 -05:00
jason.woltje	817e8f51b0	sage: Q175 SSO design r3 for #412 , Filbert r2 C1 (shared loader, config.json inside the phase 2 window, rollback order, test 25) and C2 (401 signed-out page, test 24), notes and Q-E	2026-10-20 13:39:21 -05:00
jason.woltje	5d019d8768	sessions: Filbert Q175 SSO design review r2, changes	2026-10-20 13:34:53 -05:00
jason.woltje	59475fc5a8	sage: row 163 landing record, P19 comments 372/373 on 337/412, and P19 #413 filed for the --no-send row	2026-10-20 13:32:55 -05:00
jason.woltje	1a268249e6	sage: Q175 SSO design r2 for #412 , Filbert r1 B1-B6, rulings Q-B/Q-C/Q-D, config in config.json (mos-0973)	2026-10-20 13:32:26 -05:00
jason.woltje	def2e79327	plans: brief for stack-release activate --no-send (Q175 interim, mos-0972/0973, #1687 , P19 413)	2026-10-20 13:21:30 -05:00
jason.woltje	c30b36fffb	sessions: Filbert Q175 SSO design review r1, changes	2026-10-20 13:19:06 -05:00
jason.woltje	9ae8c73acb	queue: revs 2235-2236: row 163 Sage landing note (`8ecc7a239`, patch-id b8d5f8a37c24, gate passed on `eaa0f2666`) and done	2026-10-20 13:18:46 -05:00
jason.woltje	8ecc7a239d	row 163 (#1660 ): stack-release.sh rehearse, the D2 rehearsal on a scratch root from a backup, and bus start --no-launch (Sage; Filbert approve 29447; Sage gate passed)	2026-10-20 13:17:07 -05:00
jason.woltje	7f57419b38	sage: Q175 SSO design for #412 , OIDC relying party on oauth4webapi 3.8.8, for Filbert review (mos-0970, mos-0971)	2026-10-20 13:13:38 -05:00
jason.woltje	4ca8d6e949	sage: row 42 run log, S7 reachability pass (51cebff7 answered by cff1e9ad after a chief launch, mos-0969)	2026-10-20 12:54:16 -05:00
jason.woltje	22e5e825b0	sage: row 42 run log, plain mosaic on a pinned host supersedes the 10-12 full-path line (mos-0968)	2026-10-20 12:48:53 -05:00
jason.woltje	e6dea74b22	sessions: Sage row 163 r2 approval intake; P19 337 comment 368 script and record	2026-10-20 10:42:00 -05:00
jason.woltje	cd2b377bbf	queue: rev 2234: row 163 r2 approve from Filbert (op filbert-163-r2, comment 29447, candidate c6f4f4c12596)	2026-10-20 10:41:33 -05:00
jason.woltje	ceccb0ef26	sessions: Filbert row 163 r2 review, approve	2026-10-20 10:40:36 -05:00
jason.woltje	10ab8ea624	sessions: Sage row 163 r2 in-review; P19 337 comment 367 script and record	2026-10-20 10:26:33 -05:00
jason.woltje	c539995cf4	queue: revs 2231-2233: row 163 r2 in-review from Sage (ops sage-163-r2-start, sage-163-inreview-2, .outcome; request comment 29446, reviewer Filbert, manifest c6f4f4c12596)	2026-10-20 10:26:02 -05:00
jason.woltje	92cc6011c8	queue: rev 2230: row 163 r1 changes from Filbert (op filbert-163-r1, comment 29445, candidate 430212299beb)	2026-10-20 10:23:12 -05:00
jason.woltje	7af1665748	sage: row 163 r2 packet (candidate `2c090eefd` on code `2a5f3a3a0`, base `4f02486d5`: diff, manifest c6f4f4c12596, gate passed, mutants K34-K41 killed)	2026-10-20 10:22:02 -05:00
jason.woltje	2244e8bafc	sessions: Filbert row 163 r1 review, changes	2026-10-20 10:06:03 -05:00
jason.woltje	bde0fdec9f	sessions: Sage row 163 r1 in-review; P19 337 comment 366 script and record	2026-10-20 09:49:45 -05:00
jason.woltje	def677bc76	queue: revs 2228-2229: row 163 r1 in-review from Sage (ops sage-163-inreview-1, .outcome; request comment 29444, reviewer Filbert, manifest 430212299beb)	2026-10-20 09:49:08 -05:00
jason.woltje	51f67f1f87	sage: row 163 packet (candidate `4be3f6aec` on `580500699`: diff, manifest 430212299beb, gate passed, mutants K1-K33 killed after four survivors got tests)	2026-10-20 09:44:55 -05:00
jason.woltje	5b298bd00b	sessions: Dewey row 66 r1 (changes) and r2 (approve) reviews	2026-10-20 09:12:15 -05:00
jason.woltje	565bc32c2f	queue: revs 2223-2227: row 66 r2 round from Sage (2223-2225, ops sage-r66-r2-start, sage-r66-inreview-2); r2 verdicts from Filbert (2226, op filbert-66-r2, approve) and Dewey (2227, op dewey-66-r2, approve)	2026-10-20 09:12:10 -05:00
jason.woltje	5140aa9e88	sessions: Filbert row 66 r2 review, approve	2026-10-20 08:56:35 -05:00
jason.woltje	973cb5a872	queue: revs 2220-2222: row 163 Sage start (2220); row 66 r1 verdicts from Filbert (2221, op filbert-66-r1) and Dewey (2222, op dewey-66-r1)	2026-10-20 08:50:44 -05:00
jason.woltje	b82ec93536	sage: row 66 r2 packet (candidate `0f4a57956`: diff, manifest cee63e06fdea, gate, mutants K1-K4 killed, singles rerun)	2026-10-20 08:49:55 -05:00
jason.woltje	3560c450a6	sessions: Filbert row 66 r1 review, changes	2026-10-20 08:18:38 -05:00
jason.woltje	4f02486d56	sage: row 66 r1 packet (candidate `8ec03b45a`: diff, manifest e68c6bce5ec4, gate r2), row 42 run log (trigger (a), mos-0960), SESSIONS line	2026-10-20 08:14:25 -05:00
jason.woltje	263ea8a9a3	queue: revs 2215-2219: row 66 Sage start (2215), in-review round 1 on candidate manifest e68c6bce5ec4 (`8ec03b45a`) and request comment 29437 (2216-2217); row 163 brief re-pinned to `b1500d96ad` (`6020bb43a`) and briefed (2218-2219)	2026-10-20 08:14:11 -05:00
jason.woltje	6020bb43ac	plans: D2 brief owner is sage (row 163, #1660 ), and D2 lands after the Part B window (mos-0958, mos-0959)	2026-10-20 08:12:39 -05:00