docs: append the candidate's BUILD-LOG.md and SESSIONS.md lines at the current file ends (replay of faf55618e; those logs were excluded from the per-commit replay because their tails moved on refactor)

BUILD-LOG.md

@@ -5412,8 +5412,14 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 
 2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
 
-2026-10-23 | Violet row297 #1803, Q245/mos-1498 | Before: no GitHub grant method or Q-B3 answer; row198 unverified. Recovery: read brief, AGENTS, roster, row198 BUILD, #436b r5 1be535aca and Gitea implementation. Merged 14fe7513c then 4d8123b0a without rewriting upstream commits, both Untested. Q-B3 proposal in agents/violet/work/queue-297/DESIGN.md agrees S1/S2/S3/S5/S6 and proposes per-method S4 with bounded token expiry; repository identity and renewal consumer scope go to Sage before implementation. No node/tests/build/live credential operation. Gate and landing remain Sage's, after row198.
+2026-10-23 | Gladstone | Gitea #1816 / Vikunja 614 hostcheck item 5 and bundle verification | Before: dpkg's correct 750 form falsely fails item 5, and two run-sheet bundle verifies require a missing repository. Draft after: exact root/mosaic/path with octal 0750 equivalence; stat/output unchanged; both verifies use cleaned-up bare scratch repos. Three additive-only test blocks, two planned mutants. Untested under Sage-3738; Sage-3740 authorizes untested branch push for static review. Queue row pending; Sage owns gate and landing.
 
-2026-10-23 | Violet row297 #1803, implementation candidate (UNTESTED) | After Q-B3 reads (dewey-0931, megavolt-0206) and scope sage-3620: protected GitHub App admin/HTTPS/JWT boundary, event-backed durable grants, guarded renewal, token generations, expiry/revoke/recovery, broker/runtime/CLI wiring, additive role/project binding parsing and documentation. All new tests use fake HTTPS/scratch CA/RSA keys; no node or tests run under Sage hold. Old-test delta only packages/business/tests/role.test.mjs:209 1/1 regex, Mos mos-1518; new closed-service-list test preserves its former claim. Consumer/publication gap is explicit in BUILD and README. Static git diff --check only; suites, mutants, manifest approval and gate remain outstanding. Row198 ab6417475 announced as next merge base, still untested.
+2026-10-23 | Gladstone | #1816 / Vikunja 614 scope amendment mos-1534, sage-3741 | F1 narrowed to exact 750/0750 and single spaces; F3 allows @ in absolute unit paths with unsafe-character refusals retained; F4 moves copy_tree to / after path resolution. AS_USER audit found git -C and stack-release's existing checkout cd cover the other steps. Added new unit and unreadable-cwd copy tests only. Untested under Sage's no-Node hold; no live action.
 
-2026-10-23 | Violet row297 #1803 static review dewey-0944/0946 follow-up (UNTESTED) | Before: no per-path digest packet and lifecycle-delete test stopped after first revoke job. After: second-request completion asserted; expiry sweep removes expired generation files without removing durable grants; installation-token fallback removed; manual run validates before lookup; official API-version source and admin-remove/event-scan limits documented. Three added mutant killers cover DELETE 401, uncertain 0/5xx mint and shutdown signal veto. Digest file will pin the 24 reviewed git blobs and its own SHA will be reported separately. No Node/tests/mutants run; static diff only, Sage CLEAR still required. Landing must retain the seat's BUILD-LOG and SESSIONS appends alongside refactor's.
+2026-10-23 | Gladstone | #1816 / Vikunja 614 F5 draft (mos-1536) | Before: the run sheet omits the explicit notify decision and precheck misses a bus-start refusal. After: section 9a creates a private null-binding decision as mosaic; precheck directly reuses readNotifyConfig and private_dir, and new tests cover accepted and refused decisions. Existing fixture setup additions await Mos approval through Sage; installer unchanged. Untested under no-Node hold.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 fixture ruling mos-1537 | Added only three setup lines each to host(t)/world(t) for the explicit null notifier decision. Existing assertions/fakes/lines intact. New install test checks decision bytes/mode preserved and missing decision remains absent. F5 missing-file fault removes the setup file. Untested under Sage's hold; separate follow-up atop 33950cf9b.
+
+2026-10-23 | Gladstone | #1816 / Vikunja 614 F6 and notify parent (mos-1537) | Before: the run sheet's copy check lacks its required CLI wrapper; mkdir -p -m does not guarantee the notify parent mode. After: a separately Mos-gated wrapper --create step follows install and precedes check, as mosaic from cwd /; section 9a explicitly creates both notify directories at 0700. Docs only, no live action; Node/tests still held.
+
+2026-10-23 | Gladstone | Row320 / #1816 first review CHANGES (morgana-0217) | Reviewer run: hostcheck19/19, unit47/47, install24/24, copy17/18; seven of eight mutants killed, M4 survived because both base/mutant failed only cleanup. Fixed this row's F4 test to enter cwd then chmod000, assert no read/search, pass an absolute outside bundle, and restore0700 in finally. Existing tests/setup and production scripts unchanged. Correction untested locally pending Morgana's focused rerun; no acceptance claim.

agents/beakley/README.md

@@ -0,0 +1,8 @@
+# Beakley
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 217 (C2-06, handed over from Launchpad).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 88b97f65) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `beakley/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/boyd/README.md

@@ -0,0 +1,8 @@
+# Boyd
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 298 (the chief-of-staff grant scope, handed over from Megavolt).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 48a3ae38) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `boyd/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/bubba/README.md

@@ -0,0 +1,8 @@
+# Bubba
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 288 (agent write notices and library revert, handed over from Honker).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 3d6672b5) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `bubba/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/bushroot/work/queue-198/BUILD.md

@@ -1,509 +0,0 @@
-# Row 198 build: retire the board writer on 7331; the Console serves the board in-process
-
-Branch `bushroot/row198-r3`, rebased onto `aca16404c` (queue revs 3195-3216 on refactor). Supersedes
-`bushroot/row198-r2` (base b79ad5f2c), which is kept and not force-pushed.
-Issue #1495 family, Gitea #1696. Ruling source: Sage sage-2821 answering Webby webby-0150
-(CHANGES B1-B5, N1-N3); earlier Q220 ruling sage-2803 (Mos mos-1301), reviewer Webby.
-
-## Status: UNVERIFIED
-
-No test suite, mutant, or node process has run for this commit. Sage's gate (sage-2803, sage-2821):
-"no node of any kind and no https git; no test runs until my CLEAR." This commit is local.
-It must not be pushed until the gate runs green and Sage opens a gap for the push.
-
-## Ruled: `--board` is dropped for every op (Sage sage-2834 ruling a, sage-2837)
-
-Design item 8's "keep the flag where the target parses it" part is withdrawn. `webui-service.sh
-install` has no `--board` branch (exit 4), and `c3b60e513` removed the flag from its parse_flags,
-so a kept flag fails at install-console. `install_stack` (stack-release.sh:565) runs that install on
-activate as well as rollback, so a re-pin to a pre-198 copy has the same failure. sage-2837 makes
-the rule per target, not per op.
-
-Code: `console_for_target` drops every `--board` pair from `BASE_CONSOLE`, for any op. The reason
-follows the target's `cli.mjs`:
-- `parses_flag` true (pre-198 target): `drop --board <url>; the 7331 board is retired, so this
-  Console runs without the board`.
-- `parses_flag` false (post-198 target): `drop --board <url>; the target Console does not parse it,
-  so the board runs in the Console`.
-`DROP_BOARD_WHY` carries the reason to both print sites (plan and steps).
-
-Tests: M12 unchanged (post-198 target, activate --plan). M13 now covers a kept `--board` for a target
-that parses it, on both `activate --plan` to a pre-198 copy and `rollback --plan`. Each asserts the
-drop line with the retired-board reason and no `--board` on the `Console:` install line, and that the
-plan leaves state unchanged. The README rollback note covers any move to a pre-198 copy.
-
-## What changed in the source
-
-- `scripts/stack-release.sh` (B2, design item 8): `console_for_target` drops a `--board` pair from
-  `BASE_CONSOLE` unless the target's `cli.mjs` parses `--board`. `parses_flag` matches
-  `flag === '--board'` and ignores lines that contain `throw` (N2: the target names `--board` only
-  in a refusal). A dropped pair sets `DROP_BOARD` and `DROP_BOARD_WHY` (reason by target, see the
-  Ruled section), printed in the plan and the steps. Init at the globals. `bash -n` passes; not run.
-- `packages/control-board/src/board.mjs` (B4): `createBoard` takes `isPidAlive` and passes it to
-  `scanAsync`, so the stale-pid refusal can be tested with an injected liveness check.
-- `packages/control-board/src/cli.mjs`: `serve` throws RETIRED, exit 2 (`ConfigError` path).
-- `packages/webui/src/serve.mjs`: `/api/seen` and `/api/reply` answer 405 for a non-POST, 403
-  `{error:'read-only', sent:false}` without `--send` on the public name, 503 with no board, and
-  otherwise run the in-process board. `boardSend` answers 400 on a body that is not JSON, before
-  any board call.
-- `packages/webui/src/cli.mjs`: `--board` throws `--board retired: the board runs in the Console
-  (row 198)`. The board is built over `system.dataRoot` (`board/`, `seats/`).
-- `scripts/webui-service.sh`: the unit no longer carries `--board`; render and install refuse it.
-- `scripts/stack-copy.sh`: COPY_PATHS adds `packages/control-board/src` and `tools/tmux`.
-
-## What changed in the tests
-
-- `packages/cli/tests/stack-release.test.mjs` (B2): new block before the Row 181 section.
-  `setCli` rewrites a copy's `cli.mjs` and restores it with mode 0444 in `t.after`; `withBoard`
-  appends the flags to the pointer console.
-  - M12: `seed`, `setCli` to a refusal-only `cli.mjs`, `withBoard`, `activate --plan`. Expects the
-    drop line, no `--board` in the Console line, and no state change.
-  - M13: `setCli` to a parser, real `activate` without the flag, then the unit gets `--board` and
-    `rollback --plan`. Expects the rollback drop line with the retired-board reason and no `--board`
-    in the `Console:` install line. Activation runs without the flag because `webui-service.sh
-    install` refuses it.
-- `packages/control-board/tests/serve.test.mjs` (B4, B5): `replyBoard(f, agentSend, isPidAlive)`
-  passes `isPidAlive` through. New refusal row: a stale registration (pid 4242, `isPidAlive` false)
-  answers 409 with `/stale/`. B5: the non-numeric `--port` test is deleted, since `serve` no
-  longer takes a port.
-- `packages/webui/tests/send.test.mjs` (B4): `setup` builds an in-process board object
-  (`index`, `markSeen`, `reply`, each recording into `boardHits`); the `upstream` server is gone.
-  New case: a board write with a body that is not JSON answers 400 under `--send`, and the board
-  runs nothing.
-- `packages/control-board/tests/retired.test.mjs` (new, B3): M1 `cli.mjs` starts no server;
-  M2 no board source imports `node:http`, calls `createServer`/`.listen(`, or exports a server;
-  M9 live READMEs, AGENTS.md and `scripts/*.sh` do not tell anyone to run `control-board serve`
-  or open 127.0.0.1:7331, except a line that says it is retired. Append-only logs and plans are
-  not scanned. Grep check on the current tree: no hits.
-- `packages/control-board/tests/board.test.mjs` (B3): new test, M15. After a write, `index()` must
-  start a fresh scan. The event log must read `write, bump, scan, scan`, and the answer must show
-  the mark.
-- The reply join killer (B3, M16) lives in `packages/control-board/tests/serve.test.mjs`, not
-  `board.test.mjs`. `reply()` refuses an unregistered row before any send, so the killer needs a
-  registered fixture (`replyFixture`), which `serve.test.mjs` already builds.
-- `packages/webui/tests/board-inprocess.test.mjs` (new, B3): M6 and M7 (preview: each board route
-  answers 401 without the proxy header and 403 with a foreign Host, and the board never runs);
-  M5 (`/api/seen` without `--send` writes no `seen.json`); M10 (positive control: with `--send` on
-  the public name, `/api/seen` writes the mark and `/api/reply` runs exec once); M3 (a board read
-  makes no request to a URL other than the Console's own); M14 (a real board over a 1 s tmux shim:
-  the loop never stalls and `/healthz` answers while `/api/board` is pending).
-- `packages/webui/tests/pinned-copy.test.mjs` (B3, M11): the existing "serve runs from a copy"
-  test also asserts `/api/board` answers 200 with a `sessions` array from the copy.
-
-## Dropped coverage (B4), with reasons
-
-- Stale-pid reply case. Not dropped: moved. It runs against `createBoard` with the new
-  `isPidAlive` passthrough (`serve.test.mjs`, the 409 `/stale/` row).
-- Bad-JSON request case. Moved to `packages/webui/tests/send.test.mjs`. The HTTP writer is gone;
-  body parsing now happens in the Console's `boardSend`.
-- `page.html` tests. Dropped: the page is deleted, and the Console serves the board page.
-- Tester board-proxy tests. Dropped: there is no proxy. The tester socket is built with the
-  in-process board (N1 below).
-
-## Corrections to r2 (N1)
-
-The r2 note said the tester socket gets `board: null`. That was wrong. Only
-`packages/webui/tests/proof.test.mjs` passes `board: null`. `cli.mjs` passes the in-process board
-to `startTesterSocket`.
-
-## Mutant map (M1-M15, design rev 5)
-
-Each mutant runs on a scratch copy with the new tests. Not run yet.
-
-| # | Mutant | Killer |
-|---|---|---|
-| M1 | `cli.mjs serve` starts a server | `retired.test.mjs` M1; also `board.test.mjs` "cli serve refuses" |
-| M2 | serve source restores or exports `createServer`/`startServer` | `retired.test.mjs` M2 |
-| M3 | Console proxy fetch to a board URL returns | `board-inprocess.test.mjs` "makes no request to a board URL" |
-| M4 | `/api/reply` skips the `send` check | `webui serve.test.mjs` "writes refused without --send" (existing; zero captures) |
-| M5 | `/api/seen` skips the `send` check | `board-inprocess.test.mjs` "writes no mark"; `serve.test.mjs` as M4 |
-| M6 | board block runs before the preview and header gate | `board-inprocess.test.mjs` preview 401 |
-| M7 | board route accepts a foreign Host | `board-inprocess.test.mjs` preview 403 |
-| M8 | `webui-service.sh` re-accepts `--board` | `service.test.mjs` render refusal list (status 1) |
-| M9 | live doc or script tells people to run `control-board serve` | `retired.test.mjs` M9 |
-| M10 | `/api/reply` and `/api/seen` branches move below the read-only refusal | `board-inprocess.test.mjs` positive control (200, exec once) |
-| M11 | `COPY_PATHS` drops `packages/control-board/src` or `tools/tmux` | `pinned-copy.test.mjs` "serve runs from a copy": `/api/board` 200 |
-| M12 | `console_for_target` keeps `--board` for a target that does not parse it | `stack-release.test.mjs` M12 |
-| M13 | a recorded `--board` is kept for a target that parses it (activate or rollback) | `stack-release.test.mjs` M13 (activate and rollback): plan drop line, then a real run: drop line in the output (rollback: steps.log), no `--board` in the unit or pointer |
-| M14 | a board read blocks the loop: `tmuxInspectAsync` in `scan.mjs` swapped for `tmuxInspect` (spawnSync) | `board-inprocess.test.mjs` M14: real `createBoard`, tmux shim on PATH sleeps 1 s; the timer gap while `/api/board` is pending and `/healthz` elapsed time |
-| M15 | `index()` joins a scan that started before the last write | `board.test.mjs` M15 (event log) |
-| M16 | `reply()` drops the counter bump: `writes++` at `board.mjs:61` (the event at line 62 is a second mutant, caught by the event log) | `serve.test.mjs` M16: event log `["scan","scan","send","bump","scan"]`, then the next `index()` must log `scan` |
-| M17 | `index()` never clears a settled scan: the `promise.then(clear, clear)` line in `board.mjs` `index()` is dropped (Webby B4, r3) | `board.test.mjs` B4: two `index()` calls with no write log `["scan","scan"]` and the second shows a session line appended between them; `board.test.mjs` B4 rejected scan: the next `index()` runs fresh. M15 and M16 still pass after the clear, so they do not kill M17 |
-
-### M14: closed by the real-board test (Sage sage-2839, Webby N1)
-
-The earlier gap came from a stub board: a `spawnSync` in `scan.mjs` never ran under the test. The
-M14 test now builds a real `createBoard` whose tmux check runs through a shim on PATH. The shim is
-`#!/bin/sh`, `sleep 1`, `exit 1`. The test measures two things, both by elapsed time:
-- a 10 ms timer's largest gap while `/api/board` is pending (a blocked loop stalls the timer);
-- `/healthz` elapsed time, fetched after `/api/board` is sent.
-The bound is 500 ms for each. The async path (`runAsync`) keeps both near 10 ms. The M14 mutant
-(`tmuxInspectAsync` calls `spawnSync`) stalls the loop for the shim's full second, so both checks
-fail. The real-board test is not run yet (gate). Known soft spots, to check on the first run: the
-shim must win the PATH lookup, and the `specs` entry is minimal (no registration), which may not
-match a real spec.
-
-## Checks done without running anything
-
-- Read whole: `packages/webui/tests/fixture.mjs`, `packages/webui/tests/send.test.mjs` (first
-  70 lines), `packages/webui/tests/serve.test.mjs` (first 80 lines), `packages/control-board/
-  tests/board.test.mjs`, `packages/control-board/src/board.mjs`, `packages/webui/tests/pinned-copy.test.mjs`
-  (the serve-from-copy test).
-- Grep, current tree: `--board` and `boardURL` in `packages/*/tests` and `scripts/test-*.sh`
-  show only intended refusals and the unrelated case2 suite (`case2-unit.test.mjs`, `case2-unit.sh`).
-- The M9 and M2 rules run as greps over the live docs and `packages/control-board/src`: no hits.
-- sha256 pins: no changed file pins a file sha256. The 64-hex literal at `service.test.mjs:23` is
-  a fixture uid, not a hash.
-- `packages/webui/tests/library-cli.test.mjs:16`: a fake serve module exports `DEFAULT_BOARD`.
-  Harmless; may be dropped later.
-
-## Docs (N2)
-
-- `packages/webui/README.md`: the start block is one command (`node packages/webui/src/cli.mjs
-  serve`); `--board` is refused; the proxy-origin sentence is gone; the Host and write paragraph
-  says seen and reply reach the in-process board under `--send` on the public name; rollback has
-  no 7331 step.
-- `packages/control-board/README.md`: `serve` is retired and exits 2; the board runs in the
-  Console; `scan` is kept; the serve-only flags are removed; the route list is marked as served by
-  the Console; exit 0 is scan only.
-- `docs/plans/CURRENT.md`: one dated line appended at the end (append-only).
-
-Open, ruled sage-2868: boardSend's `/api/seen` catch returns 400 for a scan failure after writeMark. Left as built: a scan failure is not a client error, so this is a real gap. Named follow-up in Sage's post-253 DEFERRED sweep (N2).
-
-Still in the README, on purpose: `packages/webui/README.md` line 826 runs the control-board suite
-(`node --test packages/control-board/tests/`). The suite still exists, so the line stays.
-
-## Gate, not run
-
-- control-board, webui and cli suites; `scripts/test-*.sh`; the mutants M1-M15 on a scratch copy.
-  All wait for Sage's CLEAR.
-- The per-target drop (sage-2834 ruling a, sage-2837) is implemented and documented; M13 has its
-  expectation for activate and rollback. Pushed at 2a758a5ba (sage-2852 gap, 17:20Z).
-- Webby webby-0152/0153 and Sage sage-2839, after 2a758a5ba: B1 and N3 met at 2a758a5ba. B2 (real
-  activate and rollback runs, unit and pointer checked), B3 and M16 (reply() join), N1 and M14 (real
-  board over a tmux shim) are written and uncommitted; the test runs wait for the CLEAR.
-- N2 is open, not changed: `boardSend`'s `/api/seen` catch answers 400 with `err.message` for a scan
-  that fails after the mark is written. Webby marked it non-blocking; Sage has not ruled on it. A
-  500 for that case would need `ConfigError` to tell refusals from scan failures.
-- M14: Sage accepted the gap as recorded (sage-2834). The mutant run is the check.
-- Push: not done. Sage's gaps govern it.
-
-## r4: rebase onto 45dca69f6 (sage-3575 step 1, sage-3586 ruling a)
-
-Branch `bushroot/row198-r4-45dca69f6`: the eight r3 commits replayed on `origin/refactor` 45dca69f6.
-`bushroot/row198-r3-253` stays at 1fb66792e and is not touched. Seven commits replayed clean. Only the
-retire commit (0bde5c8d7, now 4288b7b16) conflicted, in three files and seven hunks.
-
-Ruling applied: every upstream feature stays (federation view, decisionWrite, userOptions, the
-`/api/config` fields, granted-user gating). The board runs in-process. The URL proxy to a board origin is
-removed, because the proxy is the route to the 7331 writer that row 198 retires. This is the one place an
-upstream behaviour changes. Board routes now answer from the in-process board with the same response
-shapes. A granted user still gets `owner-only` 403 on board routes, because the granted-user gate runs before
-them.
-
-### Conflict hunks
-
-Each hunk: upstream side, our side, resolution, reason.
-
-1. `packages/webui/src/serve.mjs`, `startServer` signature. Upstream: `board = DEFAULT_BOARD`, with
-   `decisionWrite`, `userOptions`, `federation`. Ours: `board = null`, none of the three. Resolved: upstream
-   signature with `board = null`, and our doc comment above it. Reason: keeps upstream's parameters; no board
-   is now the default, not port 7331.
-2. `packages/webui/src/serve.mjs`, body after the tester checks. Upstream: decision check, `confirmations`,
-   `const upstream = boardURL(board)`, `userOptions` check, `owner` with `upstream`, `hub`. Ours: nothing.
-   Resolved: upstream minus `const upstream = boardURL(board);`; `owner` drops `upstream`. Reason:
-   `boardURL` is the proxy's loopback validator; there is no proxy. The `let {...}` destructure and the
-   granted-user `upstream = null` line lose the same name.
-3. `packages/webui/src/serve.mjs`, the board proxy block (`allowed`, `fetch(upstream + path ...)`, 502 on
-   failure). Upstream: the proxy, after the read-only gate. Ours: nothing here; in-process routes sit at two
-   points. Writes (`/api/seen`, `/api/reply`) answer 405 for a non-POST, 403 `{error:'read-only', sent:false}`
-   without `--send` and a named human, 503 with no board, then `boardSend`. Reads (`/api/board`,
-   `/api/conversations`, `/api/conversation`) answer 405 for a non-GET, 503 with no board, then
-   `consoleRead(board.index())` or `board.conversation`. Resolved: ours, upstream block removed. Reason: this
-   block is the 7331 route. Auth check order: the sign-in gate (401 for an unsigned request under `--sso`)
-   and the granted-user owner-only gate both run before the write routes and the read routes.
-4. `packages/webui/src/serve.mjs`, `/api/config`. Upstream: `board: upstream`. Ours: `board: boardLabel`.
-   Resolved: `board: granted ? null : boardLabel`, with every upstream field after it unchanged. Reason:
-   upstream sent `null` to a granted user (its `upstream` was null); `boardLabel` is `'in the Console'` for the
-   owner and `null` with no system config.
-5. `packages/webui/src/cli.mjs`, imports. Upstream: `DEFAULT_BOARD` in the `./serve.mjs` import, plus the bus
-   and console imports. Ours: `createBoard`, the two scan discovery imports, and `busCaller` again. Resolved:
-   upstream imports minus `DEFAULT_BOARD`, plus `createBoard` and `discoverRepoAgents`/`discoverFleetAgents`.
-   Reason: `DEFAULT_BOARD` no longer exists; `busCaller` was already imported by upstream.
-6. `packages/webui/src/cli.mjs`, the `startServer` call. Upstream: `board: options.board`, with
-   `federation: system?.federation ?? null`. Ours: `board`, without `federation`, `decisionWrite`,
-   `userOptions`. Resolved: upstream call with `board`. Reason: `--board` is refused at `cli.mjs:39`, so
-   `options.board` no longer exists; the new `board` is the in-process object.
-7. `packages/webui/src/public/app.js`, `/api/config` handler. Upstream: `board = config.board`, the federation
-   render, the sso line. Ours: `board = config.board || 'the Console board'`. Resolved: upstream handler with
-   our fallback label. Reason: `config.board` is `null` for a granted user and with no system config, which
-   would print `Board: null`.
-
-### Upstream tests changed to match (same commit, 4288b7b16)
-
-Upstream added tests that pass a URL board string or `f.boardURL`. Each now means "no board" (`board: null`,
-which answers the board routes 503) or the in-process fixture (`f.board`). `board: 'http://127.0.0.1:9'` and
-`board:'http://127.0.0.1:9'` became `board: null`; `f.boardURL` became `f.board` in decide-browser,
-thread-claims-browser, processing-browser and granted-user. No assertion compared the URL string. The fake
-`DEFAULT_BOARD` export strings in library-cli and thread-claims are left: they are fake module text, not board
-config.
-
-### Not ported: fake HTTP board servers (known to fail; port before the gate)
-
-These still pass a fake HTTP origin as `board`. The in-process board never calls it, so each test's
-board-route assumptions are false now. Each needs a read and a port to an in-process `board` object:
-
-- `packages/webui/tests/browser-edge.test.mjs:19` (waits for an HTTP `/api/board` request, lines 15 and 31)
-- `packages/webui/tests/preview.test.mjs:62` (fake board answers `/api/board`; line 160 asserts 200)
-- `packages/webui/tests/tester-listener.test.mjs:29` (`hits` counter on the fake board)
-- `packages/webui/tests/shell.test.mjs:111` and `:427` (fake board with unavailable, empty, one, fail, refuse modes)
-
-Also a risk, not checked: any test that reaches a board route with no `board` argument. The default moved
-from 7331 (a 502 on a dead origin) to `null` (503). A test asserting 502 there would now fail.
-
-### Range-diff
-
-`git range-diff 48e450ce8..bushroot/row198-r3-253 45dca69f6..HEAD`, markers only:
-
-    1:  0bde5c8d7 ! 1:  4288b7b16 retire the board writer on 7331 (resolved above)
-    2:  69ac924bc = 2:  aad3000fe build design item 8; killers for M1-M15; B4 drops; docs; BUILD.md
-    3:  716b46adf = 3:  77c12b554 rollback always drops --board (sage-2834 ruling a)
-    4:  0bb5f230f = 4:  c9c8badc3 drop --board for every op, reason by target (sage-2837)
-    5:  d388f47ec = 5:  f2fd6145a real-run M13 pairs, reply join killer M16, real-board M14 (sage-2839)
-    6:  02d5bd9b4 = 6:  f913d0e76 index() clears a settled scan; B4 tests and mutant M17 (webby-0157)
-    7:  25565fa97 = 7:  41b5aae3c BUILD.md places the reply join killer (B3, M16)
-    8:  1fb66792e = 8:  3c57ebb22 BUILD.md records N2 as a named follow-up (sage-2868)
-
-Seven commits are unchanged by patch-id. Only the retire commit is `!`.
-
-### Files to rerun (auto-merged or changed on rebase)
-
-The drift check found nine paths touched by both r3 and upstream. Six auto-merged and need a test rerun:
-
-- `packages/cli/tests/stack-release.test.mjs`
-- `packages/webui/README.md`
-- `packages/webui/tests/browser.test.mjs`
-- `packages/webui/tests/chat-browser.test.mjs`
-- `packages/webui/tests/chat.test.mjs`
-- `scripts/stack-release.sh`
-
-The three conflicted src files are in the hunk list above. The 21 upstream-stub test files listed above also
-need a rerun, because the drift check did not cover them: they are upstream-only changes.
-
-### Gate status
-
-UNVERIFIED. No node, no test run, and no mutant has run on r4. The gate waits for Sage's CLEAR, after 226,
-220/216 and 285 in gate order. The four fake-board tests above are known red. The rest are unknown until the
-run.
-
-## r4: the four fake-board tests ported to the in-process board (sage-3597, sage-3603)
-
-Scope: the four tests that read the retired fake HTTP board server, plus one new granted-user test. Numstat is
-against 14fe7513c, the r4 tip before this entry. Nothing in this section has been run. The gate is still
-UNVERIFIED, and the tests here were not executed (slot rule). Sage sends the list below to Mos (mos-1272).
-
-| File | +/- | What changed |
-|---|---|---|
-| `packages/webui/tests/browser-edge.test.mjs` | 14/13 | The fake server is gone. `index()` holds while `holdBoard` is set and resolves to the page's board on release. `reply()` holds in place of the `held` response and returns `{status, body}`. The 5 s "made no /api/board request" check still runs: it now watches `index()` being called. Every assertion is kept. |
-| `packages/webui/tests/preview.test.mjs` | 12/16 | `setup()` builds an in-process board that records `GET /api/board`, `POST /api/seen` and `POST /api/reply` in `boardHits`. The 401 and read-only tests keep their `boardHits` checks. The dead-board case is a board whose `index()` throws, so the answer is 502 `invalid-response`. The upstream origin is no longer in the body (see the deleted assertion below). |
-| `packages/webui/tests/tester-listener.test.mjs` | 4/4 | The first test's `hits` counter moves into an in-process `index()`. Every bus and board read still counts, and both 403 checks are unchanged. The `createServer` import is removed. |
-| `packages/webui/tests/shell.test.mjs` | 44/63 | `board()` is an in-process board. Modes: `empty`, `one`, `registered`, `fail` (throws, so 502 `invalid-response`), `unavailable` (throws `ReadError('read-failed')`, so 503). `hold()` gates `index()`. The conversation catalogue and page are sync. Changed expectations (listed below). Refusal-only steps removed (listed below). |
-| `packages/webui/tests/granted-user.test.mjs` | 32/2 | `setup()` takes `board` and `send` options, defaulting to the old `null` and `false`. New test `R6 G4b`: a granted session gets 403 `owner-only` on all five board paths with no board read, and the owner session gets 200 on each, with the read order checked. |
-
-### Changed expectations (not loosened; each is a product change, for Mos)
-
-These expectations now name the in-process contract. The message text came from the fake server before. Each one is
-an old assertion with a new value.
-
-- `shell.test.mjs` stale-data check: `/board scan failed.*Showing last known data/` is now `/invalid-response.*Showing last known data/`. A scan throw is mapped by `consoleRead` to `invalid-response` (502). Before, the fake returned 500 with the text.
-- `shell.test.mjs` unavailable check: `/board unavailable.*No board data loaded/` is now `/read-failed.*No board data loaded/`. `consoleRead` sends the code as `error`, and the page shows `err.message`, which is that code. The page shows `read-failed` now, where it showed `board unavailable` before.
-- `preview.test.mjs` dead board: the status stays 502, and `body.error` is now `invalid-response`.
-
-### Deleted assertions (proxy-only, no in-process counterpart)
-
-- `preview.test.mjs` `assert.equal(board.body.board, dead)`. The in-process board has no origin, so the body
-  can't name one. The status and the bus checks around it are kept.
-- `shell.test.mjs` the refusal block: the fake's HTTP 403 `board-refused`. `consoleRead` has no 403 code: `STATUS`
-  in `reads.mjs` maps only `not-configured`, `no-bus-host`, `queue-refused`, `read-failed`, `not-found` and
-  `invalid-request`, and any other code is 502. So the in-process board cannot refuse, and `app.js`'s
-  `err.status === 403` branch ("The board refused the read", `#board-refused`, the fail-closed drop of kept
-  rows, the inspector and the counts) has no trigger in these tests. The block that was deleted asserted every
-  one of these. The conversation refusal is deleted too: a 403 from `/api/conversation` closed the open
-  conversation, and the new step closes it with `#conv-back`.
-  This is a coverage loss, and it needs a decision. Either `reads.mjs` maps a board refusal to 403 (a product
-  change, which Mos rules on), or the refusal branch is retired. The granted-user 403 `owner-only` answer goes
-  through the same `err.status === 403` branch, so the page path is still reached by granted users. It is not
-  covered by a shell check.
-
-### Status change, dead board (Webby's question, webby-0229)
-
-A board failure used to answer by the origin's state: a dead origin was 502 with the origin named, a board 500
-was 500, and a 503 passed through. Now:
-
-- no board configured (`board` null): 503 `not-configured`;
-- a `ReadError` with a code in `STATUS`: that code's status;
-- any other throw (a scan failure): 502 `invalid-response` on `/api/board`. The 500 applies only on the
-  conversation routes (`conversation read failed`).
-
-No test under `packages/webui/tests` asserts 502 on a board path other than the preview dead-board case above.
-The grep: `usage`, `limits-route`, `routes`, `chat`, `library-status`, `thread-claims`, `send`, `bus`,
-`project-file`, `tester-listener`, `send-browser`, `instances`, `tester-cli` and `agents`. Those 502s belong to bus,
-chat, or project-file routes, which this change does not touch.
-
-### Granted-user gate (sage-3603): the test and its mutant
-
-The board is a closure that the granted rebind doesn't touch, so `userRoute` is the only gate in front of it
-for a granted session. Upstream's null-origin backstop is gone. Test `R6 G4b` pins that: the granted session gets
-403 `owner-only` on `GET /api/board`, `GET /api/conversations`, `GET /api/conversation`, `POST /api/seen` and
-`POST /api/reply`, and `reads` is still empty after those five requests. The owner session gets 200 on each, and
-`reads` shows the five calls in order.
-
-Mutant M18 (not run): in `packages/webui/src/serve.mjs`, change the granted gate
-`if (!userRoute(path, req.method)) return json(res, 403, ...)` so it passes when `path` is one of the five board
-paths. Expected: `R6 G4b` fails at the granted 403 assertion, because the granted request reaches the board and
-`reads` is not empty. Run it with the rest of the granted-user suite once Sage gives CLEAR. The kill is not yet shown.
-
-### Gate status
-
-UNVERIFIED. These four files and the granted-user test are edited but not run. The rule "commit only after suites
-are green" is not yet met, and this commit says so. The coverage loss above needs Sage's ruling before the gate.
-
-## r4 round 2: mos-1513 (B1 fix), N1 test, route helper (19:23Z 10-23)
-
-Not run. Node and browser suites wait for Sage's CLEAR.
-
-### B1: CDP interception instead of a named listener on the old files
-
-Per mos-1513, the browser tests keep the real in-process board. Each one calls `routeWrites(b, base, board)` from
-`packages/webui/tests/board-route.mjs` before it navigates. Fetch intercepts the page's `/api/config` (answered
-with the real body and `send: true`), `/api/reply` and `/api/seen`. Each write is forwarded over node http to a
-named send listener on the same board, with the preview Host, the `https://` Origin and the signed user header.
-So the server's own gate, parse and status mapping answer, and the page gets that answer back. Nothing re-implements
-`boardSend`.
-
-Shared helper, named for webby-0243: `board-route.mjs` exports `ROUTE`, `namedListener(board)`, `forward(port, path,
-body)` and `routeWrites(b, base, board)`. `namedListener` and `forward` are the same code `routeWrites` uses.
-
-### Numstat (git diff --numstat, packages/webui/tests, against 4d8123b0a)
-
-    3  1  board-held.test.mjs
-    7  2  browser-edge.test.mjs
-    6  2  browser.test.mjs
-    6  3  discord.test.mjs
-    4  2  history-return-flow.test.mjs
-    4  2  return-flow.test.mjs
-
-New files: `board-route.mjs` (helper), `board-route-map.test.mjs` (node, see below), `board-refused.test.mjs` (N1).
-
-### Line map: every removed line in the six old tests
-
-No assertion line is changed. Every removed line is one of these, and each is listed by old line:
-
-- board-held.test.mjs: `done` teardown (adds `stopRoute()` before `b.close()`); the `routeWrites` line is added in
-  `setup`. No assertion.
-- browser-edge.test.mjs: the `await b.viewport(320); await b.navigate(...)` line is rewritten as the same two
-  statements with the `routeWrites` line added before it; the `finally` adds `stopRoute?.()`. The `board` object
-  is unchanged. `held` and `releaseBoard` are the same. No assertion.
-- browser.test.mjs: the `finally` adds `stopRoute?.()`; `routeWrites` is added before the `viewport`/`navigate`
-  line, which is byte-identical. No assertion.
-- discord.test.mjs: the `fetch(base + '/api/reply', ...)` request line becomes `namedListener` + `forward`, the
-  request setup, not the assertion; `assert.equal(reply.status, 409)` is byte-identical. The `finally` closes the
-  named listener.
-- history-return-flow.test.mjs: `let b` gains `stopRoute`; `finally` adds `stopRoute()`. No assertion.
-- return-flow.test.mjs: `let web, b` gains `stopRoute`; `routeWrites` added after `browser()`; `finally` adds
-  `stopRoute()`. No assertion.
-
-### N1 (sage-3618, mos-1506 b): the refusal block, old to new
-
-Old line numbers are in `shell.test.mjs` at 14fe7513c, the block 178-245. New line numbers are in
-`board-refused.test.mjs`. Every old assertion is restored with its text unchanged:
-
-    181 -> 74    183 -> 76    184 -> 77    185 -> 78    187 -> 80
-    188 -> 81    189 -> 82    190 -> 83    191 -> 84    192 -> 85
-    193 -> 86    194 -> 87    195 -> 88    196 -> 89    197 -> 90
-    203 -> 97    204 -> 98    205 -> 99    206 -> 100   207 -> 101
-    208 -> 102   209 -> 103   210 -> 104   211 -> 105   212 -> 106
-    215 -> 109   216 -> 110   217 -> 111   218 -> 112   220 -> 114
-    221 -> 115   227 -> 122   229 -> 124   232 -> 127   236 -> 131
-    237 -> 132   238 -> 133   239 -> 134   240 -> 135   241 -> 136
-    243 -> 138
-
-Changes in the port: the page-level 403 stub (`Fetch` on `*/api/board*` and `*/api/conversation*`) is the one
-place a page-level stub is used, per N1. The board is the in-process one with `refuse()` set. The fake-board
-data in `board()` is the old fake board's data, moved.
-
-Pinned N1 mutant (not run): in `packages/webui/public/app.js` (the `error(err)` branch that sets
-`refused = err.status === 403`), drop the `#board-refused` show and the `refused` banner. Expected:
-`board-refused.test.mjs` fails at line 80 (`banner ref`) and line 83 (`#board-refused` hidden). Run after CLEAR.
-
-### Node coverage for the real route
-
-`board-route-map.test.mjs` (new) starts the named listener on a fixture board and pins the mapping the browser
-tests now rely on: seen is 200; a delivered reply is 200 with `delivered: true`; an exit-4 reply is 200 with
-`delivered: false` and `exitCode: 4` (this is `replyWith` in control-board/src/serve.mjs, which maps a nonzero exit
-to 200, not a status code). Existing coverage cited, not duplicated: `board-inprocess.test.mjs:84-97` (seen 200 and
-reply delivered through a named listener); `send.test.mjs:114-119` (loopback Host writes 403 read-only, nothing
-reaches the board); `preview.test.mjs:185-199` (every write 403 read-only from the public name and loopback; 401
-unsigned on `/api/reply`).
-
-The discord 409 is now reached through the named listener, so `discord.test.mjs` pins the connector refusal on the
-real route.
-
-### Not done in this round
-
-- The plain-listener browser check for the reply form and Seen line with send off (the `canSend` gate in app.js).
-  The node and browser coverage for that gate is not written yet.
-- `send-browser.test.mjs:67,243` is unchanged. Webby to confirm next round.
-- Mutant M18 and the N1 mutant are not run.
-
-### Gate status
-
-UNVERIFIED. Nothing in this round is run. Waiting for Sage's CLEAR before any node or browser run.
-
-### Correction to the r4 round 2 entry above (19:24Z 10-23)
-
-- The N1 mutant's file is `packages/webui/src/public/app.js`, not `packages/webui/public/app.js`.
-- `board-refused.test.mjs` does not use the in-process board. Its `board()` is an inline stub object with a `refuse()`
-  flag; the 403 comes from a page-level Fetch stub on `*/api/board*` and `*/api/conversation*`, as the N1 ruling
-  allows. The "in-process board with refuse() set" sentence above is wrong.
-
-## r4 round 2 fixes: mos-1522 (19:40Z 10-23)
-
-Not run. Commit held locally until the suites pass (mos-1522).
-
-- B1 (discord.test.mjs:43, :50): app.js now checks `r.connector` first, then `!canSend`, then the registered-seat text, in both the inspector reply line (app.js:100) and `convForm` (app.js:200, conv-no-reply). Discord still asserts "Board replies disabled for Discord connectors" with no routeWrites added. Assert lines are unchanged.
-- B2: `conv-no-reply` with send off reads "Replies are off: this Console is read-only.", asserted in send-off-browser.test.mjs.
-- routeWrites flips only `send` to true, over the real `/api/config` answer. Nothing else in the config body is changed.
-- Mutants (not run): (a) drop `canSend &&` from `canReply` (app.js:51); (b) drop the `seenButton` guard (app.js:71). Expected: send-off-browser fails on `.reply-form` absent (a) and on `[data-seen]` absent (b).
-
-## r4 round 2 follow-up: Webby CHANGES on ab6417475 (N1, N2, B1 board-refused) (10-23 19:46Z)
-
-Not run. Gate waits for Sage's CLEAR. Commit A of the follow-up; the old-test setup is commit B, below.
-
-- N1: `routeWrites` builds the config URL with `new URL('/api/config', base)`, so a trailing-slash base no longer requests `//api/config` (which parses as host `api`). The config body now comes from one new export, `sendConfig(base)` (board-route.mjs), which `routeWrites` and `sendOnConfig` both use.
-- New export `sendOnConfig(b, base)` (board-route.mjs): Fetch answers the page's `/api/config` with send on and leaves every write alone. It is config only (mos-1524); its callers are in commit B.
-- board-refused.test.mjs: line 13 imports `sendConfig`; the Fetch pattern list adds `*/api/config` (line 59 onward); the handler answers `/api/config` with `sendConfig(base)` and returns before the refusal branch. The 403 refusal stub is unchanged. The assert that was line 122 (`#conv-form` hidden is false) is now line 128, unchanged; it sees send on.
-- N2, the "Not done" list above is out of date. Its line "the canSend check is not written" is wrong: the check is in app.js (ab6417475, mos-1522 fixes in b0c79751c). Written as of this follow-up:
-  - app.js:24 `canSend` (set from `/api/config` at app.js:482); app.js:51 `canReply` gated on `canSend`; app.js:71 `seenButton` guard.
-  - app.js:100 inspector reply line and app.js:200 `convForm` (conv-no-reply): connector first, then the read-only line, then the registered-seat line.
-  - New user-visible strings: "Replies are off: this Console is read-only." and "Seen is off: this Console is read-only.".
-  - New test files: board-route.mjs (helper), board-route-map.test.mjs (node), board-refused.test.mjs, send-off-browser.test.mjs.
-  - Mutants planned, not run: (a) drop `canSend &&` from `canReply` (app.js:51); (b) drop the `seenButton` guard (app.js:71). Both must fail in send-off-browser.test.mjs.
-
-## r4 round 2 follow-up, commit B: old-test setup for the canSend gate (Webby B1, mos-1524) (10-23 19:46Z)
-
-Not run. Setup only: no assert line changed. Approved on the mos-1522 terms (mos-1524: config-only stub, not routeWrites). Gate waits for Sage's CLEAR.
-
-Numstat for this commit (`git diff --numstat`):
-
-| file | added | removed | change |
-| --- | --- | --- | --- |
-| packages/webui/tests/relaunch.test.mjs | 2 | 1 | line 10 imports `sendOnConfig`; line 32 `await sendOnConfig(b, webURL)` after `browser()` |
-| packages/webui/tests/shell.test.mjs | 2 | 0 | line 17 imports `sendOnConfig`; line 124 `await sendOnConfig(b, base)`, first test only |
-| packages/webui/tests/sso-browser.test.mjs | 1 | 1 | line 33 page stub: `/api/config` gets `send: true` on every page; `sso: true` still only with `sso` in the URL |
-
-- relaunch.test.mjs:49 (`#reply` present, "reply eligibility unchanged") is unchanged and now sees send on. No teardown is needed: `sendOnConfig` starts no server; `b.close()` in the finally ends the Fetch domain.
-- shell.test.mjs:217 (`#conv-form` hidden is false) is unchanged and now sees send on. The five-states test (from about line 410) has no reply, Seen or conv-form assertion and is not changed.
-- sso-browser.test.mjs:91-92 (`[data-seen]` wait and click) is unchanged. Its `/api/seen` write is still answered 401 `sign-in required` by the page stub before it reaches the server, so the sign-in path is what runs. The sign-in lines and the `__signIn` list are unchanged.
-- board-refused.test.mjs:128 (`#conv-form` hidden is false) is in commit A, with its config stub; it needs no change here.
-- Totals for this commit: 5 added, 2 removed, 3 files. Assert lines changed: 0.

agents/fethry/README.md

@@ -0,0 +1,8 @@
+# Fethry
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 225 (C2-10b, handed over from Morgana).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 14f80e3c) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `fethry/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/gladstone/README.md

@@ -0,0 +1,9 @@
+# Gladstone
+
+Builder seat, Codex gpt-6.1-sol, started by Mos (mos-1531, mos-1532). Owns the Case 1/2 host fixes for the 433 P1 rerun,
+F1 to F6 (#1816, Vikunja 614).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 433058fc) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `gladstone/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/gladstone/work/queue-320/BUILD.md

@@ -0,0 +1,304 @@
+# Hostcheck item 5 and bundle verification (Gitea #1816, Vikunja 614)
+
+Queue row pending from Sage. Owner Gladstone, reviewer Morgana, gate/landing Sage.
+Base: fetched origin/refactor 93694c5185d0a7f989d2fe78fb620e44599b744e;
+branch gladstone/hostcheck-item5. Scope: mos-1531 / ops-0256, sage-3738 and sage-3740.
+
+## Before and after
+
+Ubuntu 24.04 dpkg 1.22.6ubuntu6.6 prints `root mosaic 750 /usr/bin/bwrap`.
+Item 5 compared the literal `0750`, falsely refusing a correctly configured host;
+--enforce would unload the profile, close bwrap and record DRIFT.
+The candidate accepts exactly four fields, root, mosaic, octal 0750, and $BWRAP.
+`0*750` represents all octal spellings numerically equal to 0750 without arithmetic
+conversion/overflow. Horizontal whitespace separates fields; extra fields and
+embedded newlines refuse. Owner, group and path remain exact. The stat comparison
+and existing output strings remain unchanged. Only the item 5 comment also changes.
+
+The two release-transport bundle checks previously ran outside any repository.
+Each now creates an empty bare scratch repository, verifies with git -C, and removes
+the scratch directory using an EXIT trap. A failure exits the shell before cloning
+or fetching. No other run-sheet text changes.
+
+## Tests and mutants
+
+Only packages/cli/tests/case1-hostcheck.test.mjs changes among tests, by appending
+three new test() blocks; the existing passing 0750 fake and failing fake are intact.
+The pass test exercises 750, 0750 and 000750. The enforce test checks no unload,
+chown, chmod, DRIFT or hostcheck log for 750. Refusals independently cover 755,
+0755, 4750, 75, 7500, 075, non-octal strings, other owner/group/path, missing path,
+extra fields, multiple lines, blank/empty output and a missing fixture file.
+
+| Mutant | Change | Killer | Result |
+|---|---|---|---|
+| M1 | Restore the old literal root mosaic 0750 comparison (drop 750) | new check pass test | Unrun |
+| M2 | Accept any mode while preserving owner/group/path | new refusal test | Unrun |
+
+Mutant procedure: preserve script bytes, assert one replacement, run the named
+killer alone, require failure for its intended assertion, restore in finally and
+check the original bytes/hash. Run the original targeted file again after restore.
+
+## Verification status
+
+Untested. Sage-3738 prohibits all Node until CLEAR because the joint full gate
+runs alone. Sage-3740 explicitly directs pushing this untested build for Morgana's
+static review before CLEAR. This supersedes test-first execution for this draft;
+no Node, tests, node --check, full suites or live-host operations have run.
+Queue next refused linked-worktree execution; Sage owns queue creation/movement.
+Push only gladstone/*, with MOSAIC_GITEA_CREDENTIAL_FILE unset; no amend/force.
+
+Static draft receipt: `git diff --check` passed. Test-file numstat against the
+base is `46 0 packages/cli/tests/case1-hostcheck.test.mjs` (added/deleted).
+
+## Scope and implementation amendment (mos-1534, sage-3741)
+
+F1 correction: Sage requires precisely `750` or `0750` and exactly single spaces,
+so the candidate now uses `0?750` and literal spaces. It refuses 00750/000750,
+a doubled space and a tab. This supersedes the initial numeric-equivalence design
+above. Only this row's own appended tests change; no base test line changes.
+
+F3: case2-unit.sh plain() adds @. abs_plain is its only caller and requires an
+absolute normalized path, so @ cannot become an ExecStart prefix. In sed @ is
+ordinary replacement text (the delimiter is |); &, backslash and | still refuse.
+Environment=MOSAIC_CLAUDE_BIN carries @ literally; the parser compares the complete
+value, with no shell evaluation. @anthropic-ai also cannot match the residual
+@[A-Z_]+@ token check. Tests render/reinstall with a regular executable under
+@anthropic-ai, checking Environment and the new copy's WorkingDirectory. Since a
+nonroot test cannot create root ownership, a stat fake models root:0755 only for
+that file and its ancestor chain. The real file type/executable checks, render,
+installed-unit parser, and all other stat calls remain active. A separate block
+refuses space, %, $, both quote characters, backslash, & and |.
+
+F4: copy_tree changes to / before archive/npm/find, after all its path arguments
+are absolute. copy_bundle retains its existing relative-bundle resolution before
+calling copy_tree. Checkout copies have absolute REPO and COPIES too. Source-only
+use from stack-release.sh changes no cwd because copy_tree is not called there.
+Audit of every AS_USER command in stack-upgrade.sh: fetch and merge use git -C;
+plan, gate, revert, confirm-rollback, stage (activate/rollback), confirm and rehearse
+invoke stack-release.sh, which changes to its checkout at line 34. No other
+AS_USER command needs a fix. The new test enters a directory mode 0111, verifies
+that ls cannot read it, then runs both a relative-bundle copy and checkout copy,
+asserting success, no find restore error, and an immutable completed copy.
+
+Additional mutants (unrun under the same no-Node hold):
+
+| Mutant | Change | Killer | Result |
+|---|---|---|---|
+| M3 | Drop @ from plain() | new factory scoped Claude-path test | Unrun |
+| M4 | Remove copy_tree's cd / | new unreadable-cwd copy test | Unrun |
+
+All four fixes remain untested. Follow-up is an additive commit on the pushed
+branch, per sage-3741, with no amend or force. Morgana's static F1/F2 read of
+f30c74b12 was CLEAN (morgana-0205); F3/F4 and execution remain open.
+
+Morgana N1: the outer bundle-verification failure now prints
+`STOP: bundle verify failed; do not continue` instead of exiting the interactive
+root shell. The subshell still returns failure and cleans up. This follows the
+sheet's human read-and-stop convention and avoids sending remaining pasted lines
+to a parent shell after exiting sudo -i. Inner mktemp failure still exits only the
+subshell. This supersedes the initial outer-shell failure behavior noted above.
+
+## File numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 4 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 114 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 12 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 29 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## F5 (mos-1536 / ops-0260): explicit notifier decision
+
+Before: no run-sheet step creates the required notifier decision, and precheck
+accepts a host whose bus will refuse missing notify.json. After: section 9a
+requires the mosaic user to create its business notify directory at 0700 and an
+explicit {"notifyVersion": 1, "binding": null} file at 0600 before section 10.
+The shell runs with cwd / and umask 077; noclobber refuses an existing decision.
+Named binding is explicitly a later per-host choice requiring Mos's go.
+case2-install.sh is unchanged and makes no silent default.
+
+case2-precheck.sh's existing facts helper dynamically imports readNotifyConfig
+from cli.mjs and calls it directly. File type, uid, exact 0600 mode, JSON keys,
+version and binding-name validation therefore stay identical to the bus. The
+shell checks the business notify directory with existing private_dir (same uid,
+not a symlink, exactly 0700) and prints the new notifier config line. No notifier
+is started and no configuration is written. Tests append pass cases for null and
+a valid named binding, and refusal cases for missing file, 0644, 0755 directory,
+extra key, malformed JSON, invalid binding/version and a symlinked file.
+
+M5 (unrun): remove the notifier shell check, including its refusal branch; the
+new notifier refusal test must fail. Also include Morgana's F3 negative mutant
+M3b (allow $ in plain), killed by the new unsafe-character test.
+
+Existing positive precheck tests need an explicit notify fixture. Approval
+requested via Sage in gladstone-0006/-0007 for minimal setup-only additions to
+case2-unit.test.mjs host(t) and case2-install.test.mjs world(t); assertions remain
+unchanged. Those additions are not yet applied. Correction to gladstone-0007:
+case1-accept.test.mjs also names case2-precheck.sh, but uses a stand-in; it does
+not execute the changed script and needs no fixture amendment.
+
+Execution remains held by Sage: no Node/tests run. Morgana-0207 static F1-F4
+verdict on a75532db1 is CLEAN; execution and F5 review are still open.
+
+F5 acceptance from mos-1536 (for review):
+1. Before section 10, as mosaic, explicitly create <dataRoot>/notify/<business>
+   at 0700 and notify.json at 0600 with default binding null; a later named
+   binding needs Mos's go. Do not make case2-install.sh write it.
+2. Precheck must refuse missing file, non-0600 file, directory looser than 0700
+   and a document outside the CLI's exact shape. Reuse/match cli.mjs validation,
+   and name the new line in this run-sheet step's Precheck entry.
+3. Append-only test blocks cover pass, missing, 0644, 0755 dir, extra key; record
+   a skip-check mutant, the touched test file and its numstat.
+4. F3/F4 precede F5, each follow-up commit stays on gladstone/hostcheck-item5;
+   send pushes to Sage/Morgana with Mos cc. No Node until Sage CLEAR.
+
+Static F5 draft receipt: git diff --check passed. Existing fixture approvals
+remain pending; F5's new pass test creates its own explicit decisions. No claim
+that the old positive precheck tests pass without the pending setup changes.
+
+## F5 candidate file numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 6 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 179 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 34 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 65 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## Fixture approval and separate follow-up (mos-1537)
+
+Mos approved exactly setup-only additions to case2-unit.test.mjs host(t) and
+case2-install.test.mjs world(t): each gets three added lines for a 0700
+notify/acme directory and 0600 notify.json with {"notifyVersion":1,"binding":null}.
+No existing line, fake or assertion changes or is deleted. F5's missing-file
+negative case removes the file after setup, so the new default cannot mask it.
+The newly appended install test checks preserved bytes and mode after success,
+and separately removes the decision before install and checks it stays absent.
+case1-accept.test.mjs is unchanged. This follow-up is committed separately on
+33950cf9b as directed, with no amend. No Node/tests run; suite claims remain open.
+Morgana-0211 found F5 source/run sheet CLEAN statically; the setup prerequisite B1
+is addressed by this approved fixture patch, pending execution.
+
+Additional planned mutants from Morgana-0211 (unrun): M5b drops private_dir,
+killed by the directory fault; M5c prints NOTIFY ok unconditionally, killed by
+the document faults. Existing test preservation is checked by git diff showing
+only additions (numstat below).
+
+Fixture follow-up numstat: case2-unit.test.mjs +3/-0,
+case2-install.test.mjs +18/-0. Against the original base: case1-hostcheck.test.mjs
++48/-0, case2-unit.test.mjs +68/-0, stack-copy.test.mjs +16/-0,
+case2-install.test.mjs +18/-0. git diff --check passed.
+
+## F6 and notify parent correction (mos-1537 / ops-0261)
+
+Before: install creates a copy but no human CLI wrapper; the sheet's
+stack-copy.sh check --units external therefore fails even with correct units.
+After: the sheet explicitly places a wrapper step after successful install and
+before that check. On Mos's separate live-step go, mosaic changes cwd to /,
+creates $HOME/.npm-global/bin if absent, then invokes its clone's stack-copy.sh
+wrapper <sha> --create. Existing wrappers refuse and require review; install is
+unchanged. This is documentation of a gated host action, not execution of it.
+There are no tests pinning these sheet steps to adjust.
+
+Section 9a now explicitly creates/chmods <dataRoot>/notify and then its business
+leaf, each 0700. This addresses ops-0261's observation that mkdir -p -m only
+controls the leaf. The existing umask 077 remains. All exits are inside the
+unprivileged shell, so no failure exits the operator's interactive root shell.
+
+Static receipt: git diff --check passed. No Node, tests or live action. F6 and
+this parent-directory documentation correction are a separate commit after the
+approved fixture-only 5fd2328b6 follow-up. Reviewer should retain the earlier
+F1-F5 source verdicts and inspect this delta. Queue row still pending from Sage.
+
+## F6 candidate file numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 10 | 0 |
+| `agents/gladstone/work/hostcheck-item5/BUILD.md` | 241 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 51 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-install.test.mjs` | 18 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 68 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 16 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |
+
+## F6 gate citation (sage-3747)
+
+Added scripts/stack-copy.sh:3 to the F6 wrapper step's explicit Mos-go requirement.
+This is doc-only; commands and tests are unchanged. Sage ruled the delete-after-
+setup missing-file negative meets mos-1537, so no fixture change is needed.
+Morgana-0213 found the fixture/F6 deltas CLEAN statically. No Node/tests run;
+Morgana's eventual run waits for Sage's row and CLEAR after the 220+216 landing.
+Numstat for this follow-up: host-run-sheet.md +1/-1; BUILD.md +9/-0.
+Static receipt: git diff --check passed.
+
+Correction: 0f3d874d4 added 10 BUILD.md lines, not 9; the git numstat is authoritative.
+
+## First review run and F4 test correction (morgana-0217)
+
+Morgana ran af201b4a9 (6fa47e07d only relocates this file) under her authorized
+slot with timeout -k 10 and TMPDIR under /mnt/storage/scratch/tmp. Receipts:
+/mnt/storage/scratch/morgana-g320-out/base-summary.txt and mutants-summary.txt.
+
+| Targeted file | Passed | Failed |
+|---|---:|---:|
+| case1-hostcheck.test.mjs | 19 | 0 |
+| case2-unit.test.mjs | 47 | 0 |
+| case2-install.test.mjs | 24 | 0 |
+| stack-copy.test.mjs | 17 | 1 |
+
+Seven of eight mutants were killed: M1 literal0750, M2 anymode, M3a drop@,
+M3b allow$, M5 drop shell block, M5b drop private_dir, M5c always NOTIFY ok.
+M4 drop cd / SURVIVED: base and mutant both failed only setup's cleanup hook.
+This is a test defect, not a green acceptance result. The 0111 cwd retained
+search permission and did not reproduce the inaccessible inherited cwd. It
+also blocked setup's chmod -R cleanup because the directory remained unreadable.
+
+B1 correction touches only this row's appended F4 test: the child shell enters
+an initially searchable directory, chmods it 000, checks both ! -r and ! -x, then
+execs stack-copy. The parent asserts all read/search bits remain cleared. The
+bundle now lives outside cwd and is passed absolutely, matching the real flow;
+existing row232 coverage still tests relative bundles from an accessible cwd.
+Both bundle and checkout paths remain covered.
+B2 correction: each child run/assertion sequence has a finally that restores the
+cwd to0700 before setup's existing cleanup. No old setup/test lines change.
+Production scripts are unchanged; the cd / fix remains correct by static review.
+
+Correction is untested locally: no builder Node/test CLEAR was given. Morgana
+will rerun stack-copy whole, M4 and residue cleanup on the pushed correction;
+other files need no rerun unless changed. git diff --check passed.
+
+## F4 corrected candidate numstat against 93694c518 (added / deleted)
+
+| File | Added | Deleted |
+|---|---:|---:|
+| `BUILD-LOG.md` | 12 | 0 |
+| `agents/gladstone/work/queue-320/BUILD.md` | 304 | 0 |
+| `docs/SESSIONS.md` | 1 | 0 |
+| `docs/guides/host-run-sheet.md` | 51 | 2 |
+| `packages/cli/tests/case1-hostcheck.test.mjs` | 48 | 0 |
+| `packages/cli/tests/case2-install.test.mjs` | 18 | 0 |
+| `packages/cli/tests/case2-unit.test.mjs` | 68 | 0 |
+| `packages/cli/tests/stack-copy.test.mjs` | 22 | 0 |
+| `scripts/case1-hostcheck.sh` | 2 | 2 |
+| `scripts/case2-precheck.sh` | 19 | 0 |
+| `scripts/case2-unit.sh` | 1 | 1 |
+| `scripts/stack-copy.sh` | 3 | 0 |

agents/gosalyn/work/queue-226/BUILD.md

@@ -0,0 +1,331 @@
+# Row 226 build notes, C2-13b install script and library precheck (#1727)
+
+Brief: docs/plans/2026-10-20_case2-rows.md "C2-13b install script and library precheck" (:1073-1134 at
+d37210288). Design: agents/gosalyn/work/case2/DESIGN.md r11 sections 4 and 10, on gosalyn/case2-design
+75fb3e10e. Row 195's needs: agents/darkwing/work/queue-195/DESIGN.md "What row 195 needs from row 226".
+
+This is design round d2. Nothing is built yet. d1 was f46e66883, and Webby's review of it is webby-0085
+(CHANGES, B1 and N1-N6) and webby-0086 (the ordering problem). Sage ruled on both in sage-2189. The
+changes from d1 are listed at the end.
+
+## Base
+
+Branch gosalyn/c2-13b from refactor d37210288. Rows 215, 221, 222 and 230 are done.
+
+## Facts the design rests on
+
+- No CLI writes a business file. `mosaic business validate <id>` checks one and exits 0 ok, 2 invalid
+  (packages/business/src/cli.mjs). A business file needs `human`, `arbiters`, `projects`, `tracker`
+  with a sync bot and a Vikunja credential ref, and `roles`, each role with its tracker bot when its
+  definition uses Vikunja (business.mjs:23, :84-100, :131-149).
+- The library is a project, `projects.<id>.kind === "library"`, checked by `checkMapping`
+  (packages/library/src/mapping.mjs). There is no top-level `library` key.
+- `library.sync` and `library.status` are bus verbs, human only (broker.mjs:92, :2452-2476). The only
+  client is `packages/bus/src/human-cli.mjs` over the bus socket.
+- The bus makes each library mirror at start, `ensureMirror({ business, project, dataRoot })`
+  (packages/bus/src/runtime.mjs:143-145). Before the bus first starts there is no mirror.
+- `sync()` fetches outside `withLibraryLock`. Only a per-process `running` set keeps two syncs apart
+  (packages/library/src/sync.mjs:97-98), so a second process calling `sync()` would race the bus's
+  timer.
+- `libraryStatus(context)` reads the recorded state under the flock and writes nothing
+  (mirror.mjs:232-239). A missing or unsafe mirror fails `library-git` (`ownedRoot`, mirror.mjs:43-49).
+  A mirror that has never synced returns the empty state, `lastFetch: null`, `lastError: null`,
+  `problems: []` (mirror.mjs:27, :205-210). `lastError` is `{ code, at }` with `code` matching
+  `^[a-z-]{1,64}$` (mirror.mjs:225).
+- The bus builds the library context as `{ business, project, dataRoot }` and the slot as
+  `<slotDir>/secrets/<business.id>/library-gitea` (runtime.mjs:146-151, :162-164).
+- `case2-persona-import.mjs install --staging DIR --config-dir DIR --business ID` writes
+  `<configDir>/personas/<business>/<instance>.md` at 0600 in 0700 dirs, never overwriting, and prints
+  `instance bean: persona.name Bean, persona.sha256 <hex>` per persona.
+- A Discord binding is `<dataRoot>/discord/<name>.json` (packages/discord/src/binding.mjs:70-83).
+- `case2-unit.sh --copy ID` needs `<home>/.local/share/mosaic-stack/copies/<ID>`, which
+  `stack-copy.sh copy COMMIT --copies DIR` makes. The copy runs `npm ci` from package-lock.json
+  (stack-copy.sh:70), which installs the pinned pi.
+
+## Design
+
+### D1. The business file is an input
+
+Unchanged from d1. `case2-install.sh` takes `--business-file FILE`, a JSON business document written for
+the host from Jason's go. The script doesn't build one from flags, because bots, botIds and credential
+refs are host values and the brief says every host value is an input. It checks the input, adds what
+only it knows, writes it, and then runs `mosaic business validate`, so business.mjs stays the only
+schema.
+
+What the script checks before it writes anything, beyond `validate`:
+- `id` equals `--business`.
+- `library`: at least one library project, `bus.tester` not true, roles `bean` and `chet` with
+  definition `companion`, and no `persona.*` var in the input, since D3 adds them.
+- `factory`: no library project, and `bus.tester` true. These are the precheck's rules at
+  case2-precheck.sh:127-135, so the install refuses what the precheck would refuse.
+
+### D2. Install steps, in order
+
+1. Refuse to run as root.
+2. `scripts/bootstrap.sh`. It's idempotent and never rewrites an existing config.
+3. `scripts/stack-copy.sh copy <--commit> --copies <home>/.local/share/mosaic-stack/copies`. The copy
+   `case2-unit.sh --copy` names has to exist before root renders the units (row 195 need 3).
+4. `library` only: the persona import's `install` step from `--personas DIR` (D3).
+5. Write `<configDir>/businesses/<id>.json` at 0600 with O_EXCL (D4).
+6. `library` only: make `<configDir>/secrets/<business>/` at 0700, empty. The token is Jason's, design 10
+   step 4.
+7. `mosaic business validate <id>`. If it refuses and step 5 created the file in this run, remove that
+   file, then refuse. A file that already matched on a re-run (D4) is never removed (N4).
+8. Print the copy id and the next steps: root's 2c, Jason's 2d, 3 and 4, then the `--library-status`
+   check (D6b).
+
+d1's step 3, `release.sh package` and `activate`, is gone (Q4a, webby-0085 B1, sage-2189). Package is a
+`docker compose build`, and activate runs a pi Compose health check that mounts `PI_AUTH_FILE`
+(compose.yaml:43). Neither fits 2a, which has no Docker and no pi credential, and the hub doesn't run
+containers. The pinned harness comes from the copy's `npm ci` (Q3). The `CASE2_RELEASE` seam goes with
+it.
+
+It starts no unit, writes no unit file, doesn't write `/etc/mosaic-stack/dev.args` and doesn't run
+`adopt`. These are my answers to row 195's needs 4 and 5 (gosalyn-0087), unchanged. Row 195's W8 now
+passes `--business-file` and has no release step.
+
+### D3. Personas come from the staging dir
+
+Unchanged from d1. `library` requires `--personas DIR`, the staging dir from `case2-persona-import.mjs
+stage`. The install runs `case2-persona-import.mjs install --staging DIR --config-dir <configDir>
+--business <id>` and reads its two `instance` lines into `roles.bean.vars` and `roles.chet.vars`. Only
+those two lines go into the business file. They hold a name and a digest, never text.
+
+This moves the persona import's stage part of design 10 step 6 ahead of 2b: the read of her Hermes
+profiles and Jason's check of the printed pairing. Webby agreed in webby-0085 (Q1).
+
+### D4. Re-runs
+
+Unchanged from d1, plus N4. Each step is safe to run again. bootstrap and the copy are idempotent. An
+existing business file that matches the one the script would write passes, and the script remembers it
+didn't create it. One that differs refuses `business-file-differs`, and the script doesn't touch it.
+The persona import already refuses to overwrite. On a re-run the install compares each existing
+persona file's sha256 with the staging manifest, and refuses on a mismatch.
+
+### D5. Inputs and seams
+
+```
+case2-install.sh --business ID --business-file FILE --commit SHA [--profile factory|library]
+                 [--personas DIR] [--home DIR]
+```
+
+`--home` defaults to `$HOME`, which is `/srv/mosaic` under `sudo -u mosaic -H`. `MOSAIC_CONFIG` is
+honoured as bootstrap.sh honours it. One test seam, in case2-unit.sh's `CASE2_*` pattern:
+`CASE2_STACK_COPY` is the copy script, and the test uses a stub that makes the copy dir.
+
+Exit codes: 0 ok, 1 refused, 4 usage, as case2-unit.sh uses.
+
+### D6. Precheck library checks, split in two (Q4b, sage-2189)
+
+d1 ran `sync()` from the precheck. Webby's N1 and webby-0086 showed two faults. The precheck runs before
+the units start, so there is no mirror yet (runtime.mjs:143-145). And a precheck `sync()` after the bus
+is up would race the bus's timer, since `sync()` fetches outside the lock (sync.mjs:97-98). Sage split
+the check in sage-2189, and the brief's "runs library.sync" becomes "reads the bus's recorded sync
+state".
+
+#### D6a. Before the units start, `--profile library`
+
+These run where the precheck runs today, after 2c's render and before the start. They sync nothing and
+read no mirror. Each is a `refuse` line in the script's style.
+- The business file is owned by the uid, with no group or other bit (`business-file-mode`).
+  `businesses/.history/<id>/` is 0700 and its `changes.jsonl` is 0600, when present (`history-mode`).
+- The persona dirs are 0700. Each creative role's persona file is regular, owned and 0600
+  (`persona-mode`), and its sha256 equals the role's `persona.sha256` (`persona-mismatch`). The output
+  prints names and digests, never text.
+- No `<dataRoot>/discord/*.json` exists (`discord-binding`).
+
+#### D6b. `case2-precheck.sh --business ID --library-status`, after the bus is up and after step 4
+
+A new mode, run as `<user>` once the bus is up and Jason has placed the token. It changes nothing. A
+node block builds the context the bus builds, `{ business, project, dataRoot }` for each library
+project, with `dataRoot` from the config (N3, runtime.mjs:146-151, :162-164). For each one it:
+- refuses `library-mirror-missing` when the mirror path doesn't exist. It checks this itself, so the
+  message says the bus hasn't made it, not `library-git`;
+- calls `libraryStatus(context)` only, and refuses with the thrown code when that fails, for example
+  `library-git` for an unsafe mirror or `library-sync-busy` when the flock wait runs out;
+- refuses `library-never-synced` when `lastFetch` is null;
+- refuses `library-last-error <code>` when `lastError` is not null. The code is the fixed
+  `^[a-z-]{1,64}$` string, so it's safe to print. This also covers Webby's N2;
+- prints each recorded R-problem as `problem   R<n> <path>`, with the path through `JSON.stringify`, then
+  one `problems  <count>` line (N5). Her file names are the only part that prints, never text.
+  R-problems don't refuse (Q2, agreed by Webby).
+
+The bus syncs each library with a `user` every 60 s, so the first run after step 4 may need a minute,
+or Jason's own `library.sync`. The run sheet says so.
+
+### D7. host-run-sheet.md fix
+
+`docs/guides/host-run-sheet.md:240` says "I2's install writes it" about `dev.args`. It becomes: root
+writes it at the unit render, from the values the go names, and the install never writes it, because
+`<user>` can't write `/etc` and root reads nothing `<user>` wrote. Sage asked in sage-1832 for this fix
+to go in this build commit, with its path in the manifest. Section 9's `library-gitea` line (:275) says
+"C2-13b's `library.sync` (not landed)". It becomes the `--library-status` check (D6b). The install
+section also gets a line that the copy's `npm ci` needs the npm registry from the host (Q3, webby-0085).
+
+### D8. Design 10 text
+
+Sage ruled that design 10 gets the same change when 226 lands, with the line in this row's manifest.
+In agents/gosalyn/work/case2/DESIGN.md:
+- step 2b drops `release.sh package` and `activate`;
+- a new step after step 4 runs `case2-precheck.sh --business <business> --library-status`;
+- the precheck's library text says it reads the bus's recorded sync state, not that it runs
+  `library.sync`.
+
+### D9. Tests, `packages/cli/tests/case2-install.test.mjs`
+
+These follow case2-unit.test.mjs: scratch HOME, MOSAIC_CONFIG, stub bin dir and seams, a local bare repo
+cloned `--bare --no-local` as sync.test.mjs does, and the fixture's key never in output.
+- Install `library`:
+  - writes the business file at 0600 with bean's and chet's persona vars;
+  - writes the persona files at 0600 in 0700 dirs and the empty slot dir at 0700;
+  - logs the copy call and no release call;
+  - starts nothing;
+  - passes on a re-run;
+  - refuses `business-file-differs` and leaves the file unchanged.
+- Install `factory`:
+  - writes no library mapping, no persona file and no slot dir, which is the brief's case;
+  - refuses a library project and `bus.tester` off.
+- Install refuses: run as root, a business id mismatch, missing `--personas` under library, and a
+  `validate` refusal, after which no business file is left.
+- N4: a re-run where the matching business file is already there and `validate` refuses leaves that
+  file in place, byte for byte.
+- D6a refusals, one case each: a persona file at 0644, a digest mismatch, a business file at 0644, a
+  `changes.jsonl` at 0644, and a Discord binding. A clean library host passes D6a with no mirror.
+- D6b, with the mirror made by `ensureMirror` and the state written by a real `sync()` against the local
+  bare repo, as the bus would:
+  - no mirror refuses `library-mirror-missing`;
+  - a fresh mirror refuses `library-never-synced`;
+  - a sync against a remote that doesn't resolve refuses `library-last-error` with its code;
+  - a synced bare repo with one R2 path prints its `problem` line and `problems  1`, and passes.
+
+Every new refusal gets a mutant that removes it. The count goes in the slot request.
+
+### D10. Files
+
+Owned by the brief: `scripts/case2-install.sh` (new), `scripts/case2-precheck.sh` (library checks and
+`--library-status` only) and `packages/cli/tests/case2-install.test.mjs` (new). Also
+`docs/guides/host-run-sheet.md` (D7, sage-1832), agents/gosalyn/work/case2/DESIGN.md (D8, sage-2189)
+and this BUILD.md. Before the slot request I'll grep for outside readers of case2-precheck.sh, since
+case2-unit.test.mjs runs it.
+
+## Questions
+
+All three d1 questions are settled:
+- Q1, persona stage before 2b: Webby agreed (webby-0085).
+- Q2, R-problems don't refuse: Webby agreed.
+- Q3, the pinned harness is the copy's `npm ci`: Webby agreed, and asked for the registry note in D7.
+- Q4a and Q4b: Sage, sage-2189.
+
+One choice for Webby to check: D6b's `problem` line carries the path through `JSON.stringify`. N5 asked
+for a prefix and a count. I kept the path because Jason needs it to tell her which file to fix, and the
+names are hers, not text.
+
+## Changes from d1
+
+- B1: release package and activate dropped, with the `CASE2_RELEASE` seam and its test (D2, D5).
+- N1 and webby-0086: the sync is gone from the precheck. D6 splits into D6a before the start and D6b,
+  `--library-status`, after the bus is up and step 4 (sage-2189).
+- N2: covered by D6b's `lastError` refusal.
+- N3: D6b builds the context and slot as the bus does.
+- N4: step 7 removes only a file this run created, with a test.
+- N5: `problem` prefix and a `problems` count.
+- N6: the run sheet lines are :240 and :275.
+- New D8, the design 10 text change, and its path in D10.
+
+## Build
+
+Webby approved d2 in webby-0087 (REVIEW-design-d2.md, webby/reviews 2f488b4ea). Nothing above this
+section changed after approval. This section records the build.
+
+### D8 lands on case2-design
+
+Sage ruled in sage-2195, after Webby's N1, that D8 goes on gosalyn/case2-design, because
+agents/gosalyn/work/case2/DESIGN.md isn't on refactor. The change is commit 624212842 there, pushed:
+step 2b drops `release.sh package` and `activate`, new step 4a runs `--library-status`, and the C2-13b
+row text says the precheck reads the bus's recorded sync state. DESIGN.md is not in this row's manifest.
+
+The brief's lines docs/plans/2026-10-20_case2-rows.md:1093-1096 still name release package, activate and
+a library.sync fetch. Sage owns the brief and will amend those lines to match D8 in a doc-only commit
+after the re-pin window (sage-2205). They are not in this row's manifest.
+
+### Webby's d2 notes
+
+- N2: the `problem` line keeps the path. After `JSON.stringify` the precheck also escapes DEL, the C1
+  controls U+0080-009F, U+200E and U+200F, U+2028 and U+2029, and the bidi controls U+202A-202E and
+  U+2066-2069 as `\uXXXX`. Webby named C1 and bidi. I added the rest because `JSON.stringify` leaves
+  them raw too, and each one can change how a terminal shows the line. The test path holds U+202E and
+  U+0085, and the test checks that neither prints raw.
+- N3: `lastError` is checked before `lastFetch`. A first sync with no token records
+  `library-credential-missing` and leaves `lastFetch` null, so it refuses `library-last-error`, not
+  `library-never-synced`. The fresh-mirror test has `lastError` null and refuses `library-never-synced`.
+
+### Choices made in the build
+
+- The config dir. The persona import refuses a config dir with group or other bits, and bootstrap makes
+  one with the default mode. So the install makes the config dir at 0700 when it's absent, before
+  bootstrap, and refuses `config-dir-mode` when it exists with a group or other bit. It checks
+  `secrets/` and `secrets/<id>/` the same way under library (`secrets-mode`, `slot-mode`).
+- `--home` must equal `$HOME` (`home-mismatch`). Every path comes from `$HOME` and `MOSAIC_CONFIG`, as
+  bootstrap's does, so a different `--home` would only name a second home the script doesn't use.
+- A plan step runs before anything is written. It reads the input and the staging manifest, computes
+  the persona vars from the manifest, and compares the result with what's on disk. It refuses every
+  input rule, `business-file-differs` and `persona-differs` there, so a refused run writes nothing.
+  After the import the script checks that the import's two `instance` lines carry the manifest's
+  digests.
+- A re-run with both persona files present and matching skips the import, which would refuse to
+  overwrite them. One matching file and one missing refuses `persona-differs`.
+- A diverged library prints one line under `--library-status`, naming the tip `library.sync --accept`
+  would take. It doesn't refuse. The design doesn't list it as a refusal, and the bus still serves the
+  old tip.
+- The precheck's library checks print `ok` lines for each check they pass, as the rest of the script
+  does. A business file that's missing prints no extra line, since the existing business-file check
+  already refuses it.
+- The business id must match the persona import's rule, `^[a-z0-9][a-z0-9-]{0,63}$`. That's narrower
+  than the precheck's, which also takes `.` and `_`, because the persona dir uses the id.
+
+### Outside readers
+
+`git grep` over packages/*/tests/*, packages/*/src/* and scripts/test-*.sh finds case2-precheck.sh read
+by case2-unit.test.mjs, which runs it, and case1-accept.test.mjs, which names a copy's path but runs a
+fake. No test reads host-run-sheet.md. No test pins a hash of either script. case2-unit.test.mjs's
+precheck host has a 0600 business file and no persona vars, so the new D6a checks pass there.
+
+### Mutants
+
+24, in /mnt/storage/scratch/gosalyn-r226/mutate.py. Each replaces one exact string once. Line numbers
+are the candidate's. run.sh stops with BASE RED before any mutant unless the base run is rc=0 and
+fail 0.
+
+| Mutant | Line | Check removed |
+|---|---|---|
+| I1 | install :73 | run-as-root |
+| I2 | install :74 | home-mismatch |
+| I3 | install :81 | config-dir-mode |
+| I4 | install :101 | business-id-mismatch |
+| I5 | install :107 | profile-library-business |
+| I6 | install :108 | bus-tester-off |
+| I7 | install :111 | bus-tester-on |
+| I8 | install :115 | persona-var-input |
+| I9 | install :158 | business-file-differs |
+| I10 | install :152 | persona-differs |
+| I11 | install :218 | N4, removes the file even when this run didn't write it |
+| I12 | install :218 | validate's removal of the file this run wrote |
+| P1 | precheck :229 | business-file-mode |
+| P2 | precheck :235 | history-mode for changes.jsonl |
+| P3 | precheck :246 | persona-mode for a persona file |
+| P4 | precheck :251 | persona-mismatch |
+| P5 | precheck :241 | persona-mode for a persona dir |
+| P6 | precheck :258 | discord-binding |
+| P7 | precheck :104 | library-mirror-missing |
+| P8 | precheck :107 | library-last-error |
+| P9 | precheck :107 | N3, the order swapped |
+| P10 | precheck :108 | library-never-synced |
+| P11 | precheck :92 | N2, the escape after stringify |
+| P12 | precheck :65 | --library-status refuses --profile |
+
+`history-mode` for the history dir itself has no mutant and no test. The brief names only the
+`changes.jsonl` case.
+
+### Tests
+
+Not run yet. They wait for a slot.

agents/honker/work/queue-283/BUILD.md

@@ -0,0 +1,276 @@
+# Row 283 (#1788) C2-01d build notes (Honker)
+
+Append-only. Design: DESIGN.md d2 16e809457, APPROVE webby-0172. Gate owner Sage, reviewer Webby.
+
+## 2026-10-23 build on 45dca69f6 (sage-3577)
+
+Branch honker/row283-build from origin/refactor 45dca69f6e4bce52834587f66f2ff33ba839ab8a. The old branch
+honker/row283 (16e809457) held only the design, so its two commits were cherry-picked as 398314cf4
+(d1) and 4f66dccde (d2). The DESIGN.md blob equals 16e809457's.
+
+Commits:
+- 331653b38: code, README and tests T1-T8.
+- 28918824c: the survey.test:73 re-pin, alone (mos-1330 item 4).
+- this file.
+
+Nothing has run. No node, test or mutant ran during the build: Darkwing held the slot. Every count
+below is a plan until Sage's CLEAR.
+
+### Drift check (sage-3577)
+
+`git diff --stat 94c33a43c 45dca69f6` (design base to build base) over the paths the tests read or
+hash-pin:
+- No change in packages/library, packages/business/src/business.mjs or
+  packages/business/tests/business.test.mjs.
+- No test hash-pins a library file. bus library.test and library-sync.test import index.mjs, and
+  stack-copy.test only checks that index.mjs exists.
+- webui library-cli.test changed one line and doesn't read scope. The `classify` in webui reads.mjs is
+  the business one, not the library's.
+
+I redo the drift check on BASE..refactor before the in-review move.
+
+### N3 (webby-0169): deepEquals of the mapping output outside packages/library
+
+`git grep -n playground -- 'packages/*/tests/*' ':!packages/library/*'` and the files naming
+`universes` give two files:
+- business.test.mjs:20 compares `validateBusinessDocument(...).projects.books` with
+  `checkMapping(mappingEntry())`. That is output against output, so `supporting: []` shows up on both
+  sides. :27 compares only `.playground`.
+- library-projects-protected.test.mjs compares file bytes (:31, :32) and change paths (:58), never the
+  mapping output.
+
+No re-pin is needed outside library. Inside library, only the draft deepEqual at mapping.test:48 gains
+`supporting: []`, as the design says.
+
+### Q1 departure (sage-2923) and the :73 re-pin (mos-1330 item 4)
+
+survey.mjs:65 counts `supporting: 0` and formatSurvey prints it. T8 is the only added test
+(survey.test "C2-01d: with --mapping the survey counts supporting files").
+
+mos-1330 item 4, packages/library/tests/survey.test.mjs:73, commit 28918824c:
+- old: `'scopes canon 5, playground 1, unmapped 3; indexed 6',`
+- new: `'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',`
+
+N2: the pin gains only `supporting 0`. No other text on the line or in that test moved.
+
+### Q2 tradeoff (webby-0169)
+
+A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. That goes past
+the brief, but it is the fail-closed reading, and it uses an existing code: classify checks supporting
+first, so that playground prefix could never match. The cost is that she can't nest a playground under
+a supporting folder, though she can nest the other way (a playground holding a supporting folder).
+
+### Handoffs
+
+- Q4 (webby-0169, sage-2930): the M12 delete rule ("A delete also needs the path to exist at the tip as
+  a 100644 blob", case2 DESIGN.md :308) is not in supportingPath. It binds row 288 (C2-02) via Gitea
+  #1793 comment 30738, with tests for a missing path and a non-100644 entry.
+- A save with no `editor` refusing is C2-02's (DESIGN.md section 1).
+
+### Choices the design left open
+
+- The book loop is now `againstBooks(owners, list, code)` in mapping.mjs, called once per list. The
+  playground's messages and codes are byte-equal to before.
+- A non-string path refuses `library-write-story-path` ("the path must be a string") as part of
+  check 1. A non-array `tree` is a TypeError (DESIGN.md section 3).
+- Check 8 builds the tree's names as every path and every folder above it, keyed by
+  `normalize('NFC').toLowerCase()`. A name on the way refuses if its key holds any name other than
+  itself, so a tree that already holds case twins refuses a write to either (R7).
+
+### Mutants (exact strings)
+
+Each applies one replacement to the build tip. Run one at a time, and restore with `git checkout --`
+on the one file before the next.
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M1 | src/scope.mjs | `const prefix = entry.supporting.find(p => inside(p, path));` | `const prefix = entry.supporting.find(p => inside(p, path) && !entry.playground.some(q => inside(q, path)));` | scope.test "supporting comes before playground", supporting.test "passes at book level" (both-lists path) |
+| M2 | src/mapping.mjs | `if ((inside \|\| holding) && owner !== id)` | `if ((inside \|\| holding) && owner !== id && list !== 'supporting')` | mapping.test "each supporting prefix rule", business.test C2-04 |
+| M3 | src/supporting.mjs | `for (const p of own) if (LINKS.has(modes.get(p)))` | `for (const p of own) if (false && LINKS.has(modes.get(p)))` | supporting.test "symlink or gitlink" |
+| M4 | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.normalize('NFC');` | supporting.test "case or Unicode form" |
+| M4b | src/supporting.mjs | `const fold = name => name.normalize('NFC').toLowerCase();` | `const fold = name => name.toLowerCase();` | supporting.test "case or Unicode form" (NFD case) |
+| M5 | src/supporting.mjs | `Buffer.byteLength(path, 'utf8') > MAX_BYTES` | `path.length > MAX_BYTES` | supporting.test "1025 bytes" |
+| M6 | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[<>]/;` | mapping.test "editor is optional" |
+| M6b | src/mapping.mjs | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;` | `const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f]/;` | mapping.test "editor is optional" |
+| M7 | src/supporting.mjs | `if (place.scope !== 'supporting' \|\| place.universe !== universe)` | `if (place.scope !== 'supporting')` | supporting.test "outside the universe's supporting folders" |
+| M8 | src/mapping.mjs | `if (sid === pid && s !== p && holds(s, p))` | `if (false && sid === pid && s !== p && holds(s, p))` | mapping.test "each supporting prefix rule" (Workshop case) |
+
+(The `\|` in the table is an escaped `|` in the source text.) Each mutant runs the one test file named,
+plus business.test for M2, under `timeout -k 10 600`. A mutant passes the gate only when its run is red
+on the named test and the restored file's sha256 equals the build tip's.
+
+### Gate plan (on Sage's CLEAR)
+
+1. The touched files whole, each under `timeout -k 10 600`: library mapping, scope, supporting and
+   survey tests, and business.test.mjs. Counts go below.
+2. M1-M8 as above.
+3. The full gate, under mos-1275 timeouts: `node --test packages/library/tests/` and
+   `node --test packages/business/tests/` each under `timeout -k 10 1800`, and every scripts/test-*.sh
+   under `timeout -k 10 300`. pipefail and tee, with skips named (test-task Docker groups).
+4. Before in-review: grep packages/*/tests for a 64-hex pin on any changed file and for the changed
+   message text, then the drift check on BASE..refactor.
+
+## 2026-10-23 Webby early look (webby-0227, static, not a verdict)
+
+- E1: business.test.mjs is an existing test file with a 4-line addition after the playground refusal.
+  The in-review request lists it next to survey.test:73.
+- E3 fixed: supportingPath now runs the string check before `JSON.stringify`, so a BigInt (or any
+  non-string) path refuses `library-write-story-path` instead of throwing a TypeError.
+  supporting.test's string case now covers 7, null, undefined, 1n and an array.
+- E2 open: `editor` takes surrounding whitespace, and git trims it at commit, so the saved ident and
+  the commit ident can differ. DESIGN.md section 1 says "non-empty after trim". Refusing
+  `value.trim() !== value` would change that approved rule, so it went to Sage instead of into the
+  build.
+
+## 2026-10-23 E2 departure (sage-3601)
+
+A departure from DESIGN.md section 1 (which stays unedited). The design says each `editor` value is
+"non-empty after trim". Sage ruled that surrounding whitespace refuses too, because git trims an
+ident at commit, so a padded value would save one name and commit another. mapping.mjs now adds
+`if (value.trim() !== value) bad(`editor.${key} must not start or end with whitespace`)` after the
+IDENT_BAD check. `trim()` covers Unicode whitespace, so U+00A0 and U+3000 refuse as well. Inner
+whitespace is kept ("Her  Middle Name" passes).
+
+T3 gains a case per key for leading, trailing and both-ends spaces, U+00A0 and U+3000, plus one inner
+whitespace pass.
+
+M6 grows a third part:
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value) bad(` | `if (false && value.trim() !== value) bad(` | mapping.test "editor is optional" (padded cases) |
+
+Fixture grep: `git grep -nE "\beditor\b|\bauthor\b" -- 'packages/library/tests/*' 'packages/business/tests/*'`,
+leaving out mapping.test.mjs, finds nothing. packages/business/tests has no fixtures directory. The
+library fixture mapping.json has no `editor`. The positive control (`vaultPrefix` in mapping.json)
+matches once. No fixture maps an editor or author with surrounding whitespace.
+
+## 2026-10-23 E4 (webby-0230, sage-3606), same departure as E2
+
+Claimed: `queue move 283 in-progress`, op honker-283-start, rev 3642, 19:10:49Z (briefed→in-progress).
+
+Git's ident.c `crud()` strips any byte <= 0x20 and `, : ; < > " \ '` from both ends of an ident. I
+checked that with git 2.55.0: `Jane,` `"Jane"` `'Jane'` `Jane;` `Jane:` `Jane\` and `,Jane` all
+commit as `Jane`, while `Jane.` and `Ja,ne` are kept. mapping.mjs now takes the set from crud()
+rather than from that list: `IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/`.
+The E2 check became `if (value.trim() !== value || IDENT_CRUD_END.test(value))`, which refuses
+library-mapping-invalid with "editor.<key> must not start or end with whitespace or any of , : ; " ' \".
+`trim()` still catches Unicode whitespace (U+00A0, U+3000), which crud() leaves alone.
+
+Inner characters: IDENT_BAD (`/[\u0000-\u001f\u007f-\u009f<>]/`) already refuses `<`, `>`, newline,
+tab and every other control anywhere in the value. T3 now pins that at the start, the end and the
+middle. Inner `, : ; " ' \` are kept, since git keeps them, and T3 pins that too.
+
+Tests:
+- T3 has one case per character in [space, U+00A0, U+3000, `,`, `:`, `;`, `"`, `'`, `\`], at the start
+  and at the end, for each key. `<`, `>`, newline and tab are pinned at the start, end and middle.
+  Four accepted names have inner crud characters.
+- New round-trip test, "an accepted editor round-trips through a real git commit unchanged". It
+  commits in a scratch repo with editor `Doe, Jane Q.` / `[email protected].` as author and
+  committer, with GIT_AUTHOR_* and GIT_COMMITTER_* stripped from the env, and asserts `git log`
+  shows exactly the saved values. I preflighted that commit with git 2.55.0 by hand: both values came
+  back unchanged.
+
+M6c now replaces the whole end check (this supersedes the earlier M6c row):
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6c | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (false)` | mapping.test "editor is optional" (end cases) |
+| M6d | src/mapping.mjs | `if (value.trim() !== value \|\| IDENT_CRUD_END.test(value))` | `if (value.trim() !== value)` | mapping.test "editor is optional" (`,` `:` `;` `"` `'` `\` cases) |
+
+## 2026-10-23 E5 (webby-0236, not blocking), fixed
+
+The round-trip test stripped only GIT_AUTHOR_* and GIT_COMMITTER_*. With GIT_DIR, GIT_WORK_TREE or
+GIT_INDEX_FILE set (inside a hook, say), GIT_DIR beats `-C root` and the commit would land in the
+outer repo, and the test read global and system config. It now deletes GIT_DIR, GIT_WORK_TREE,
+GIT_COMMON_DIR and GIT_INDEX_FILE (as queue/tests/helpers.mjs gitEnv does) and sets
+GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 (as ledger.test.mjs does). The `-c user.*`
+ident still applies. Test only; no mutant changes.
+
+## 2026-10-23 sage-2925: optional editor.user (sage-3649)
+
+sage-2925 (recorded in ludwig/row286-r2 agents/ludwig/work/queue-286/BUILD.md, Q4) ruled that row 283
+adds an optional `editor.user`, her Gitea login for the `library-human` slot, which row 288 (C2-02)
+passes to `humanCredential(context, {user})`. It reached this row after the DESIGN.md d2 approval
+(ludwig-0068, bubba-0009, sage-3649), so it departs from DESIGN.md section 1 ("exactly the keys
+`name` and `email`"). DESIGN.md stays unedited.
+
+- mapping.mjs: `only(entry.editor, ['name', 'email', 'user'], 'editor')`. When present, `user` must be
+  a string matching USER (`/^[A-Za-z0-9_.-]{1,100}$/`, the entry `user` check), else
+  library-mapping-invalid "editor.user must be a plain account name". The output carries `user` only
+  when given. An absent `editor.user` refusing library-human-missing is 288's (bubba-0009).
+- README: the `editor` line names `user` and the end-character rule from E2/E4.
+- Tests: T3 (mapping.test "editor is optional") gains one accepted case (`her.login-1`, kept in the
+  output) and refused cases for '', an inner space, '@', 101 characters, 7 and null. They go in
+  mapping.test with the other editor cases, not in the new supporting.test, which tests write paths.
+- No test outside mapping.test reads `editor` or pins mapping.mjs or README (git grep).
+
+| Mutant | File | Replace | With | Killed by |
+|---|---|---|---|---|
+| M6e | src/mapping.mjs | `if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' \|\| !USER.test(entry.editor.user)))` | `if (false)` | mapping.test "editor is optional" (editor.user refusals) |
+| M6f | src/mapping.mjs | `...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {})` | `...({})` | mapping.test "editor is optional" (`her.login-1` kept) |
+
+## 2026-10-23 T2 run (sage-3695 CLEAR, lane A, library and business only)
+
+Node v26.8.1. refactor was e2b873390 (226 landed); `git diff --stat 45dca69f6 e2b873390 -- packages/library
+packages/business` is empty. TMPDIR was a mktemp -d under /mnt/storage/scratch/tmp, with pipefail.
+Singles and mutants ran under `timeout -k 10 600`, suites under `timeout -k 10 1800`.
+
+First-run red (mos-1272, placed): the first base run on 46bad7ea3 at 20:01:09Z was red in
+supporting.test "malformed paths refuse by class, in order". 5 of 6 passed, with `TypeError: Do not know
+how to serialize a BigInt`. The cause was the test helper, not the product: `refuses()` labelled each
+assertion with `JSON.stringify(path)`, and the 1n case added for E3 can't be stringified. In c18ad3e12
+the label uses `util.inspect(path)`, a 2-line test-only change. The product's 1n refusal was never in
+question: supportingPath type-checks before it stringifies (E3). The whole run below is on c18ad3e12.
+
+Base, the touched files whole (20:01:43Z), all rc=0:
+- library mapping.test 16/16, scope.test 6/6, supporting.test 6/6, survey.test 7/7;
+- business business.test 21/21;
+- 0 skipped, 0 cancelled, 0 todo.
+
+Mutants (20:01:44Z). Each was applied by exact string with count 1, then restored with `git checkout --`.
+Every restored sha256 equals HEAD's blob, and the tree was clean after.
+
+| Mutant | Run | Result | Failing test |
+|---|---|---|---|
+| M1 | scope.test | rc=1, 5/6 | supporting comes before playground; a folder in both lists is supporting… |
+| M1 | supporting.test | rc=1, 5/6 | a path passes at book level, universe level, in a draft and in a folder in both lists |
+| M2 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+| M2 | business.test | rc=1, 20/21 | C2-04: library mappings load without roots, remain frozen, and retain mapping refusals |
+| M3 | supporting.test | rc=1, 5/6 | a symlink or gitlink on the way, or at the path itself, refuses |
+| M4 | supporting.test | rc=1, 5/6 | a name that differs from a tree name only in case or Unicode form refuses… |
+| M4b | supporting.test | rc=1, 5/6 | the same case/Unicode test |
+| M5 | supporting.test | rc=1, 5/6 | a path of exactly 1024 bytes passes, and 1025 bytes… refuses |
+| M6 | mapping.test | rc=1, 15/16 | editor is optional, kept when given, and refuses anything but a plain name and email |
+| M6b | mapping.test | rc=1, 15/16 | the same editor test |
+| M6c | mapping.test | rc=1, 15/16 | the same editor test |
+| M6d | mapping.test | rc=1, 15/16 | the same editor test |
+| M6e | mapping.test | rc=1, 15/16 | the same editor test |
+| M6f | mapping.test | rc=1, 15/16 | the same editor test |
+| M7 | supporting.test | rc=1, 5/6 | a path outside the universe's supporting folders refuses |
+| M8 | mapping.test | rc=1, 15/16 | each supporting prefix rule refuses with its code |
+
+14 of 14 mutants killed, each on its named test only.
+
+Suites (20:01:47Z):
+- `packages/library`: `node --test tests/*.test.mjs` rc=0, 98/98, 0 skipped.
+- `packages/business`: `node --test tests/` rc=0, 231/231, 0 skipped.
+
+Not run here: every scripts/test-*.sh and the other packages. Those are Sage's 283 gate, after Webby's
+APPROVE.
+
+## 2026-10-23 G1: mos-1528 OK for the mapping.test draft deepEqual (sage-3713)
+
+This entry completes the N3 line above (BUILD.md:42, "only the draft deepEqual at mapping.test:48 gains
+`supporting: []`"). BUILD.md is append-only, so :42 stays as written. Mos OK'd the change of that old
+assertion in mos-1528. It is now at packages/library/tests/mapping.test.mjs:52, and commit 331653b38
+changed it. Everything else in that commit's hunk is new test lines, not changed old ones.
+
+- Old, mapping.test.mjs:48 at 45dca69f6:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });`
+- New, mapping.test.mjs:52 at b2a1f4092:
+  `assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });`
+
+The line gains only `, supporting: []`; nothing else in it moved. The business.test and scope.test hunks
+add tests only (sage-3713: no OK needed). The other old-test change in this row is survey.test:73
+(mos-1330 item 4, 28918824c). Doc only.

agents/honker/work/queue-283/DESIGN.md

@@ -0,0 +1,191 @@
+# Row 283 (#1788) C2-01d design, draft 2 (Honker)
+
+Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
+agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
+1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
+build waits for 282 to land (sage-2906).
+
+## 1. Mapping (packages/library/src/mapping.mjs)
+
+`supporting`:
+- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
+  hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
+- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
+- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
+  `books: []`. classify then needs no `?? []`. The business writer writes the raw document
+  (organization.mjs:195), not this output, so no business file changes shape.
+- The prefix rules, across every entry (ruling after r11):
+  - A supporting prefix holding another supporting prefix, or one listed twice, refuses
+    `library-mapping-invalid`.
+  - A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
+  - A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
+  - Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
+    is book level, and outside every book is universe level. A draft's prefixes are all universe level.
+- Between the two lists (my choice, Q2):
+  - A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
+  - A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
+    and the rest stays playground.
+  - A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
+    checks supporting first, so that playground prefix could never match.
+  - A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
+    `library-mapping-invalid`. Otherwise one path would have two universes.
+- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
+  label. The playground's messages and codes stay byte-equal, so no existing test text moves.
+
+`editor`:
+- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
+  `email` (via `only()`). Each value is a string that is non-empty after trim and has no control
+  character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
+  and commits under a different name, so C2-02 would never see a failure). Anything else refuses
+  `library-mapping-invalid`.
+- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
+  with no `editor` refusing is C2-02's job.
+
+## 2. Scope (scope.mjs)
+
+- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
+  with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
+  null at universe level and in a draft. The type and folder come from the first folder under the
+  prefix, as for the playground.
+- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
+- The comment above `classify` names the three prefix scopes and the order.
+
+## 3. supportingPath (new supporting.mjs)
+
+`supportingPath(mapping, universe, path, tree)` returns `path` or throws
+`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
+
+- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
+  C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
+  a caller bug, not a path class.
+- The checks run in this order, each with its own message naming the class:
+  1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
+  2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
+  3. It must have no backslash.
+  4. It must not be absolute (a leading `/`).
+  5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
+  6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
+     covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
+     story path, a playground path that isn't also supporting, and another universe's prefix. The scope
+     rule then has one source, and M1 below hits both.
+  7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
+     mode `120000` (symlink) or `160000` (gitlink).
+  8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
+     (derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
+     it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
+     a name as one file (webby-0169 N1).
+     Directories are checked too, because the folders under a supporting prefix are hers to name. A
+     path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
+- The refusal messages quote the path with JSON, except for the control-character class, whose message
+  leaves the path out.
+- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
+  the brief's supportingPath list. It stays with C2-02's delete (Q4).
+  The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
+  (webby-0169 Q4).
+- index.mjs exports `supportingPath`.
+
+## 4. README (packages/library/README.md)
+
+- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
+- Refusals: a `library-supporting-other-universe` row, and the new cases in the
+  `library-mapping-invalid` row.
+- Scope: supporting first, then playground, then canon.
+- A new section, "Agent write paths", for supportingPath and its classes.
+
+## 5. Callers of classify outside files owned (Q1 for Sage)
+
+- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
+  `scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
+  prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
+  `scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
+  adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
+  covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
+- No change in the rest, each for a reason:
+  - reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
+  - R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
+    raises nothing.
+  - render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
+  - mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
+  - No bus or webui source filters on scope (git grep at 94c33a43c).
+- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
+  test is added there.
+
+## 6. Tests
+
+- mapping.test:
+  - T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
+    it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
+  - T2: one test per prefix rule.
+    - These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
+      listed twice, one equal to its own book, one holding its own book, one holding a playground
+      prefix, and one overlapping another entry's playground.
+    - These refuse `library-supporting-other-universe`: one inside another universe's book, and one
+      holding another universe's book.
+    - An equal same-entry playground passes.
+  - T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
+    array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
+    `<` or `>` in either value.
+- scope.test, T4:
+  - Supporting at book level, universe level and in a draft each give their universe and book.
+  - A folder in both lists is `supporting`, and a playground-only folder is `playground`.
+  - A supporting `.canvas` or `.base` is unmapped.
+- supporting.test (new):
+  - T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
+  - T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
+    The classes are:
+    - unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
+      supporting prefix, and an unknown universe;
+    - absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
+    - a symlink folder, a gitlink folder, and a symlink at the path itself;
+    - a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
+    - 1,025 bytes made with a multi-byte character, so bytes and characters differ.
+  - Each asserts the code `library-write-story-path`.
+- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
+  `library-supporting-other-universe`.
+- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
+
+## 7. Mutants (exact strings go in BUILD.md)
+
+| Mutant | Change | Killed by |
+|---|---|---|
+| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
+| M2 | the other-universe fail for supporting is dropped | T2 |
+| M3 | the symlink and gitlink check is dropped | T6 |
+| M4 | the case check is dropped | T6 |
+| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
+| M5 | the byte length uses `path.length` | T6 1,025 bytes |
+| M6 | the `editor` control-character check is dropped | T3 |
+| M6b | the `editor` `<` and `>` check is dropped | T3 |
+| M7 | supportingPath skips the universe match | T6 other universe |
+| M8 | the supporting-holds-playground check is dropped | T2 |
+
+## 8. Gate
+
+- Webby approves the manifest.
+- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
+- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
+  file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
+- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
+  message text, then drift-check BASE..refactor.
+
+## 9. Questions
+
+- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
+- Q2 (Webby): the cross-list rules in section 1?
+- Q3 (Webby): `tree` as the `listTree` array?
+- Q4 (Webby): the delete's 100644 check stays with C2-02?
+- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
+  would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
+
+## 10. Draft 2 (webby-0169)
+
+- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
+- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
+  prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
+  is that she can't nest a playground under a supporting folder, though she can nest the other way.
+- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
+- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
+- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
+  (mos-1330, its own commit).
+- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
+  on the build base.

agents/lena/README.md

@@ -0,0 +1,8 @@
+# Lena
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 296 (FED R7, handed over from Quackerjack).
+
+No launcher in this directory. The seat runs as a T3 thread (thread db27faca) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `lena/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/researcher/work/queue-216/BUILD.md

@@ -0,0 +1,237 @@
+# Row 216 build notes (C2-05a, lookup index and queries, #1717)
+
+Phase A only: code, tests and this file. No test, suite or mutant has been run. `node --check` passed on every changed `.mjs`.
+
+- Branch: `researcher/row216`
+- Base: `d372102882d6858fa77af4aee453f866c886ad5c` (origin/refactor)
+- Design: `agents/gosalyn/work/case2/DESIGN.md` on origin/gosalyn/case2-design, section 3 (table at lines 625-631, bullets 633-641), 1.2-1.4, B12, D2
+- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-05a at lines 320-357
+
+## Files
+
+| Path | Status |
+|---|---|
+| `packages/library/src/index-build.mjs` | new |
+| `packages/library/src/query.mjs` | new |
+| `packages/library/src/index.mjs` | edit: 2 export lines added |
+| `packages/library/tests/query-fixture.mjs` | new, test helper |
+| `packages/library/tests/query.test.mjs` | new |
+| `packages/library/tests/index-build.test.mjs` | new |
+| `agents/researcher/work/queue-216/BUILD.md` | new (this file) |
+
+No existing test or source file changed beyond `index.mjs`.
+
+## Design rows and where each is tested
+
+| Design row | Code | Tests (query.test.mjs unless noted) |
+|---|---|---|
+| `library_find` | `find` | find is bound to its universe; every result carries its scope; long list pages; large items page under the cap |
+| `library_get` | `get` | hybrid gets a source file; get lists visible links both ways; get pages its lines |
+| `library_search` | `search` | search returns scoped line hits; item that cannot fit alone is refused |
+| `library_manuscript` | `manuscript` | one chapter at most 400 lines; refused without chapter; hybrid reads a source chapter |
+| `library_universe` | `universeInfo` | universe info reports a hybrid's sources, constraints, notes; unknown universe refused |
+| Hybrid semantics (1.4) | `sees` | a hybrid sees its sources canon minus exclusions, no playground |
+| Unmapped never appears | index build + `sees` | unmapped files never appear (query.test); index holds mapped files only (index-build.test) |
+| Per-commit cache (3) | `indexFor` | same commit, path, mapping return one index; different path, mapping or commit get their own; eight-entry bound; failed read not kept; unchecked mapping refused (index-build.test) |
+| Rebuild time (3, C2-05a gate) | `indexFor` | 3,000-file rebuild, time reported with `t.diagnostic`, no threshold asserted |
+| REPLY_CAP parity | `QUERY_REPLY_CAP` | equals `REPLY_CAP` from harness tools.mjs |
+
+## Choices where the design table is silent or differs
+
+These are departures or gaps. Each is built as stated, so Sage can rule before Phase B. A ruling that changes one of them is a small edit.
+
+1. **Paging arguments (gap a).** The table has no offset. `find` and `search` take an optional `offset` (a position in the filtered list, default 0). A reply carries `next`: the position of the next item, or `null`.
+2. **`library_get` has no universe (gap b).** Built with a required `universe`. Without it the reply could not be isolated. A missing file and a file the universe cannot see both return `null`, so a caller cannot tell them apart. `get` also takes an optional `from` line.
+3. **`get` over the cap (gap c).** Lines page by `from` with `next`. `links_out` and `links_in` come back whole on every page. If the frontmatter and links alone exceed the cap, the call is refused with `query-item-too-large`. A hub note with many backlinks may be refused. This needs a ruling: link paging, or accept the refusal.
+4. **`manuscript` without a chapter (gap d).** Refused with `query-chapter-required`. The design names no list form. A chapter name that matches two visible files is refused with `query-chapter-ambiguous`.
+5. **`search` excerpt (gap e).** The excerpt is the whole line, not a truncation. A line that alone exceeds the cap is refused. Truncating it would cut an item.
+6. **`exclude` form (gap f).** `checkMapping` accepts only a folder path for `exclude` (`folder()`), so an exclusion is a path prefix. There is no type or source form to build. Confirm.
+7. **Pin constraints.** `pin` does not hide any file. It is reported by `universeInfo` only. Confirm.
+8. **Playground through `get`.** `scope` applies to lists. `get` by an explicit path returns a playground file of the caller's own universe. Confirm.
+9. **Links.** A link into a file the universe cannot see is dropped from `links_out` and `links_in`, in line with N1. Links from a visible file that point into another universe are kept in the index (the reader keeps them under R6), and the query layer drops them for universes that cannot see them.
+10. **`find` matching.** Case-insensitive substring over the front matter `name` and the file name. An empty `query` matches every file in scope.
+11. **Cache key.** `repo`, `commit` and a sha256 of the canonical mapping. Keying by commit alone would return the wrong scopes after a mapping change. The cache holds eight entries, least recently used out. Failed reads are not kept.
+12. **`universeInfo`.** Reads only the checked mapping and the served commit. It builds no index.
+13. **Reply commit.** Every reply carries the index commit, which is the served commit passed in.
+
+## Provisional refusal codes (pending Sage approval)
+
+The brief says new refusal codes need Sage's approval first. These are provisional and must not be treated as settled:
+
+- `query-argument-invalid`
+- `query-universe-unknown`
+- `query-chapter-required`
+- `query-chapter-ambiguous`
+- `query-item-too-large`
+
+Reused, existing codes: `library-mapping-invalid`, plus the reader's `library-git`, `library-commit` through `indexFor`.
+
+## Grep results (grep only, not a test run)
+
+- Test references to the changed paths: `packages/library/tests/*.mjs` import `../src/index.mjs` and `../src/mapping.mjs`. `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs` import the library index as a namespace. Neither enumerates its exports, so the two new export lines break no assertion.
+- `packages/cli/tests/stack-copy.test.mjs:52` checks that `packages/library/src/index.mjs` exists, and it still does.
+- 64-hex pins: none in `packages/library/tests`, none on `index.mjs`, `query.mjs` or `index-build.mjs`.
+- `scripts/test-*.sh`: no reference to the new modules.
+
+## Flag for Sage
+
+- `packages/library/tests/helpers.mjs` `repo()` builds its fixtures under `tmpdir()`, which is `/tmp`. The launcher rules forbid that. The new tests do not use it; they use `tests/query-fixture.mjs`, which builds under `/mnt/storage/scratch/tmp`. The existing helper should be fixed in a separate row, not here.
+
+## Phase B commands (not run)
+
+Run only after Sage sends "slot clear". Set the scratch TMPDIR first, per the launcher rule.
+
+```
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-aa3cc98787bc5152c/packages/library
+export TMPDIR=/mnt/storage/scratch/tmp
+node --test tests/query.test.mjs tests/index-build.test.mjs
+node --test tests/*.test.mjs
+```
+
+Also run `packages/bus/tests/library.test.mjs` and `library-sync.test.mjs`, since they import the index.
+
+## Status
+
+Not yet verified. Nothing has been tested and nothing is committed. The working tree holds the Phase A changes. AGENTS.md invariant 8 allows a commit only after the applicable suites are green, so the commit waits for Phase B. The dispatch asked for a local commit in Phase A; Sage to confirm that the commit waits for Phase B.
+
+## Round 2 (2026-10-22, sage-2708, sage-2716): rulings applied, rebased onto aca16404c
+
+Added after the text above; nothing above is edited. "Nothing is committed", "Provisional refusal codes",
+`query-chapter-required` and the tmpdir flag above were true when written and are superseded here.
+
+- Branch `researcher/row216-r2`, one local commit on origin/refactor `aca16404c`. Row 268 (C2-01c) is in
+  that base. Row 253 has not landed; the work rebases onto 253's tip before any gate. Not pushed, not run.
+- Rulings: `agents/sage/work/queue-216/RULINGS.md` at da9555ca2, rulings 1-13 and the tmpdir flag.
+- Drift check, d37210288..aca16404c against my paths: the library files that changed are `mapping.mjs`,
+  `scope.mjs`, `README.md` and the mapping and scope tests. None is a file I add or edit. `query.mjs` reads
+  the checked mapping through them, so the whole library package runs in phase B.
+
+### What changed from phase A
+
+| Ruling | Change in `query.mjs` | Test |
+|---|---|---|
+| 3 `get` over the cap | `links_out` and `links_in` page together with `links_from`; every reply carries `links_next`, `next` and the front matter. A page with lines left carries at least one line. Links take at most half the cap while lines remain. `query-item-too-large` is left for front matter alone or one line alone (or one link alone) | hub note with 900 backlinks pages and adds up; front matter alone and a line alone refused; bad `links_from` |
+| 4 `manuscript` no chapter | `chapter` optional: the first visible chapter in path order. Every reply carries `next_chapter`. `query-chapter-required` removed. Ambiguity still refuses | first chapter and `next_chapter`; ambiguous name refused |
+| 5 `search` long line | hit comes back `{path, line, excerpt: null, excerpt_too_long: true, scope}`, other hits still return | marked hit and unmarked hits in one reply |
+| 6 `exclude` | path-prefix reading only. The test names `EXCLUSION` and `EXCLUDED_PATHS` in `query-fixture.mjs`, so C2-15 (row 267) swaps two constants | exclusion hides from the hybrid and not from the source |
+| 8 hybrid `get` | unchanged code; test added | hybrid gets a source's playground file as `null`; the source gets it with `scope: "playground"` |
+| PRD 1.14 (row 268) | `universeInfo` reports `kind` from the mapping (`draft` included) | four tests below |
+
+PRD 1.14 tests, one each: a lookup naming a `book` leaves `book: null` files out (find and search);
+`library_manuscript` never reads a `book: null` file; a draft universe has no canon, so its lookups return
+files only with `scope: "playground"`; `library_universe` on a draft returns kind, name and prefixes.
+The levels fixture is `WITH_LEVELS` in `query.test.mjs`: harbor gets `Notes/Harbor/` as a universe-level
+playground prefix, and `idea` is a draft over `Drafts/New World/`.
+
+`query-fixture.mjs` builds under `tmpdir()`, as `helpers.mjs` does (ruling "tmpdir flag"). The earlier
+flag about `helpers.mjs` building under `/tmp` is closed by that ruling: the gate sets `TMPDIR`.
+
+Refusal codes now: `query-argument-invalid`, `query-universe-unknown`, `query-chapter-ambiguous`,
+`query-item-too-large`. All four approved in the rulings.
+
+### Grep results (grep only, not a test run)
+
+- `git grep` over `packages/*/tests/*` and `scripts/*` for `query.mjs` and `index-build`: no hit outside
+  `packages/library/tests/query*.test.mjs` and `index-build.test.mjs`.
+- 64-hex pins naming a library path: none. Positive control: the same pathspec finds the sha256 lines in
+  `packages/cli/tests/case1-hostcheck.test.mjs` and the `packages/library/src/index.mjs` existence check at
+  `packages/cli/tests/stack-copy.test.mjs:52`.
+- Tests that read `packages/library/src` as a directory: `packages/cli/tests/stack-release-fixture.mjs:309`
+  copies `packages/library/src` whole into a release fixture. It carries no file list, so two new files break
+  no assertion. `stack-release.test.mjs` is not in the gate unless Sage wants it.
+- Tests that import the library index as a namespace: `packages/bus/tests/library.test.mjs` and
+  `library-sync.test.mjs`. Neither enumerates exports, so the two export lines add no break. Both run
+  whole in phase B.
+
+### Run limits (fixed before any run)
+
+Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
+
+- Node test files: LIMIT 900 s. The library test files have no recorded time. 900 s is above the longest
+  recorded whole-package run I know of (cli, 591 s, row 281 BUILD.md "Runs" step 3), so it holds the 3x rule
+  for any single file. The first run records each file's time, and a file past 300 s gets a limit re-derived
+  from it before the next run. `query.test.mjs` builds a 900-file repo and a 3,000-file index rebuild is in
+  `index-build.test.mjs`; both are the files most likely to need it.
+- No shell script is in this row's gate, so no script limit applies.
+
+Any timeout goes to Sage, then Mos, unplaced (mos-1275).
+
+### Phase B (not run; Sage's CLEAR first, then a rebase onto 253's tip)
+
+```
+export TMPDIR=/mnt/storage/scratch/tmp
+cd <worktree>/packages/library
+for f in tests/*.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
+cd ../bus
+for f in tests/library.test.mjs tests/library-sync.test.mjs; do setsid -w timeout -k 10 900 node --test "$f"; done
+cd ../cli
+setsid -w timeout -k 10 900 node --test tests/stack-copy.test.mjs
+```
+
+Mutants I propose (my list, not read off the brief; each is meant to be killed by the named test, and none
+has been thrown; the kill claims are unverified until CLEAR):
+
+- M-a: `sees()` returns true for a file of another universe: killed by "find is bound to its universe".
+- M-b: the playground filter dropped: killed by "playground appears only when asked for".
+- M-c: the hybrid reads a source's playground: killed by "a hybrid gets a source playground file as null".
+- M-d: `links_next` always null: killed by the hub paging test.
+- M-e: the book filter lets `book: null` through: killed by the PRD 1.14 book test.
+
+### Status
+
+Built, not run. `node --check` has not been run on this round's files (no node before the CLEAR); the
+phase A pass above covered the earlier text only. The commit is local and waits for no gate under Sage's
+sage-2716 instruction, which allows git and docs work only; push and claim wait for Sage's go.
+
+## Round 3: rebase onto 45dca69f6, drift check, hash-pin grep (2026-10-23T18:53:43Z, sage-3576)
+
+Appended; nothing above is edited. Git only; nothing run, nothing pushed. Branch researcher/row216-r4 holds the
+one row 216 commit on 45dca69f6 (origin/refactor, 10-23). Earlier base: 48e450ce8 (row 253).
+
+- Rebase: clean. `git range-diff 48e450ce8..038089e5f 45dca69f6..researcher/row216-r4` shows the commit as `=`.
+- Landed in 48e450ce8..45dca69f6: 1175 files. Path overlap with this row's 7 paths: none. packages/library: no
+  landed file. packages/harness/src/tools.mjs (imported by query-fixture.mjs or the tests): not landed.
+- Hash-pin grep (the item 216 owed): 64-hex in packages/library: none. Positive control: 364 files in
+  packages/*/tests and scripts match 64-hex. Tests and scripts that name library files by path:
+  bus/tests/library.test.mjs and library-sync.test.mjs and bus/src/runtime.mjs import library/src/index.mjs;
+  business/src/business.mjs and its test import library/src/mapping.mjs (unchanged by this row);
+  cli/tests/stack-copy.test.mjs, stack-release-fixture.mjs:310 and stack-release.test.mjs:1991 copy
+  packages/library/src as a tree; scripts/stack-copy.sh:37 copies it; scripts/mosaic:41 runs survey.mjs. None pins
+  a hash of index.mjs, index-build.mjs or query.mjs.
+- bus/src/runtime.mjs landed changes after 48e450ce8 and uses libraryModule by named members (ensureMirror, SLOT,
+  readLibraryFile, libraryStatus, sync, LibraryError, SYNC_INTERVAL_MS) only; the landed diff touches none of them,
+  and this row's two new index.mjs exports (query and index build) are not iterated by any caller.
+- Gate additions for phase B: run bus library.test.mjs and library-sync.test.mjs whole (they import index.mjs), and
+  the cli stack-copy and stack-release tests that copy packages/library/src.
+
+## Round 4: phase B on 4e5d28ab2, two test fixes for r5 (2026-10-23T20:20:51Z, sage-3702, mos-1528)
+
+Appended; nothing above is edited.
+
+Phase B receipts on 4e5d28ab2 (researcher-r216-kit/out-b1): library whole 114 pass, 2 fail; bus library.test and
+library-sync.test 12 pass; cli 266 pass. The 3,000-file rebuild took 3807 ms (the test, with fixture setup, 4070 ms;
+`t.diagnostic` in index-build.test.mjs). No row 216 mutant was required or thrown in that round.
+
+The 2 library reds are test faults, not product faults. Both are placed as first-run reds in files this row adds
+(mos-1272); Mos ruled both fixes in mos-1528 and Sage relayed it in sage-3712.
+
+- R4: `packages/library/tests/index-build.test.mjs`, test "a different repo path, mapping or commit gets its own
+  index". Old: `writeFileSync(join(repo, 'Book One/Places/New.md'), …)` with no `Book One/Places` folder in FILES, so
+  the write failed with ENOENT. New: one `mkdirSync(join(repo, 'Book One/Places'), { recursive: true })` before the
+  write (import line gains `mkdirSync`). No assertion changes.
+- R5: `packages/library/tests/query.test.mjs`, test "a hybrid sees its sources canon, minus exclusions, and no
+  playground". The assertion sorts the actual paths and compared them to an unsorted literal, so the literal had
+  the wrong order (Characters before Chapters; Second World Characters before Chapters). New: only the expected
+  literal is reordered into sorted order. The `.sort()` on the actual side stays, and the assertion still checks
+  order. The set of seven paths is unchanged.
+- Product code: no edit.
+
+Reruns owed after the r5 commit (run on Sage's CLEAR, after the 283 gate): index-build.test.mjs whole,
+query.test.mjs whole, library whole, and the mutants those two files kill (M-a to M-e above). Results are appended
+below as a new entry.
+
+Run limit note: stack-release.test.mjs ran 644 s in the cli run. A per-file limit of 3 x 644 = 1932 s covers it.
+Sage's gates run cli as one whole-package `node --test` under 2100 s.
+
+Carry notes from Filbert's static check (doc only, no change in r5): N1 and N2 stay recorded as he gave them. The
+`After` list in this file still names row 268; row 268 landed at c27207f6e.

agents/researcher/work/queue-220/BUILD.md

@@ -0,0 +1,100 @@
+# Row 220: C2-10a, no raw session view (M7) and no raw Discord engine (M8)
+
+Phase A. No test, suite or mutant has been run. Sage opens the slot.
+
+- Owner: researcher seat (Haiku 5.5 subagent), dispatched by Sage under lead decision 129.
+- Reviewer: Filbert.
+- Branch: `researcher/row220`, from `origin/refactor` at d37210288.
+- Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-10a (line 495) and "Rules every row keeps".
+- Design: `agents/gosalyn/work/case2/DESIGN.md` on `origin/gosalyn/case2-design`, sections 5.1 (M7, M8), 7.6, 8 (row list).
+
+## Status
+
+| Item | State |
+|---|---|
+| M7 reader side (`conversation-not-listed`) | Built. Tests written, not run. |
+| M7 production wiring (the caller that passes `isCreative`) | Not built. Outside the file list, and it needs a ruling (question 1). |
+| M8 `discord check` and `discord run` refusals | Not built. `packages/discord/src/cli.mjs` is untouched. Blocked on question 1 and question 2. |
+
+Phase A is therefore partial. The row cannot pass its acceptance until Sage rules on the questions below.
+
+## Files
+
+- `packages/conversation/src/reader.mjs`: exports `NOT_LISTED`; `createReader` takes `isCreative` (default `() => false`); `catalogue()`, `open()` and `next()` hide a root for which it returns truthy.
+- `packages/conversation/tests/reader.test.mjs`: three new tests, inserted before the "unknown conversations" test.
+- `agents/researcher/work/queue-220/BUILD.md`: this file.
+
+Nothing else is changed. `node_modules` in the worktree is a symlink to the canonical checkout and is ignored by git.
+
+## Brief and design items mapped to tests
+
+| Item | Test |
+|---|---|
+| M7: a creative session file under the root isn't listed | "M7: a creative seat's session is not listed and won't open by id; an assistant seat still lists" |
+| M7: and won't open by id (`conversation-not-listed`) | same test; second check of the open refusal in "M7: a creative session already open refuses its next page once the root is hidden" |
+| M7: an assistant session still lists | same test (the `sage` seat is listed and opens with its text) |
+| M7: an already-issued cursor stops once the root is hidden (my addition; the design's "won't open" implies it) | "M7: a creative session already open refuses its next page once the root is hidden" |
+| M7: refused rows and the unsupported placeholder of a creative root are hidden too (my addition; the design hides "creative sessions", and a refused row or placeholder names one) | "M7: a creative root's refused files and its unsupported placeholder are hidden as well" |
+| Default behavior without `isCreative` is unchanged | the existing reader suite; the default predicate returns false |
+| M8: `discord check` / `discord run` refuse `discord-engine-not-allowed` on a library business, and a `mosaic-bus` binding with `tools` | none (not built, question 1) |
+| M8: a pi binding on a business without a library still checks clean | none (not built, question 1) |
+
+Every test's fixture text is `CREATIVE-MARKER` or a made-up assistant line. The M7 tests assert the marker is absent from the catalogue and refusal output.
+
+## Choices made in phase A
+
+- `isCreative(root)` is the reader's only input. The reader reads no business file. A truthy answer hides, so a doubtful answer fails closed. The predicate must depend on `root.seat` and `root.project` only, because a cursor is checked against the root object from an earlier listing.
+- Hidden check placed after the cursor's actor/purpose/conversation/branch checks in `next()`, and before the source is read.
+- `open()` checks hidden after the id resolves, so a creative id gets `conversation-not-listed`, and an unknown id still gets `unknown-conversation`.
+- `conversation-not-listed` is `reconcile: false`. The design names no reconcile flag. `unknown-conversation` uses true. Question 3.
+- The default predicate is `() => false`. Until a caller passes one, M7 does nothing. This is the open risk, and question 1 covers it.
+
+## Grep over `packages/*/tests` and `scripts/test-*.sh` (static, phase A)
+
+Changed path `packages/conversation/src/reader.mjs`:
+- `packages/conversation/tests/reader.test.mjs:14` imports `rootsFromSpecs, createReader, conversationId, cwdInProject, UNSUPPORTED_HARNESS`. It is the file under change.
+- `packages/control-board/tests/serve.test.mjs:26` imports `UNSUPPORTED_HARNESS`. That export is unchanged.
+- `packages/library/tests/sync.test.mjs:15` imports `packages/library/src/reader.mjs`, a different file. Not a hit.
+- `scripts/test-*.sh`: no reference to the conversation reader.
+- 64-hex pins naming this path: none. `packages/bus/tests/grant-migration.test.mjs:24` has a 64-hex value, but it is a DDL digest, not a pin on this path. That file matched only the word "reader" in a test title.
+
+Changed path `packages/conversation/tests/reader.test.mjs`:
+- No other test or script names this file. It runs through `packages/conversation`'s `node --test tests/`.
+- No 64-hex value in the file.
+
+Changed path `agents/researcher/work/queue-220/BUILD.md`: no pin.
+
+`node --check` passed on both changed `.mjs` files.
+
+## Phase B plan (not run)
+
+The reader test uses `os.tmpdir()`. Set `TMPDIR` to a scratch dir first, per the rule against `/tmp`.
+
+```
+export TMPDIR="$(mktemp -d /mnt/storage/scratch/tmp/r220XXXXXX)"
+cd packages/conversation && node --test tests/reader.test.mjs
+cd packages/conversation && node --test tests/
+cd packages/discord && node --test tests/
+cd packages/control-board && node --test tests/serve.test.mjs
+```
+
+The first command is the touched file whole. The second and third are the conversation and discord suites whole, as the brief asks. The control-board serve test is not in the brief. It consumes `reader.mjs`, so I recommend it. Sage can drop it.
+
+## Questions for Sage
+
+1. **Business link (blocks M8 and the M7 wiring).** Neither rule can be built from this row's file list, because the inputs don't exist in the code:
+   - A reader root carries `seat` (the spec's `agent`) and `project` (the repo directory name). It has no business id. Roots come from control-board scan specs (`packages/control-board/src/scan.mjs`, `discoverRepoAgents`) and seat registrations. Neither carries a definition.
+   - A Discord binding has `seat` and no business key (`packages/discord/src/binding.mjs`, `TOP_KEYS`).
+   - Creative status lives only in the business file: `roles.<instance>.definition` in `CREATIVE_DEFINITIONS` (`packages/business/src/vocabulary.mjs:176`). A library project is `projects.<id>.kind === "library"` (`packages/business/src/business.mjs:243`).
+   - Creative thread sessions are stored at `<dataRoot>/threads/<business>/<thread>/session` (`packages/seat/src/session.mjs:59-64`), outside the `.pi/state` roots the board scans. M7 may therefore reach only creative seats that have a `.pi/state` session root. Please confirm.
+   - The design does not define the mapping from a seat to a business.
+
+   Recommendation: add a required `business` key to the binding, validated against `businesses/<id>.json`. The board builds `isCreative` from `loadBusiness(id)`: a root is creative when its seat is a `roles` key whose definition is in `CREATIVE_DEFINITIONS`, and the business has a library project. This needs file scope for `packages/discord/src/binding.mjs` and `cli.mjs` (M8), and `packages/control-board/src/serve.mjs` (M7 wiring). None of those is on this row's list. I need that scope amendment and the mapping ruling before I build M8 or the wiring.
+
+2. **M8 refusal code for a `mosaic-bus` binding with `tools`.** The design names `discord-engine-not-allowed` for the engine case and no code for the tools case. A new code goes to you first. My proposal is to reuse `discord-engine-not-allowed` with a message that names the tools key.
+
+3. **`reconcile` on `conversation-not-listed`.** I chose `false`. Confirm or change.
+
+4. **HTTP status for `conversation-not-listed`.** `REFUSAL_STATUS` in `packages/control-board/src/serve.mjs` has no entry, so the route returns 422. My proposal is 404, next to `unknown-conversation`. This needs that file on the scope list too.
+
+Phase A stops here. On your "slot clear" I will run the phase B commands above. I will not build M8 or the wiring until question 1 is answered.

agents/researcher/work/queue-220/r2/BUILD.md

@@ -0,0 +1,481 @@
+# Row 220 r2: phase A round 2 (M7, M8, business helper, REFUSAL_STATUS)
+
+Phase A only. No node, npm, `node --check` or test run has happened in this round, and nothing is
+committed. Phase B (the suites) waits for the coordinator's "slot clear".
+
+- Owner: researcher seat (Haiku 5.5 subagent), dispatched by Sage under lead decision 129.
+- Reviewer: Filbert.
+- Branch: `researcher/row220-r2`, from `origin/refactor` at da9555ca2. The r1 cherry-pick 3fa833715 is
+  staged with `-n`.
+- Rulings: `agents/sage/work/queue-220/RULINGS.md` on origin/refactor (da9555ca2). Import-by-path is
+  followed: no export line in `packages/business/src/index.mjs`, and `packages/discord/src/binding.mjs`
+  is untouched.
+
+## Coordinator rulings, applied
+
+Round 1 answers (earlier packet): applied as before. Absent `businesses/` gives empty sets only on
+ENOENT; other failures throw. stack-copy test joins phase B. Webui fixtures pass `businessDir` (renamed `configDirectory` in round 2b below). Discord
+refusals exit 2.
+
+Round 2 rulings (coordinator message, this round):
+
+1. **Dangling symlink at `businesses/` refuses.** `loadSeatSets` calls `lstatSync(join(dir, "businesses"))`
+   first. Only an lstat ENOENT (nothing at the path) returns empty sets. If something is there and
+   `readdirSync` fails for any reason, including ENOENT through a dangling link, it throws `BusinessError`.
+   Test added: "a businesses symlink to a missing target throws; no empty set". The absent-directory test is kept.
+2. **Sets are read once per public reader call.** `createReader` takes `creativeCheck`, a factory. Each
+   `catalogue()`, `open()` and `next()` calls it once, then applies the returned predicate to every root.
+   A load failure refuses `conversation-business-unreadable` for the whole call. `serve.mjs` exports
+   `creativeCheck(dir = configDir())`, the factory, and `createServer` passes `creativeCheck(businessDir)`.
+   Test added: "one catalogue calls the creative check once, however many roots it lists". It counts factory
+   calls: 1 after `catalogue()`, 2 after one `open()`.
+3. **Phase B adds three test files:** `packages/webui/tests/tester-browser.test.mjs`,
+   `tester-cli.test.mjs` and `proof-cli.test.mjs`, run whole (they reach `fixture.mjs` through
+   `tester-fixture.mjs`). Phase B is 36 files: 33 plus these 3.
+4. **Scope additions approved** (coordinator round 2 ruling 4): `packages/control-board/tests/discord.test.mjs`
+   line 123 and the five webui test files (`fixture.mjs`, `history-fixture.mjs`, `relaunch.test.mjs`,
+   `return-flow.test.mjs`, `discord.test.mjs`). They stop tests reading the real config directory.
+5. **TMPDIR** for phase B is set by the coordinator under `/mnt/storage/scratch/tmp`. No code change.
+
+## Discord exit code
+
+Refusals from the library-seat check exit 2, the code the Discord CLI already uses for configuration and
+binding refusals.
+
+- `packages/discord/src/errors.mjs` line 2: `// exitCode follows docs/TOOLS.md: 1 operation failed, 2 invalid data or configuration, 3 refused by a brake (STOP or a held binding; a supervisor must not retry), 4 usage.`
+- `packages/discord/src/errors.mjs` line 5: `constructor(message, exitCode = 2, details = undefined)`.
+- Config refusal precedent: `packages/discord/src/binding.mjs` line 67, `throw new DiscordError(\`config.dataRoot must be an absolute path: ${path}\`);`. No explicit code, so exit 2.
+- `checkLibraryEngine` in `packages/discord/src/cli.mjs` lines 115 to 122. Each refusal passes `, 2)`:
+  `discord-business-unreadable` (115), `discord-engine-not-allowed` for a non-mosaic-bus engine (119),
+  and `discord-engine-not-allowed` for a mosaic-bus binding that declares `tools` (122).
+- `grep -n ", 3)" packages/discord/src/cli.mjs` finds nothing. `grep -rn "status, 3" packages/discord/tests`
+  finds only existing brake tests in recover.test.mjs and binding.test.mjs. Not changed.
+  `library-seat.test.mjs` asserts 2 on all three refusals.
+
+## Files (round 2, uncommitted)
+
+| File | Change |
+|---|---|
+| `packages/business/src/library-seats.mjs` | new: `loadSeatSets({ dir, rolesDir })` returns `{ librarySeats, creativeSeats }`; lstat-first (ruling 1); read per call |
+| `packages/business/tests/library-seats.test.mjs` | new: 7 tests (6 from r1 plus the dangling symlink) |
+| `packages/conversation/src/reader.mjs` | r1 plus r2: `NOT_LISTED`; `creativeCheck` factory option, called once per `catalogue()`, `open()` and `next()`; `catalogue()` wrapped so a refusal returns `{ ok: false }` |
+| `packages/conversation/tests/reader.test.mjs` | r1: 3 M7 tests, now on `creativeCheck`; r2: 1 spy test (one factory call per catalogue) |
+| `packages/control-board/src/serve.mjs` | `REFUSAL_STATUS`: `conversation-not-listed` 404, `conversation-business-unreadable` 503; `export creativeCheck(dir = configDir())` (factory); `createServer({ businessDir = configDir() })` wires `creativeCheck: creativeCheck(businessDir)` |
+| `packages/control-board/tests/creative-hidden.test.mjs` | new: 4 tests (3 from r1 plus known-and-unknown id both 503), switched to `creativeCheck` |
+| `packages/control-board/tests/serve.test.mjs` | pin test adds `NOT_LISTED` and `conversation-business-unreadable`; conversation fixture passes `businessDir` |
+| `packages/control-board/tests/discord.test.mjs` | line 123 passes `businessDir` (ruling 4) |
+| `packages/discord/src/cli.mjs` | `checkLibraryEngine` called from `prepare()`; exit 2 |
+| `packages/discord/tests/helpers.mjs` | `makeDeployment` creates an empty `businesses/` beside `config.json` |
+| `packages/discord/tests/library-seat.test.mjs` | new: 5 tests, all `--offline`, all asserting exit 2 |
+| `packages/webui/tests/fixture.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/history-fixture.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/relaunch.test.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/return-flow.test.mjs` | `businessDir` on the board start (ruling 4) |
+| `packages/webui/tests/discord.test.mjs` | `businessDir` on the board start (ruling 4) |
+
+Not touched: `packages/business/src/index.mjs`, `packages/discord/src/binding.mjs`, `scripts/stack-copy.sh`.
+
+## Brief item to test map
+
+| Brief item | Test |
+|---|---|
+| Q1 helper: library and creative sets from business files | `business/tests/library-seats.test.mjs` "library seats come from library businesses..." |
+| Q1 a non-library business puts no seat in either set | `library-seats.test.mjs` "a business with no library project..." |
+| Q1 absent businesses directory gives empty sets | `library-seats.test.mjs` "an absent businesses directory gives empty sets" |
+| Q1 any other failure throws, no empty set | `library-seats.test.mjs` "a businesses path that is not a directory throws"; "a businesses symlink to a missing target throws"; "a business file that can't be read throws"; "a business file that is not valid JSON throws" |
+| Round 2 ruling 2: one read per public call | `conversation/tests/reader.test.mjs` "one catalogue calls the creative check once..." |
+| M7 hidden from catalogue, open and next | `control-board/tests/creative-hidden.test.mjs` "the check hides the creative seat..."; r1 reader tests (catalogue, open, next, symlink and placeholder) |
+| M7 second wall: thread store | `creative-hidden.test.mjs` "a thread store is not a root from a spec..." (asserts `rootsFromSpecs` drops it, then a root over it is hidden with 404 `conversation-not-listed`) |
+| M7 unreadable business refuses listing and open | `creative-hidden.test.mjs` "an unreadable business file refuses the listing and open with 503" |
+| Coordinator follow-up: known and unknown id both 503 when unreadable | `creative-hidden.test.mjs` "with an unreadable business file, a known and an unknown id both refuse with 503" |
+| M8 non-mosaic-bus engine on a library seat | `discord/tests/library-seat.test.mjs` "a library seat's binding on a non-mosaic-bus engine is refused" (exit 2, message names the engine) |
+| M8 mosaic-bus binding that declares tools | `library-seat.test.mjs` "...declares tools is refused, and the message names tools" (exit 2) |
+| M8 mosaic-bus, no tools, allowed | `library-seat.test.mjs` "...with no tools passes the engine rule" |
+| M8 unreadable business file | `library-seat.test.mjs` "an unreadable business file refuses check with discord-business-unreadable" (exit 2) |
+| M8 seat in no library business checks clean | `library-seat.test.mjs` "a binding on a seat that is in no library business checks clean" |
+| Q3 reconcile false | r1 reader test asserts `[false, "conversation-not-listed", false]` |
+| Q4 HTTP 404 and 503 | `creative-hidden.test.mjs` (status asserted); `serve.test.mjs` pin test |
+
+## Choices (for Filbert to check)
+
+1. **Absent versus unreadable `businesses/`.** Only nothing at the path reads as empty (lstat ENOENT). A
+   dangling symlink, a file, or an unreadable directory throws. Coordinator ruling 1.
+2. **Sets are read once per public call.** `creativeCheck()` runs once in each of `catalogue()`, `open()` and
+   `next()`. The returned predicate answers every root in that call. A catalogue with zero roots still
+   loads the sets once, so an unreadable business file refuses even an empty list. Coordinator ruling 2.
+3. **Behavior change, kept on coordinator ruling (round 2 follow-up): an unknown id or cursor loads the sets
+   first.** In `open()`, the check runs after `checkCaller` and before `resolveConversation`. In `next()`, it
+   runs at the start of the try. So with an unreadable business file, a known id and an unknown id both give
+   503 `conversation-business-unreadable`, where round 1 gave 404 `unknown-conversation` for the unknown id.
+   Checking the id first would give 503 for a hidden creative id and 404 for an unknown one, which reveals
+   whether the hidden id exists. Loading first answers every id the same way (fail closed). This reverses
+   round 1 choice 3. Test: `creative-hidden.test.mjs` "with an unreadable business file, a known and an unknown id both refuse with 503".
+4. **Discord refusals use the `code: message` form and exit 2.** Exit 3 is for brake refusals (STOP or a held
+   binding). A seat's engine or library membership is not a brake. The business CLI is not used as precedent.
+5. **The thread-store wall exists in part already.** `rootsFromSpecs` (`reader.mjs` line 44) drops any
+   sessions directory that is not `<project>/.pi/state/<seat>/sessions`. The M7 check is the second wall, for
+   roots built another way. The test checks both.
+
+## Static checks (read-only; no node)
+
+- **COPY_PATHS** (`scripts/stack-copy.sh` 29 to 41): `packages/business/src`, `packages/conversation/src`,
+  `packages/discord/src` and `packages/library/src` are present. `packages/control-board/src` is not. COPY_PATHS
+  is not changed.
+- **Stale names.** `grep -rn -E "isCreative|creativeRootPredicate" packages scripts` finds nothing after this round's edits.
+- **Board starts without `businessDir`.** Webui: all five direct starts pass it. Control board:
+  - `serve.test.mjs` has seven single-line starts without it (lines 402, 445, 464, 483, 509, 528, 907) and four
+    multi-line starts without it (114, 149, 229, 258). None of those tests reaches a conversation route.
+    Every conversation route call in the file (lines 1027 to 1171) follows a start that passes `businessDir`
+    (1006, 1075, 1124). Checked by line order.
+  - `creative-hidden.test.mjs` builds `creativeCheck(f.dir)` on its own scratch directory. No default is used.
+  - `discord.test.mjs` passes `businessDir` (line 123).
+- **Consumers of the two fixtures** (exact import strings, `from './fixture.mjs'`, `from './history-fixture.mjs'`):
+  - Direct `fixture.mjs` importers, 31 test files: board-held, browser-edge, browser, bus-browser, bus,
+    chat-browser, chat, discord, docs-browser, editor-browser, editor, instances-browser, limits-browser,
+    limits-route, messages, preview, proof, relaunch, return-flow, routes-browser, send-browser, send, serve,
+    settings-form, shell, sso-browser, sso, tester-listener, usage-browser, usage, views.
+  - `history-fixture.mjs` importers, 2 test files: conversation, history-return-flow.
+  - Total fixture consumers: 33. Plus `tester-browser`, `tester-cli` and `proof-cli` (through
+    `tester-fixture.mjs`, ruling 3): 36 files in phase B.
+
+## Phase B commands (after "slot clear" only)
+
+TMPDIR is set by the coordinator under `/mnt/storage/scratch/tmp`. The commands below assume it. The new
+tests call `tmpdir()`, so an unset TMPDIR would put them under `/tmp`, which bwrap hides.
+
+```sh
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/conversation && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/discord && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/business && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/control-board && node --test tests/
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e && scripts/test-discord.sh
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/cli && node --test tests/stack-copy.test.mjs
+cd /mnt/storage/src/mosaic-stack/.claude/worktrees/agent-a1b36cb7769b3d00e/packages/webui && node --test tests/board-held.test.mjs tests/browser-edge.test.mjs tests/browser.test.mjs tests/bus-browser.test.mjs tests/bus.test.mjs tests/chat-browser.test.mjs tests/chat.test.mjs tests/conversation.test.mjs tests/discord.test.mjs tests/docs-browser.test.mjs tests/editor-browser.test.mjs tests/editor.test.mjs tests/history-return-flow.test.mjs tests/instances-browser.test.mjs tests/limits-browser.test.mjs tests/limits-route.test.mjs tests/messages.test.mjs tests/preview.test.mjs tests/proof.test.mjs tests/relaunch.test.mjs tests/return-flow.test.mjs tests/routes-browser.test.mjs tests/send-browser.test.mjs tests/send.test.mjs tests/serve.test.mjs tests/settings-form.test.mjs tests/shell.test.mjs tests/sso-browser.test.mjs tests/sso.test.mjs tests/tester-listener.test.mjs tests/usage-browser.test.mjs tests/usage.test.mjs tests/views.test.mjs tests/tester-browser.test.mjs tests/tester-cli.test.mjs tests/proof-cli.test.mjs
+```
+
+The webui line is 36 files, run whole. `history-fixture.mjs` and `tester-fixture.mjs` run through their
+consumers. No test has been run. The expectations above come from reading the code.
+
+## Open items
+
+a. Phase B checks the dangling-symlink test on this platform (lstat then readdir ENOENT must throw).
+b. Phase B checks the spy count (1 after catalogue, 2 after one open). A failure here means a public call
+   reads the factory more than once.
+c. Choice 3 is settled by the coordinator: keep 503 for unknown ids too. Phase B checks the new known-and-unknown test.
+d. The browser-based webui tests need a browser in this environment. A failure there would be environmental.
+   Phase B will show which.
+e. Nothing here has been executed. Phase B checks every expectation, including the unreadable-file test
+   (EACCES must throw), the root skip (uid 0 skips), and the webui consumers.
+
+## Resolved
+
+- Dangling symlink at `businesses/` (round 1 open item a, and round 1 question 1): refuses, ruling 1.
+- Tester and proof CLI tests (round 1 question 2): join phase B, ruling 3.
+- Per-root reads (round 1 open item b): replaced by one read per public call, ruling 2.
+
+## Rebase onto aca16404c, run limits, index export (2026-10-22, sage-2708)
+
+Added after the text above; nothing above is edited. "Nothing is committed" above was true when written.
+
+- Commit `6f656abac` on `researcher/row220-r2`, one commit, rebased from da9555ca2 onto origin/refactor
+  `aca16404c`. Row 253 has not landed; this rebases again onto 253's tip before any gate.
+- Drift check, da9555ca2..aca16404c against my 18 paths: one overlap, `packages/discord/src/cli.mjs`
+  (the processing-control imports, rows 264 and neighbours). The conflict was the import block only. I
+  kept both sides: the two landed `processing-control` imports and my `loadSeatSets` import. No landed hunk
+  is reverted. `checkLibraryEngine` and its call in `prepare()` merged without a marker.
+- Board starts: no test added since da9555ca2 starts the control board or reads a conversation route
+  without `businessDir`. `packages/webui/tests/shell.test.mjs` fakes the board and does not start it.
+- Two edits since the r2 text: (1) a missing space in `reader.mjs` `next()` (`held =typeof`) fixed;
+  (2) `packages/business/src/index.mjs` gets `export { loadSeatSets } from "./library-seats.mjs";`. The text
+  above says "no export line". RULINGS.md Q1 says the helper is "exported from the package index" and the
+  scope amendment lists "its export line", so the file wins and the export is added. The two callers still
+  import by path, so nothing needs the export today. Filbert: drop the line if you read the ruling otherwise.
+  The export adds no test; `node --check` has not been run on it (no node before the CLEAR).
+
+### Run limits (fixed before any run)
+
+Every node file runs as its own `setsid -w timeout -k 10 LIMIT node --test FILE`; nothing runs unbounded.
+
+- Node test files: LIMIT 900 s. I found no recorded per-file time for the conversation, discord, business,
+  control-board or webui files. 900 s is above the longest recorded whole-package run I know of (cli, 591 s,
+  row 281 BUILD.md "Runs" step 3), so it holds the 3x rule for any single file. The first run records each
+  file's time; if a file passes 300 s, the limit is re-derived from it before the next run.
+- Shell scripts: `timeout -k 10 LIMIT bash scripts/test-X.sh`, LIMIT = 3x the longest recorded run plus
+  120 s, taken from Megavolt's row 281 table (`agents/megavolt/work/queue-281/BUILD.md`, from Gander's
+  `agents/gander/work/queue-278/SHELL-LIMITS.json`). A script with no limit does not run.
+
+| Script | LIMIT | Script | LIMIT |
+|---|---|---|---|
+| test-auth | 126 s | test-land-work | 158 s |
+| test-conductor | 145 s | test-queue | 191 s |
+| test-config | 130 s | test-release | 157 s |
+| test-discord | 147 s | test-task | 231 s |
+| test-extension-package | 130 s | test-foundation | 240 s |
+
+Any timeout goes to Sage, then Mos, unplaced (mos-1275).
+
+## Round 2b: Filbert's early look and sage-2719 (2026-10-22T14:46Z)
+
+Added after the text above; nothing above is edited. Where earlier text says `businessDir`, the parameter is
+now `configDirectory` (below). Second commit on `researcher/row220-r2`, on top of ea6dc9eff. Not pushed, not
+run; `node --check` has not been run on any of these files (no node before the CLEAR).
+
+Rulings applied (sage-2719): Q1 keep the index export. C1, C2 and the fixture scope are changes.
+
+### Fixture scope: the parameter is a config directory
+
+`createServer` took `businessDir`, but `creativeCheck(dir)` reads `<dir>/businesses`, so every fixture that
+passed `join(root, 'businesses')` made the reader look in `<root>/businesses/businesses`. That read nothing
+(ENOENT, empty sets): isolation from the real config held by accident. Now:
+
+- `createServer({ configDirectory = configDir() })` in `serve.mjs`. The parameter is not named `configDir`
+  because the import of that name is the default's source.
+- Every fixture passes the config directory it owns: `configDirectory: root` in the five webui files,
+  `f.root` in `control-board/tests/discord.test.mjs`, and `f.configDirectory` in `serve.test.mjs`.
+  `conversationFixture()` and `replyFixture()` both return `configDirectory: root`. The seven reply starts
+  that passed `f.businessDir` (undefined, falling back to the real `configDir()`) now pass a real value.
+- The dead `mkdirSync(join(root, 'businesses'))` lines in the five webui fixtures and in `serve.test.mjs`
+  are removed. So is the one in `discord/tests/helpers.mjs` `makeDeployment`, whose comment said "a missing
+  one refuses"; that was false (lstat ENOENT gives empty sets). The comment now says nothing there means no
+  library seat. Tests that need a `businesses/` directory create it: `writeJson` does, and the two
+  unreadable-file tests in `library-seat.test.mjs` call `mkdirSync` themselves.
+- Proof that the fixture's own business file is the one read: the new default-reader test (C2) hides `bean`
+  and shows `pm`, and nothing else in that fixture says which is which.
+
+### C1: M8 on `run`
+
+`library-seat.test.mjs` gains three `run` tests: a raw engine, a mosaic-bus binding with `tools`, and an
+unreadable business file. Each asserts exit 2 and the code in stderr, and that `s.d.journalDir` does not
+exist (`ensureJournal` comes after `prepare()` in `run`, so nothing was started). `run()` calls
+`initializeControl(dataRoot)` first, because `run` stops at `assertProcessing` before `prepare()`, as the
+STOP test in `binding.test.mjs:203` does. There is no `run` test for a clean seat: that would go on to the
+network.
+
+### C2: the default reader
+
+`creative-hidden.test.mjs`, "the board's default reader hides a creative seat's session from the listing and
+the detail route". It calls `startServer` with no `conversationReader`, `configDirectory: f.dir`, a `bean`
+session and a `pm` session on disk, and drives HTTP: the listing holds `pm` only; bean's detail is 404
+`conversation-not-listed`; pm's detail is 200; after a broken business file lands the listing is 503
+`conversation-business-unreadable`.
+
+### Mutants to throw (CLEAR only; none thrown; the kill claims are unverified)
+
+| Id | Mutation | Meant to be killed by |
+|---|---|---|
+| M7-w | delete `creativeCheck: creativeCheck(configDirectory),` in `createServer` (`serve.mjs`) | the default-reader test, first assertion (the listing shows `bean`) |
+| M7-c | `hiddenCheck()` in `reader.mjs` open() returns `() => false` | reader.test "hides the creative seat" and the `creative-hidden` 404 asserts |
+| M7-o | `creativeCheck` catch returns an empty set instead of throwing | the 503 asserts in `creative-hidden` |
+| M8-p | delete `checkLibraryEngine(...)` in `prepare()` | the three `check` refusals and the three `run` refusals; one mutant covers both verbs because they share `prepare()` |
+| M8-e | `loadSeatSets` returns empty sets on any lstat error | `library-seats` ENOENT-vs-file tests |
+
+### `refusalResponse` and `catalogue()`'s refusal (past "predicate wiring and REFUSAL_STATUS only")
+
+Why it is needed: the reader's `catalogue()` now returns a refusal when the business check throws (M7: no
+partial list), and `conversationResponse` had no way to turn a catalogue refusal into a status. `open` and
+`next` already built `{ status: REFUSAL_STATUS[code] ?? 422, body: { error, refusal: { code, reconcile } } }`
+inline; that expression moved, character for character, into `refusalResponse(out)` so the listing could
+use it too.
+
+No existing route's status or body changes:
+
+- `open` and `next` refusals: the same expression, now behind a function. `git diff aca16404c..HEAD --
+  packages/control-board/src/serve.mjs` shows the line as a move.
+- `/api/conversations` success: `{ status: 200, body: listing }` where `listing` is what the route returned
+  before. `catalogue()` returned `ok: true` on every path before this row, so the new branch is reached only
+  by the business refusal.
+- The "no parameters are accepted" 400 is untouched.
+
+Phase B runs `serve.test.mjs`, `discord.test.mjs` and the conversation route tests whole, so Filbert can
+check this statement against a green run.
+
+### Smaller changes from the early look
+
+- Spy test: one `next()` call adds a third `creativeCheck` count (`reader.test.mjs`). The catalogue assert
+  also checks `refusedRoots` is empty, in the same test and in the thread-store test in `creative-hidden`.
+- `library-seats.test.mjs` mode-000 test pins `BusinessError` and its message (`must be a regular,
+  non-symbolic-link file`, from `readJsonFile`'s open failure).
+- "passes the engine rule" now asserts exit 0 and `offline check passed`. The expectation is unverified: if
+  a mosaic-bus binding fails some other offline check, that is a first-run red to place (mos-1272).
+
+### Carried, not changed here
+
+- `conversation/src/controller.mjs:176` builds a reader with no `creativeCheck`. No `src` file imports it
+  today; a live wiring must pass the check. Raised for Sage.
+- `discord run` reads the business file once at start. `engine` and `tools` are FIXED_KEYS, so only a
+  business-file change while a connector runs goes unseen until the next start.
+- `creative-hidden` and `library-seats` use the repo `roles/` as the default `rolesDir`.
+
+### Gate additions
+
+Phase B list is unchanged: the same suites run whole, plus the files above are inside them. The drift check
+against `aca16404c..refactor`, including files these tests copy or read, repeats after the rebase onto 253.
+
+## Round 2c: refusalResponse statement corrected from the diff, controller.mjs follow-up (2026-10-22T14:55Z, sage-2729)
+
+Appended after Round 2b; nothing above is edited. This replaces Round 2b's refusalResponse statement, which I
+wrote from memory of the code. Source: `git diff aca16404c HEAD -- packages/control-board/src/serve.mjs` and
+`packages/conversation/src/reader.mjs`, read in full. No test has run.
+
+### What the diff shows in serve.mjs
+
+- `open` and `next` refusal: the object expression `{ status: REFUSAL_STATUS[out.refusal.code] ?? 422, body: {
+  error: out.refusal.message, refusal: { code, reconcile } } }` moved unchanged into `refusalResponse(out)`.
+  The two call sites reach it by `return refusalResponse(out)`. Status and body are identical for every code
+  that reached it before.
+- `REFUSAL_STATUS` gains two keys, `conversation-not-listed` (404) and `conversation-business-unreadable`
+  (503). Before, those codes did not exist, so no earlier response used them or changes. Every other key is
+  untouched.
+- `/api/conversations` with a query string: the 400 `no parameters are accepted` line is untouched.
+- `/api/conversations` success: before, `{ status: 200, body: reader.catalogue() }`; now the same object
+  when `listing.ok` (it is the same `listing`), so the 200 body is unchanged.
+- The one new response shape: `/api/conversations` can return a refusal (503 or the refusal's status) when
+  the business check throws. That is the M7 behaviour, not a change to an existing route's response.
+
+### What the diff shows in reader.mjs, past my Round 2b statement
+
+`catalogue()` is now wrapped in `try { ... } catch (err) { return refuse(err); }`. `refuse` returns a refusal
+object for a `Refusal` and rethrows anything else (`reader.mjs:352-355`). So a non-Refusal error still
+propagates as before. A `Refusal` escaping the loop body would now come back as `{ ok: false }` where it
+used to throw. The loop already catches `Refusal` from `listSessionFiles` and from `summarize`, so the only
+`Refusal` that newly reaches the wrapper is the hidden check's. I have not confirmed that `listRoots()`
+(`rootsFromSpecs`, `loadRegistrations`) never throws a `Refusal`; if it does, that call now returns a
+refusal. Filbert's round check should read `rootsFromSpecs` for `Refusal` throws.
+
+Round 2b said the old `catalogue()` "returned ok: true on every path". True for returns; it could throw.
+
+### Named follow-up for DEFERRED (Sage lands it with 220; it does not block 220)
+
+`packages/conversation/src/controller.mjs:176` builds a reader with no `creativeCheck`. No `src` file imports
+`controller.mjs` today, so no live path leaks. Whoever first wires `controller.mjs` live must pass
+`creativeCheck` (`creativeCheck(configDirectory)` from `control-board/src/serve.mjs`, or the reader's own
+equivalent) and add a test that a creative seat's sessions stay hidden through that path.
+
+## Round 2d: can listRoots() throw a Refusal into catalogue()? No (2026-10-22T14:53Z, sage-2730)
+
+Appended after Round 2c; closes the question Round 2c left open. Static read on 9a9f6dd54; nothing run.
+Filbert reached the same answer independently (filbert-220-r2c-static).
+
+`catalogue()` calls `listRoots()` inside the new `try`. In production that is `serve.mjs:261`,
+`roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations)`. The only `Refusal` class
+the reader catches is the one in `conversation/src/safe-fs.mjs:21`.
+
+- `rootsFromSpecs` (`conversation/src/reader.mjs:38-71`) calls `resolve`, `join`, `basename`, `Array.find`,
+  `toTime` and `samePath`, and constructs no `Refusal`.
+  - `toTime` (`conversation/src/pi.mjs:21-26`) returns a value or null and has no throw.
+  - `samePath` (`seat/src/seat.mjs:261-269`) wraps `realpathSync` in try/catch and returns false.
+- `loadRegistrations` (`control-board/src/scan.mjs:272-292`) catches `SeatError` and rethrows anything
+  else. It calls `readRegistration` (`seat/src/seat.mjs:200-216`), which throws `SeatError` only.
+- `grep -n "Refusal\|refuse(" packages/control-board/src/scan.mjs packages/seat/src/seat.mjs` finds
+  nothing, and neither file imports `safe-fs.mjs` (checked with `grep -n "^import"`). A `Refusal` cannot
+  originate in either.
+- Inside the loop, `listSessionFiles` is caught at `reader.mjs` (the `catch (err)` that rethrows
+  non-Refusals) and `summarize` turns an `openSessionFile` Refusal into a `denied` row.
+
+So the only `Refusal` that reaches the new catch is the hidden check's `conversation-business-unreadable`.
+Any other error still throws through `refuse()` (`reader.mjs:352-355`) exactly as before.
+
+Therefore `/api/conversations` has no status change for a path that existed before this row: the old
+throw paths are unreachable by a `Refusal`. The one new response is the business refusal, already pinned by
+the creative-hidden 503 assertion and the reader catalogue-refusal test. No extra test is added.
+
+The exception is an injected `roots` function that throws a `Refusal` itself; only a test could pass one,
+and none does.
+
+Time correction (2026-10-22T14:51:01Z): the heading times of Round 2c (14:55Z) and Round 2d (14:53Z) were written before I read the clock. The commits were made at 14:49:40Z (9a9f6dd54) and 14:50:52Z (176ac262e). The heading of Round 2b (14:46Z) is also an estimate; its commit e4a204836 was made before 14:47:53Z.
+
+## Round 4: rebase onto 45dca69f6, drift check (2026-10-23T18:53:43Z, sage-3576)
+
+Appended; nothing above is edited. Git only; nothing run, nothing pushed. Branch researcher/row220-r4 holds the
+five row 220 commits on 45dca69f6 (origin/refactor, 10-23). Earlier base: 48e450ce8 (row 253).
+
+- Rebase: clean. `git range-diff 48e450ce8..3ef6da90d 45dca69f6..researcher/row220-r4` shows all five commits as `=`,
+  so no patch changed.
+- Landed in 48e450ce8..45dca69f6: 1175 files (47 packages/bus, 32 webui, 29 cli, 10 plugins, 9 seat, 4 harness,
+  2 tasks, 7 scripts, BUILD-LOG.md, the rest agents/ and docs/).
+- Path overlap with this row's 19 paths: none.
+- Landed files in the packages these tests touch: webui (src/serve.mjs, src/cli.mjs, chat and bus files,
+  tests). Row 220's webui test changes are five fixtures that start the control-board server with
+  `configDirectory: root` and start the webui server with only `{ port, board }`; no landed webui file passes or reads
+  configDirectory. The landed webui tests are not in this row's change set, but a whole webui run covers them.
+  No landed file in control-board, conversation, discord or business.
+- Other users of the touched symbols (git grep on the r4 tree for createReader, rootsFromSpecs, creativeCheck,
+  configDirectory, businessDir, loadSeatSets, checkLibraryEngine, conversationReader outside this diff):
+  only conversation/src/controller.mjs:173-176 (the follow-up named in Round 2c) and the conversation README.
+- Hash pins: grep for 64-hex in packages/*/tests and scripts finds 364 files (positive control), and none pins a
+  row 220 source file by hash. Path-string hits for packages/discord/src/cli.mjs (copy-service.test.mjs,
+  scripts/test-discord.sh, discord-service.sh) are paths, not hashes.
+- Added to the gate list: `packages/discord/tests/helpers.mjs` is imported by 19 discord test files, and this row
+  removed its empty `businesses` mkdir. Phase B must run the discord package whole (and `scripts/test-discord.sh`),
+  not only library-seat.test.mjs.
+
+## Round 5: phase B on 2bb146b28, R1 and R2 fixes (mos-1528) (2026-10-23T20:21:39Z, sage-3712)
+
+Appended; nothing above is edited. The tree is 2bb146b28 plus the commits of branch researcher/row220-r5.
+
+Phase B receipts on 2bb146b28 (researcher-r220-kit out-b1, out-b2, out-b3, out-mut, out-npm):
+
+- discord 20 files, 200 pass; conversation 7 files, 187 pass; scripts/test-discord.sh rc=0, 82 passed.
+- control-board 7 files, 128 pass, 1 fail (serve.test.mjs, R2 below); business 26 files, 237 pass, 1 fail
+  (library-seats.test.mjs, R1 below).
+- webui: first run 409 pass, 1 fail (editor-provenance.test.mjs). Cause: the esbuild in the worktree's
+  node_modules resolved to the root copy (0.28.1) and not to packages/webui's own pin. Fix (R3, no repo change):
+  `cd packages/webui && npm ci --ignore-scripts --no-audit --no-fund` in the worktree, output in out-npm/npm-ci.txt;
+  esbuild is then 0.28.2. Rerun of all 65 webui files whole with MOSAIC_REQUIRE_EDITOR_BUILD=1: 65 of 65 rc=0, 410
+  pass, 0 fail.
+
+Fixes (both are test-only; src/ is unchanged from 2bb146b28; Mos ruled both in mos-1528):
+
+- R1, `packages/business/tests/library-seats.test.mjs`, test "M7/M8: a business file that can't be read throws; no
+  empty set". The fixture registers `rmSync(root)` as a `t.after` hook before the test registers its
+  `chmodSync(file, 0o600)` restore, so on the way out the restore found the file already removed and threw ENOENT.
+  Old: `t.after(() => chmodSync(file, 0o600));`. New: the same call inside try/catch that rethrows anything but
+  ENOENT. The assertion is unchanged.
+- R2 (option A, mos-1528), `packages/control-board/tests/serve.test.mjs:1073`, test "conversation routes (F16): a
+  foreign Host, a wrong port and a cross-origin Origin get 403 before the reader runs, with no CORS headers".
+  Failure: the same-origin request at the end reached the route, the spy's `catalogue` returned the number
+  `calls.push(...)` gives (1), and 220's `conversationResponse` reads `listing.ok`, so `refusalResponse(1)` threw on
+  `out.refusal.code` and the route answered 500. Old text:
+  `const spy = { catalogue: () => calls.push("catalogue"), open: () => calls.push("open"), next: () => calls.push("next") };`
+  New text: `catalogue` records the call, then returns `{ ok: true, conversations: [], refusedRoots: [] }`; `open` and
+  `next` are unchanged (the test never reaches them with a passing request). The assertions are unchanged: 200 for the
+  same-origin request and `calls` equal to `["catalogue"]`. serve.mjs stays as 220 has it.
+  Added test, same file before "every refusal code the reader can raise has an HTTP status": a reader whose
+  `catalogue()` returns `{ ok: false, refusal }` gets `conversation-business-unreadable`'s status (503) and the body
+  `{ error, refusal: { code, reconcile } }`. No such route test existed; the earlier claim that no route's status or
+  body changed was wrong for a reader that returns a bare value, which the old spy did.
+
+Mutants thrown on 2bb146b28 (out-mut; the base run for library-seats was red from R1, so a kill by that file is not
+shown there):
+
+| Mutant | Result |
+| --- | --- |
+| M7-w | killed by control-board creative-hidden ("the board's default reader hides a creative seat's session…") |
+| M7-c | killed: creative-hidden 4 fail, conversation reader 3 fail |
+| M7-o | killed: creative-hidden 4 fail |
+| M8-p | killed: discord library-seat 6 fail |
+| M8-e | SURVIVED: no test failed other than the base red in library-seats; handled in the next entry |
+
+Run limit: stack-release.test.mjs took 644 s. The per-file limit is 3 x 644 = 1932 s. Sage's gates run cli whole
+under 2100 s.
+
+Reruns owed after r5 (run on Sage's CLEAR): the touched files whole (library-seats, serve, and the M8-e test),
+control-board whole, business whole, and every 220 mutant, M8-e included. Results are appended as a new entry.
+
+## Round 5b: correction of the M8-e kill claim, and the test that kills it (2026-10-23T20:21:52Z, sage-3715)
+
+Appended; nothing above is edited. This is a correction to the "Mutants to throw" table in this file (the M8-e
+row, around line 270), which says M8-e, "`loadSeatSets` returns empty sets on any lstat error", is killed by the
+`library-seats` ENOENT-vs-file tests. That claim is wrong. M8-e changes the lstat catch to
+`return { librarySeats: new Set(), creativeSeats: new Set() };` for every error code, so only a test that makes lstat
+fail with a code other than ENOENT can kill it. The file-as-businesses test and the dangling-symlink test I named
+make lstat succeed or fail with ENOENT, never another code, so they pass under M8-e. Phase B on 2bb146b28 showed
+the mutant surviving (out-mut, M8-e: no failure besides the base red).
+
+Added in this commit, `packages/business/tests/library-seats.test.mjs`: "M7/M8: a config directory under a regular
+file throws (lstat fails with ENOTDIR); no empty set". The config path is a regular file, so
+`lstat(<file>/businesses)` fails with ENOTDIR; the test expects `BusinessError` matching "cannot list businesses".
+It is a new test in this row's own file, in its own commit, and droppable without touching R1 or R2.
+
+The rerun of M8-e on r5 (the test must fail under it) is owed and runs on CLEAR; the result is appended as a new
+entry.

agents/violet/README.md

@@ -0,0 +1,8 @@
+# Violet
+
+Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 297 (the GitHub grant method, handed over from Bushroot).
+
+No launcher in this directory. The seat runs as a T3 thread (thread 6229eb89) and works in its own worktree. It has no
+credentials of its own; it pushes only its own `violet/*` branches through the repository credential helper (mos-0981),
+never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
+2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).

agents/violet/work/queue-297/BUILD.md

@@ -1,154 +0,0 @@
-# Row 297: GitHub grant method (#1803)
-
-Owner Violet (thread `6229eb89-192c-4ca8-9a07-204a33458de3`), reviewer Dewey.
-Assignment: Mos mos-1498 / Q245, 2026-10-23. Branch `violet/row297`.
-Brief: `docs/plans/2026-10-23_mvp-readiness-rows.md`, GitHub grant method section.
-
-## Status: Untested; Q-B3 contract review before implementation
-
-First commit merges row 198 at `14fe7513c`; second merges its next head `4d8123b0a`.
-Both are merge commits; Bushroot's commits remain byte-identical. New 198 heads will
-be merged, never rebased/amended/force-pushed. Row 198 is unverified and its old-test
-approval is pending. Row 297 cannot land before row 198 passes its own gate.
-
-Read AGENTS.md, agents/README.md, Bushroot's queue-198 BUILD.md and the supplied brief.
-Recovered #436b r5 at `1be535aca`, section 10 S1-S6, and inspected row 236's Gitea
-implementation, current credential schema, CLI and broker integration. Bushroot
-confirmed there are no prior Q-B3 answers or started row 297 work.
-
-`DESIGN.md` answers Q-B3, proposes per-method S4, and names the repository identity
-and renewal consumer boundaries requiring Sage's ruling. No implementation starts
-before Dewey and Megavolt read the answer, as brief Step 1 requires. Shared Gitea
-behavior remains unchanged. No credential file or live token was read; research
-used public official GitHub documentation only.
-
-## Verification and slot
-
-- `scripts/mosaic queue next violet` in this worktree refused linked-worktree execution.
-- Retried in `/mnt/storage/src/mosaic-stack`: reported an unknown rendered view and
-  `nothing` for Violet. No queue file changed. Sage owns registration and queue changes.
-- No node, test, webui build, gate or mutant run. Sage sage-3614 requires CLEAR first.
-- Merge commits are explicitly labeled Untested per Mos's assignment.
-
-## Pre-existing tests changed by Violet
-
-None. Inherited row 198 test changes belong to Bushroot and are recorded in that
-row's BUILD.md; Violet has neither changed nor claimed verification of those files.
-
-## Push and landing
-
-Only `violet/*` may be pushed. No push, PR, landing or queue movement yet. First push
-ETA communicated as 20:00 UTC, subject to Q-B3 review. Sage owns the gate and landing.
-
-## First push: 6af63e1d3 (2026-10-23)
-
-Pushed only `violet/row297`, normal new-branch push. Packet sent as violet-0004 to
-Sage, Dewey, Megavolt and Mos with its commit link and the two explicit scope
-rulings. `git diff --cached --check` passed before the packet commit. Verified
-14fe7513c and 4d8123b0a are ancestors; only the packet, this BUILD and append-only
-session/build-log entries differ from 4d8123b0a. No product or test delta.
-
-Independent inspection after the packet confirms the boundaries: runtime.mjs
-constructs only giteaGrant/giteaKeys; broker grants.run routes only to Gitea;
-credential reference dates are calendar days, and publication identity is Gitea
-fork-based. A GitHub renewal consumer cannot safely reuse those assumptions
-without the method-specific contract. Implementation waits on the required
-Q-B3 reading and Sage's scope ruling, not on a routine coding choice.
-
-## Implementation in progress (sage-3620; dewey-0931; megavolt-0206)
-
-Both Q-B3 reads completed with no design blocker. Sage selected the App bot on
-configured repositories, no accounts/forks, and protected mint/renewal/evidence/
-revoke/expiry in this row. Consumer creation is excluded. DESIGN.md now names
-R1-R5 and exact clock constants, plus method-specific CLI shapes and workflow
-exclusion. PLAN.md records inline implementation. Tests were authored before
-their implementations, but no red or green execution is claimed: Sage's Node/test
-hold still applies. No test, syntax check through Node, mutant or suite has run.
-
-Code in progress: private file/HTTPS/admin boundary; event-backed durable grants
-and generation cleanup; callback-only renewal; broker/CLI/runtime dispatch;
-additive reviewed schema support without changing role policy files. New tests
-use a fake HTTPS API and generated scratch CA/key. Their fake origin is injected
-only through tests; metadata still rejects every HTTP origin, including loopback.
-
-### Consumer gap for Sage's follow-up row
-
-No GitHub consumer, git helper, mirror push or publication is implemented. The
-protected `Broker.githubWithToken` callback is the stop point. Gitea's generic
-Credentials path has calendar-day dates and fork-specific identity; GitHub tokens
-remain protected generation files rather than loading into that unguarded path.
-A consumer row must call the protected function and honor expiry/cancellation.
-The grant's approval block and README explicitly name this gap.
-
-### Pre-existing test change, Mos authorized
-
-`packages/business/tests/role.test.mjs:209`: exactly 1 insertion / 1 deletion.
-Only the regex changes from `/service must be one of/` to `/unsupported.*scopes/`.
-The refusal of `{service:"github",scopes:[]}` stays. Reason: sage-3620 authorizes
-fixed-scope GitHub declarations; caller-provided scopes now fail on the unknown
-key, rather than on an unknown service. Mos mos-1518 (cc Violet, 19:29:15Z) permits
-this exact change through Sage. A new-file test in business/tests/github.test.mjs
-preserves the closed-service-list check with `not-a-service` and the original
-`/service must be one of/` pattern. No other old test has changed.
-
-## Static pass before first implementation push
-
-Additional new tests cover a known token left by an interrupted mint (no adoption,
-remote cleanup), unsafe slot modes/symlinks, per-agent busy claim, admin rotate
-identity/binding invalidation, fire cleanup/refusal and the lifecycle delete's
-first revoke job. No existing fixture or existing test other than the authorized
-regex changed. Static review corrected the grant.call method/op field collision
-and added revocation sequence binding so an old unspent approval cannot revive a
-revoked grant. Both corrections are unexecuted and remain unverified.
-
-No idle GitHub startup sweep is emitted for a business with no GitHub residue.
-This avoids changing unrelated runtime evidence. The callback's cancellation
-signal is also aborted at the token safety deadline, not only on explicit revoke.
-
-Static dependency inspection found createdCredentials in instance-settings.mjs
-would generate an invalid day-based `credentials.github` reference for a new
-instance. It now excludes this protected grant declaration, as it excludes host;
-a new business/github.test.mjs case pins the human add behavior. This is local
-schema integration needed by the new declaration, not new agent grant authority.
-
-## Row198 moving base: 397ef58be (sage-3687, 2026-10-23)
-
-Merged Bushroot's fix head `397ef58bebef2e265e6332bc3ede05de30c4624c`
-intact after `ab6417475`. No rebase, amend or force push. His round-3 review
-remains open; this is a moving, untested dependency, not acceptance evidence.
-Row297's own source/test candidate is still `53a454185`.
-
-Sage sage-3681 allocated the five-new-file first baseline/fix run to T6, about
-21:55 UTC, with an explicit CLEAR still required. No Node, tests, browser,
-webui build, suites or mutants have run in this session. Consumer stop/gap at
-Broker.githubWithToken is accepted by sage-3681. Dewey reviews the row297 delta;
-the eventual gate must use the latest intact row198 fix head.
-
-## Static review dewey-0944 / dewey-0946 follow-up (UNTESTED)
-
-Dewey found no source blocker in 53a454185 and confirmed the clean carried delta
-at 5ca83173e. Required M1: add a per-path SHA-256 list for the 24 row297 paths,
-then report that digest file's own SHA separately to avoid a self-reference.
-The list will use git blob bytes at the final head sent for the gate.
-
-Lifecycle-delete coverage now includes the second request completing exactly one
-instances.set write after the protected revoke job. New tests are unexecuted.
-N1: sweep closes an active generation at its conservative bound with reason
-expired, preserving the durable grant for a later renewal. N2: installation calls
-require an explicit valid token, with no App JWT fallback. N7: grants.run checks
-keys/identifier before approval lookup. Each change has new-file regression
-coverage, with Node execution still held for Sage CLEAR.
-
-N3 is documented behavior, retained for Gitea parity: human admin remove can
-invalidate cleanup while residues exist; serviceLeft remains until a matching
-slot returns or conservative expiry. N4: official API-version source added to
-DESIGN.md; public GitHub docs list 2026-03-10 as supported. N5: full event scans
-remain acceptable at MVP volume; no cache introduced. N6 for Sage: preserve both
-BUILD-LOG.md and docs/SESSIONS.md seat appends alongside refactor's appends when
-landing; do not replace either append-only history.
-
-Three additional mutants requested by Dewey have named new-file killers:
-- accepting DELETE 401 as revoked: `mutant: closeToken must not count a 401 as proven revocation`;
-- treating status 0/5xx as not-issued: `lost mint response stays visible through restart until conservative expiry equality` and `mutant: mint 500/503 is uncertain issuance and stays serviceLeft`;
-- dropping recheck's controller.signal.aborted: `mutant: shutdown abort alone prevents a pending generation from applying` (no revocation event, so the signal is the only veto).
-No mutant has run; every kill still needs gate evidence.

agents/violet/work/queue-297/DESIGN.md

@@ -1,221 +0,0 @@
-# Row 297: Q-B3 answer and proposed GitHub method contract
-
-Violet, 2026-10-23. Issue #1803. Reviewer Dewey. Proposal for review before code.
-Source contract: #436b r5 section 10, `agents/megavolt/work/436b/DESIGN.md`
-at `1be535aca`. Row 236 is already built; this proposal changes none of its behavior.
-Row 198 dependency: merged `14fe7513c`, then `4d8123b0a`, preserving every commit.
-
-## Q-B3: S1-S6
-
-| Item | Answer |
-| --- | --- |
-| S1 | Agree. Keep `{method, agent, rotateBy, target}`, with `method: "github"` and `target: {projects: [...]}`. Code fixes permissions; the caller cannot name permissions, repository IDs, installation IDs, or an API origin. Resolve projects from reviewed business configuration, and bind the resolved identities in the decision. |
-| S2 | Agree. Keep `<configDir>/secrets/grants/<business>/github/admin`, human set only, never an agent service. For GitHub this contains an App RSA private key, not a PAT. Nonsecret metadata identifies the App, installation, account ID, API origin, set time and rotate-by day. One installation per business and method. Only Jason performs the live bootstrap. |
-| S3 | Agree. Every network call, including preflight, renewal, verification and remote undo, goes through reserved `action.allowed` `grant.call` then `grant.result`, paired by `callId`. Preserve the grant actor and the kind filter, and use `grantDecision` outside the single consume record. No raw response, key, JWT, installation token, authorization header or token digest enters evidence. |
-| S4 | Per method, as section 10 permits. GitHub installation tokens expire within one hour. Recommend a durable approved repository grant, with short-lived token generations renewed only by protected code inside that grant's unchanged binding and rotate-by deadline. Never treat the grant's rotate-by day as a token's expiry. Detailed proposal below. Gitea's mint/issue/settle sequence stays unchanged. |
-| S5 | Agree with local-first order. Block new issuance/use and abort the agent's pending generation first; durably remove the active grant next; revoke each known token remotely last. Keep unresolved generations in `serviceLeft` and retry with sweep. An unreturned token cannot be revoked by ID; its bounded expiry must remain visible until elapsed. Do not uninstall or suspend a shared installation to revoke one agent. |
-| S6 | Agree. Method-specific checks at admin set, every executor start/renewal, and remote undo. Verify App identity, installation identity/account, non-suspension and the required permissions. Pin repository IDs and verify minted reach across every page. No version-number analogy to Gitea; unsupported responses or absent capabilities refuse closed. |
-
-## Provider facts
-
-Checked against official GitHub documentation on 2026-10-23; these are documentation
-findings, not live probes. No credential file was read and no authenticated API call was made.
-
-- [Create an installation access token](https://docs.github.com/en/rest/apps/apps#create-an-installation-access-token-for-an-app):
-  App JWT authentication; explicit `repository_ids` and `permissions` narrow issuance.
-  Omitting either uses the installation's broader defaults. Tokens expire after one hour.
-  Token format is opaque; no fixed-length or 40-character assumption.
-- [Generate an App JWT](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app):
-  RS256 with bounded `iat`/`exp`, at most ten minutes ahead, authenticated with Bearer.
-- [Installation endpoints](https://docs.github.com/en/rest/apps/installations):
-  `GET /installation/repositories` reports token-accessible repository IDs and total count.
-  `DELETE /installation/token` revokes the token used to authenticate that request.
-  This does not provide Gitea's recorded-token-ID deletion or `GET /token` identity contract.
-
-## Approaches and recommendation
-
-1. Mint once per Approve, store with its actual expiry, then require another Approve.
-   Smallest lifecycle but forces another human approval within an hour of each use.
-2. Durable approved grant plus protected renewal, recommended. The approval names the
-   agent, exact project/repository binding, fixed permissions and latest renewal date.
-   Token expiry is separate. This needs renewal, interruption and revoke-race coverage.
-3. A human PAT or copied Gitea account/user lifecycle is not proposed. It does not supply
-   the App issuance contract this brief calls out, and GitHub is not an account-creation
-   API equivalent to Gitea's site-admin path.
-
-The recommendation is Violet's proposal, not an owner decision. Q-B3 must be read by
-Dewey and Megavolt before implementation. Sage must settle the scope points below.
-
-## Proposed per-method S4
-
-The durable authority is the approved binding, not a long-lived token. Raise is chief-only;
-Approve and admin-slot writes retain their existing human gates. Preflight checks and
-binding recheck happen before consume, under an agent claim. Only consume has `decision`.
-
-At grant time, resolve the configured projects to immutable repository IDs and bind the
-definition, relevant role/project configuration and admin metadata. Show the App and
-installation identity, repositories, fixed permissions, grant deadline and automatic
-renewal behavior in the human approval block. Permission proposal: `contents: write`
-plus GitHub's implicit `metadata: read`; no workflow, administration, issue or PR write
-permission. Adding any permission requires a reviewed method change.
-
-Before every generation: check the grant is active, unchanged, unexpired, the agent is
-still eligible, and processing/revocation does not prohibit the operation. Re-run the
-capability floor. Write the mint intent before POST and the result after it. POST always
-includes the exact nonempty repository ID list and the fixed permission map. Verify the
-returned expiry, permissions and all token-accessible repositories before making the
-generation usable. A missing/invalid/past expiry or wider reach revokes the candidate and
-refuses. Never use a stale token during a failed renewal.
-
-Use the actual provider expiry as a timestamp with a safety margin. Token replacement
-must be atomic with respect to revoke: a revoke that wins while mint/verify is pending
-prevents publication of that candidate. Only one generation per agent runs at once.
-New generations cannot widen the original approved repository IDs; changed configuration
-requires a fresh decision. The App private key and JWT never enter the agent credential
-store, and the worker never gets the App key or authority to renew.
-
-There is no claim that a stored token can be identified by a Gitea-style token ID.
-On restart, an interrupted generation is held out of use. Any recoverable token is
-verified/revoked through its own installation authentication; an ambiguous generation
-is not adopted as an applied grant. Where the token was minted but its response/file was
-lost, record unresolved remote reach until the documented maximum lifetime has elapsed.
-An unanswered mint uses a conservative expiry bound that includes the request deadline;
-the implementation must document the clock/response assumptions rather than claim remote
-revocation succeeded. A new generation never hides an older unresolved one.
-
-The concrete token storage and consumer hook are still scope decisions below. A generic
-`Credentials.issue` using only `YYYY-MM-DD` would lose the token lifetime and is unsuitable
-without a method-specific timestamp guard on every use and restart load.
-
-## Scope points for Sage, with reviewer input
-
-These are unresolved integration boundaries found in the existing implementation:
-
-1. Repository authority and identity: `SERVICES`, credential dates, role identity and
-   publish code currently implement Gitea/Vikunja/host, not GitHub. Recommend GitHub App
-   access to the configured exact repositories, with the App bot as service identity;
-   no creation of GitHub user accounts or automatic forks. If row 297 must reproduce
-   per-agent forks, that needs a separate repository/identity contract before code.
-2. Renewal consumer: recommend protected on-demand renewal for the GitHub credential
-   consumer, with timestamp checks and no worker mint endpoint. Confirm whether row 297
-   owns that consumer integration (including GitHub git publication), or only the grant
-   executor/management surface. A stored expiring token with no guarded consumer is not
-   a complete renewal implementation.
-
-## Acceptance and proposed test manifest
-
-Fake API only; never a real GitHub token or a call to github.com/api.github.com. Bind a
-loopback fake explicitly in tests; production origins come only from the admin contract.
-Prefer new test files. No pre-existing test changes without Mos's OK through Sage.
-
-Mirror row 236 X-G1 through X-G15 where meaningful: binding refusals and no writes;
-admin floor/write-on-refusal; approval end to end; foreign/rebound identities; failure
-matrix and revoke leftovers; interruption/restart; approval drift; call/result ordering
-and secrecy; admin replacement invalidation; token replacement ordering; human gates,
-single consume and busy; paginated exact reach; evidence reservation; fire/delete;
-look-alike evidence ignored. Explicitly mark Gitea-only user creation/disable, version
-floor, token-name and token-whoami cases as replaced by App/installation identity,
-fixed permissions, expiry and generation checks, not silently dropped.
-
-Additional expiry cases: expiry before use; past/malformed/missing or excessive lifetime
-in mint response; controlled-clock renewal; renewal refusal after grant rotate-by;
-changed installation/repository/definition/admin binding; failed renewal with no stale
-use; restart with an interrupted mint; revoke during pending mint/verify; unknown remote
-token visible until its conservative expiry bound; no shared-installation deletion.
-
-Mutants mirror these claims: omit explicit IDs; omit permissions; skip identity/floor,
-binding/expiry/reach check; read only one page; publish before verify; mint before intent;
-result before call; skip claim; revive after revoke; keep expired token after renewal
-failure; renew after grant deadline; clear unresolved reach early; perform remote undo
-before local revocation; bypass human/reserved-evidence gates; log a provider secret.
-
-Full touched suites, every `scripts/test-*.sh`, and mutants wait for Sage's CLEAR. Dewey
-approves the final manifest. Row 297 lands only after row 198's own gate passes.
-
-## Build design: rulings and review inputs (2026-10-23)
-
-Sage sage-3620 accepts App bot access to exact configured repositories, no accounts
-or forks, and row297 ownership of protected mint/renewal/evidence/revoke/expiry.
-New GitHub mirror push, publication and credential helpers are excluded. Stop on
-the protected side where the Gitea consumer path cannot carry GitHub safely; Sage
-files the consumer gap. Dewey dewey-0931 and Megavolt megavolt-0206 read Q-B3 and
-report no design blocker. Approach 2 is selected under these rulings.
-
-### Binding and protected interface
-
-Proposed additive configuration: a definition declares `{service: "github"}` with
-no caller scopes; the business role declares `github: {projects: [...]}`, and each
-such project has `remote` plus positive safe-integer `githubId`. These declarations
-are separate from Gitea `identity` and fork-based `publish`. Unknown keys, including
-account/fork requests, refuse. No role policy file or live configuration is changed.
-The grant binding stores the exact project IDs, repository IDs and remote names,
-role/definition digest and admin metadata digest. Renewal compares those immutable
-snapshots to current configuration; it never adopts configuration changes as new
-authority. GitHub scope approvals remain human-only (no Q228 scope fast path).
-
-Expose renewal only as a trusted host function `withToken(business, agent, fn)` in
-protected code, passing `(token, signal)` to the trusted callback. No worker or
-socket verb returns a token or mints one without a durable approval. Token files
-are generation-specific protected files, never evidence. Do not load these into
-`Credentials`, whose calendar-day guards and Gitea helpers cannot enforce expiry.
-That is the consumer gap: publication/credential-helper wiring needs another row.
-
-### Dewey R1-R5 and Megavolt notes
-
-- R1: Before paginated verification, require exact mint `permissions` equality to
-  `{contents: "write", metadata: "read"}`, `repository_selection === "selected"`,
-  and returned repository IDs equal to the bound set, without duplicate IDs.
-  Missing fields, subsets and supersets refuse and revoke the candidate. Mutants
-  accept extra permissions or extra repositories; both must be killed.
-- R2: Production metadata accepts normalized HTTPS origins only; no HTTP or test
-  bypass. Tests run a fake HTTPS GitHub API with an injected scratch CA and optional
-  transport, following row236. A named admin-set test rejects HTTP before any call.
-- R3 C1 replacement: pinned API version and required App/installation/token-response
-  shapes, refusing unavailable/unsupported capabilities. No Gitea version comparison.
-  C2 replacement: RSA key's signed JWT authenticates the configured App ID and the
-  installation belongs to it and is not suspended. C3 replacement: installation
-  permissions cover the fixed map; the issued token's map must equal it exactly.
-  C4 replacement: App ID, installation ID and account ID equal the slot metadata.
-  No claim that the App is a dedicated site-admin account with an empty repo list.
-- R4 constants: `TOKEN_LIFETIME_MS = 3_600_000`, `CLOCK_SKEW_MS = 60_000`,
-  `TOKEN_MARGIN_MS = 60_000`, `CALL_TIMEOUT_MS = 15_000`. A generation is usable only
-  before `expiresAt - TOKEN_MARGIN_MS`. Mint expiry cannot exceed the request start
-  plus lifetime plus skew. Unknown mint reach remains until request start plus
-  request timeout plus lifetime plus skew. Equality at each deadline is expired.
-  These assume provider expiry is bounded by the documented lifetime and skew;
-  a request that never returns has no claim of proven remote revocation. Each
-  boundary has a controlled-clock test. JWT uses `iat = nowSeconds - 60` and
-  `exp = nowSeconds + 540` (less than the ten-minute maximum).
-- R5: A changed project ID, remote, allowed-project list, role definition or admin
-  slot between generations refuses renewal, even if the replacement configuration
-  would independently grant access. Re-approval is required.
-- Admin CLI: separate `--app-id`, `--installation-id`, `--account-id`, `--url`,
-  `--rotate-by` shape. RSA private key on bounded stdin; never misuse `--account`
-  for an installation ID. Rotation replaces a Jason-provided App key on stdin;
-  this method does not pretend it can manufacture/delete GitHub App private keys.
-- Approval block and README explicitly exclude `.github/workflows/` writes and
-  account/fork creation. No workflow, issue, PR or administration permission is
-  granted. All fake JWT claims use the injected clock.
-
-### Review follow-up (dewey-0944 / dewey-0946)
-
-`API_VERSION = "2026-03-10"` is pinned from GitHub's official
-[API Versions](https://docs.github.com/en/rest/about-the-rest-api/api-versions)
-page, checked 2026-10-23. It lists that version as supported and specifies the
-`X-GitHub-Api-Version` request header. This is a public-document check, not a
-live API probe; fake tests do not reach GitHub.
-
-`grants sweep github` may close an expired active generation once its conservative
-`until` bound has elapsed. It deletes that generation's private file and records
-`grant.token.closed` with reason `expired`; the durable grant stays renewable.
-It must not close a live active generation early. Installation endpoints now
-require an explicit valid installation token and cannot fall back to an App JWT.
-Manual run validates keys and identifier before any approval lookup.
-
-Admin remove intentionally retains the human's existing ability to remove the
-local slot while grants or residues exist (Gitea parity). This invalidates future
-use/renewal, but known residue cannot be remotely retried until a matching slot
-returns; expiry still closes it at its conservative bound. Status/sweep do not
-claim remote revocation in that case. The App itself and private keys are not
-removed at GitHub. Event projection is a full read at MVP volume; no cache is
-introduced whose invalidation could weaken revocation.

agents/violet/work/queue-297/MANIFEST.md

@@ -1,99 +0,0 @@
-# Row297 verification manifest (UNTESTED)
-
-Candidate pending tests. Dewey approves this manifest; Sage owns CLEAR and gate.
-All listed tests are fake HTTPS API or scratch configuration. No live key/token,
-no GitHub service contact, and no public consumer is installed. No Node/test run
-has occurred in Violet's session. Static `git diff --check` is the only check run.
-
-## Files and permission boundary
-
-- New protected modules: bus/src/github-api.mjs (HTTPS, JWT, App slot and floor),
-  github-files.mjs (private atomic files), github-grant.mjs (event projection,
-  approval binding, renewal, generation files, revoke/recovery).
-- Broker/runtime add the method to existing grant gates and lifecycle revocation;
-  no token-returning or renewal socket verb. Existing Gitea code paths remain.
-- Business role/instance parsing: a role declaration `{service:"github"}` takes no scopes; role.github
-  names allowed projects; project.githubId pins its provider identity. Generic
-  token-reference schema stays closed to github. No role JSON policy is changed.
-- CLI github-grants.mjs handles method-specific admin identity flags and bounded
-  stdin. grants.mjs dispatches the method without changing Gitea flag shapes.
-- New tests: bus fake-github-api.mjs, github-api.test.mjs,
-  github-grant.test.mjs, github-broker.test.mjs; business github.test.mjs;
-  cli github-grants.test.mjs. README and packet/build records document the limits.
-- One pre-existing test change: business/tests/role.test.mjs:209, exactly 1/1,
-  regex only. Mos mos-1518 authorization and replacement closed-list test are in
-  BUILD.md. No other pre-existing test is edited by Violet.
-
-## Row236 X-G correspondence
-
-| Row236 claim | GitHub replacement / named coverage |
-| --- | --- |
-| X-G1 binding, no writes | grant binding rejects scopes/account/fork keys; business binding refuses missing declaration/project/ID; R5 drift refuses before consume |
-| X-G2 C1-C4 | C1 pinned API/required response shapes; C2 signed App authentication and App/installation identity/non-suspension; C3 installation permissions cover the fixed map; C4 App, installation and account IDs match metadata. API tests name identity, suspension, floor, HTTP and RSA refusals |
-| X-G3 approved end to end | broker chief raise, human Yes, exact durable grant, protected callback, revoke, fake token gone |
-| X-G4 foreign user | No user account lifecycle. Replaced by App/installation/account identity, exact configured repository IDs/names, no account/fork request |
-| X-G5 failures/leftovers | invalid mint candidate revoked; remote delete failure is serviceLeft; failed renewal never calls consumer; revoke wins pending renewal |
-| X-G6 restart | active generation needs its recorded binding/timestamp; lost response remains until controlled bound; interrupted call without result is visible; no interrupted generation adoption |
-| X-G7 binding drift | project ID, remote, allowed-project list, definition and admin metadata between generations; preflight refusal unspent, restart spends interrupted |
-| X-G8 calls/secrecy | intent and call visible while fake receives request; result after call; only consume has decision; no key/JWT/token in evidence |
-| X-G9 admin rotation | Human replacement key, same App/installation/account/origin, setAt changes binding; no GitHub private-key creation/deletion claim |
-| X-G10 replacement | new generation active before old token DELETE, old token removed afterward |
-| X-G11 callers/claim/spend | human-only admin/run; chief-only raise; no socket renewal/token; old approval invalid after revoke; single consume across renewal |
-| X-G12 reach | exact mint IDs/permissions/selected mode, paginated GET through page 2, repository names checked; wider GET reach refuses and deletes candidate |
-| X-G13 reserved namespace | existing grant actor/trigger retained; new direct human insert refusal test; existing grant-migration tests cover shared reservation |
-| X-G14 fire | GitHub local revoke; fire completes only after remote cleanup; remote leftover blocks fire. No shared installation suspend/uninstall |
-| X-G15 evidence kind | a look-alike applied record under action.refused cannot establish a grant |
-
-Gitea-only version ordering, user nonce/adoption/disable, token-name minting,
-admin token minting and token-ID whoami settlement are replaced, not copied.
-No Gitea account or fork API is used by the GitHub method.
-
-## Dewey R1-R5
-
-R1 tests mint permission extra/missing/higher keys, selected mode, repository
-extra/missing/duplicate IDs before paginated verification. R2 tests admin HTTP
-refusal with no loopback exemption; fake HTTPS injects a scratch CA. R3 maps C1-C4
-above. R4 constants are lifetime 3,600,000 ms, skew/margin each 60,000 ms, request
-15,000 ms; JWT clock claims, margin equality, excessive expiry and lost-response
-bound equality have controlled-clock tests. R5 tests configuration changes between
-generations, preserving the original binding rather than granting from new config.
-
-## Runs requested, not yet authorized/executed
-
-1. New-file red/green or baseline diagnostic run: `node --test` on the five new
-   test files. Tests were written first; the test hold prevented observing red
-   before implementation, so no TDD execution evidence is claimed.
-2. Touched suites: business, bus, cli. Full every `scripts/test-*.sh` on Sage's gate.
-   If the gate includes webui, roster's required editor build applies; Violet
-   has not run a webui build or touched row198's inherited webui tests.
-3. Mutants: run on a disposable copy only after a green baseline. Every survivor
-   is an open failure, not a waived requirement. Planned mutations: HTTPS origin,
-   RSA restriction, App/installation/account identity, permission floor, explicit
-   mint IDs/permissions, exact response maps/selected mode/IDs, expiry ceiling,
-   margin boundary, durable config/admin digests, revocation epoch, expiry bound,
-   intent/call ordering, local-before-remote revoke, evidence kind, auto-dispatch,
-   lifecycle inclusion and unknown-token retention. Actual kill evidence is pending.
-
-## Remaining evidence gaps before acceptance
-
-No test has run, so no pass count or mutant kill is claimed. New tests now cover
-a known interrupted token, unsafe file modes/symlinks, busy claim, admin rotate
-and the lifecycle-delete revoke job. Runtime verification may require fixes or
-additional new-file coverage; lifecycle-delete now includes its second request
-completing after the revoke job. These are in-scope gaps, not deferred acceptance. The consumer gap is separately
-ruled out of scope in sage-3620 and recorded in BUILD.md.
-
-## Byte manifest (Dewey M1)
-
-`candidate-manifest.sha256` lists SHA-256 of the git blob bytes of the 24 paths
-reviewed for row297, including this MANIFEST.md. It excludes itself to avoid a
-self-reference. Its own SHA-256 and the final pushed head are reported together
-in Violet's review handoff message. After any byte change, regenerate the list
-and report a new checksum before the gate. Inherited row198 paths are excluded.
-
-The three extra mutants from dewey-0944 are required: accept DELETE 401 as
-revoked (killer `mutant: closeToken must not count a 401 as proven revocation`);
-count 0/5xx as not-issued (lost-response test and `mutant: mint 500/503 is uncertain
-issuance and stays serviceLeft`); drop the controller abort check (`mutant:
-shutdown abort alone prevents a pending generation from applying`). All kill
-evidence remains pending Sage CLEAR.

agents/violet/work/queue-297/PLAN.md

@@ -1,69 +0,0 @@
-# GitHub grant method implementation plan
-
-Goal: implement row297's protected GitHub App grant and renewal lifecycle.
-Architecture: a GitHub transport/slot module and event-backed executor, integrated
-through the broker's existing human grant gates. No GitHub consumer is added.
-Stack: existing Node ESM, node:crypto/node:https/node:fs, append-only bus events.
-Spec: DESIGN.md, including sage-3620, dewey-0931 and megavolt-0206.
-Execution: Violet inline; Dewey reviews the final manifest. No subagent dispatch.
-
-## Global constraints
-
-Fake HTTPS API and scratch CA only. No credential files, live token, real API call,
-Node or test execution before Sage CLEAR. No old-test edits without Mos approval.
-Preserve row198 commits; push only violet/*; no amend or force push. No schema
-migration for grant state: use reserved grant evidence with the existing actor.
-
-## Review focus
-
-- Lost mint responses remain visible until conservative expiry; never claim undo.
-- Revocation racing renewal cannot publish a late token or restore the grant.
-- Malformed provider responses cannot authorize a wider token.
-- Restart cannot adopt an interrupted generation or changed configuration.
-- Refusals and audit records cannot leak RSA/JWT/token values.
-
-## Task 1: configuration, HTTPS transport and admin slot
-
-Files: new bus github-api.mjs and github-files.mjs; modify business role/business
-parsing; new business github.test.mjs and bus github-api.test.mjs/fake-github-api.mjs.
-Interfaces: checkGrant, binding configuration checks, githubApi({configDir, ca,
-transport, now}), adminMeta/setAdmin/removeAdmin/checkAdmin/mint/repos/revoke.
-
-- [ ] Write tests first for HTTPS-only metadata, RSA-only input, App/installation/
-  account identity, suspension, permission floor and fixed mint response equality.
-- [ ] Run red tests on Sage CLEAR; record the exact failure, no invented red claim.
-- [ ] Implement strict additive config and slot/transport with no raw response audit.
-- [ ] Run new tests green on CLEAR; no old tests changed.
-
-## Task 2: durable executor and renewal
-
-Files: new bus github-grant.mjs; new bus github-grant.test.mjs.
-Interfaces: configure({store,business,event,approved,consume,grantable,working});
-raiseBinding, run, withToken, revoke, sweep, status, reconcile, idle, close.
-The broker supplies private approved/consume/event callbacks, not a worker verb.
-
-- [ ] Write lifecycle/expiry/recovery tests before implementation, including all
-  R1-R5 cases, revoke races, config drift and lost-response bounds.
-- [ ] Run red tests on CLEAR, then implement evidence projection, generation files,
-  exact reach, expiry-aware guarded use, local-first revoke and retryable cleanup.
-- [ ] Verify no untrusted token-returning endpoint and no token in any evidence.
-- [ ] Run green and mutant checks on CLEAR; record every unexecuted check honestly.
-
-## Task 3: broker, runtime and CLI integration
-
-Files: broker.mjs, runtime.mjs, cli grants.mjs; new github-broker.test.mjs and cli
- github-grants.test.mjs; bus/cli README edits. Existing Gitea behavior stays intact.
-
-- [ ] Write tests first for chief raise, human approval, rejected caller scopes,
-  admin human-only, run claim, status/revoke/sweep, fire/delete and restart.
-- [ ] Dispatch github before existing Gitea branches; connect reserved writer and
-  consume, automatic run on human yes, reconcile, lifecycle revoke and shutdown.
-- [ ] Add method-specific CLI admin flags and RSA stdin; never print secrets.
-- [ ] Document fixed scope, workflow/account/fork refusals and consumer gap.
-- [ ] Request CLEAR for touched suites and every scripts/test-*.sh; run only after
-  granted. Present actual diff/numstat, manifest and mutants to Dewey and Sage.
-
-## Acceptance ledger
-
-Static checks can run without Node. All red/green runs, suites, mutants and gate
-are currently unexecuted. No success claim is implied by this plan.

agents/violet/work/queue-297/candidate-manifest.sha256

@@ -1,24 +0,0 @@
-6b54b05eeabaee822ad9ec96e63ba007c6d52b7e66100ab4dc051fa414af103f  BUILD-LOG.md
-e9dcab5e3125660f177989e6bf726da596149aa237c4f179fa24c13aefc009e1  agents/violet/work/queue-297/BUILD.md
-156db930b2e455c7dc8deffdd48fd832d898b32e5c8136f014bd4af84f50f526  agents/violet/work/queue-297/DESIGN.md
-99c99d4ca9bdf1397869247c454f45fd0c3fba8fb47b0b9bd424e8532b7d2453  agents/violet/work/queue-297/MANIFEST.md
-929d9a5fc28bdcdfd5c7db5cb818186633954d5f60ad2a03e129d062bcb4f725  agents/violet/work/queue-297/PLAN.md
-d599b0f0d4c248fba5a32b4f04022ac4676a4cb4029d32d29e0ab1f10ade9162  docs/SESSIONS.md
-bed3be579c94c16f6ad840b298f589339e1e0d58e3fca13571e2262a3502aace  packages/bus/README.md
-e46abbba0514be8bad8c53ec3a0b19133746bb96318c13923d66e9f54c6b2a34  packages/bus/src/broker.mjs
-1f09e6a8e3b814a475fb1f7a91bd6ee670e08d7c76399212134e107a2ec4b499  packages/bus/src/github-api.mjs
-2f3fce1244446c4be93cdc8ab744de710758bdebb1106e09badd25fa57c355ff  packages/bus/src/github-files.mjs
-bca3836d62525620d9af372c0c2039e3405579290e8919a1f4f6a35baafee6da  packages/bus/src/github-grant.mjs
-83a2d294b87e900fcb8357724941be1475ce5ef6afde237a149eb5c138f087b2  packages/bus/src/runtime.mjs
-c6e6884471a884663db9446f662669d0977009f6f2f24f2a388e29104c9cb960  packages/bus/tests/fake-github-api.mjs
-9e0f43e5b25c3a77d746dbd1b956ff767406548fda2528cab51c8d5b38157e5b  packages/bus/tests/github-api.test.mjs
-8c78d2ad8aad12632ee40eea8212fd360281bc11b4ae900bf3e38f4618c5d6db  packages/bus/tests/github-broker.test.mjs
-544f15f07cfaa76394da8618d63573ef91a7c0ebf3f65a6f39339c015e4f96a5  packages/bus/tests/github-grant.test.mjs
-87dc329f40f5783a4c2e85c9a1d8c94b6dc4889cdce7191e79af852ab251fac7  packages/business/src/business.mjs
-c022a8aa32d84a189b585696b207001ba690660ed1c83c6038be4031703550a4  packages/business/src/instance-settings.mjs
-a68518d83a039ecc82ddb4cfbbc6234df8eac384acc78499c94b0d0945a7717b  packages/business/src/role.mjs
-956981b7ab8f633054831a00133d44a43b5bf9be7c6fd6a326ce20b769c9f822  packages/business/tests/github.test.mjs
-445c224530f5545fd4e1e734c7b36c407db6f1b182b6c6ef65e5c9d91fd16ac0  packages/business/tests/role.test.mjs
-410b3c3e50c476de39720b0906dcf077739d029e293b444cc6e4a13bb24a9031  packages/cli/src/github-grants.mjs
-9fd3589258b83e7cf2c5828811251d0d0a24087a8bded926a44144e3b4a07438  packages/cli/src/grants.mjs
-2886fbc1c4c6f0dc22d365e76641f13b7e31f46123b9e7b3e280d2ff79ea52e9  packages/cli/tests/github-grants.test.mjs

docs/SESSIONS.md

@@ -1593,5 +1593,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T17:48:43Z | Scrooge (629b6cd3) | Row 252 Console inbox Approve and Deny (#1753) | Rebased onto 306 landing as 580037105 (range-diff all =), slot run bus 907/0 webui 410/0 cli 943/0, in-review revs 3608/3609, Webby r1 APPROVE, J1-J19 specs to Sage; Sage landed 45ea3fa0d (done rev 3616). Part 1 mutant results were never in BUILD.md; they went to Sage by T3 (scrooge-0252-mutant-specs).
 2026-10-23 | Sage (1ef1e4f8) | Rows 308 and 252 landings, 571 Connections design amendment, Vikunja 597 | 308 (PRD 1.17, #1815) landed 30e6bb680 and 252 (#1753) landed 45ea3fa0d (replay of 580037105 onto 30e6bb680, range-diff all =), each after a full gate on the landed tree (252 also J1-J19, J11c and J18 equivalent); Gyro's 571 amendment (Fenton APPROVE) landed e8bb13df8; Vikunja 570, 435 and 597 done, canonical webui esbuild 0.28.2; queue revs 3589-3616 committed 59f013247
 2026-10-23 | Sage (1ef1e4f8) | Vikunja 571 W build rows; rows 13, 42, 257 and 289 check | Filed the design's ten W rows as queue rows 309-318 (revs 3617-3626, owners set to unassigned 3627-3636, queue commit 293b42fee pushed); Vikunja 571 done (comment 994). Row 13's candidate fd72d2689 is on refactor, gate is Monday's row 7 ledger run; 42 paused under mos-1184; 257 post-v1; 289 waits on 214 and 288. Slot released 17:56Z.
-2026-10-23 | Violet (6229eb89, Codex gpt-6.1-sol, mos-1498/Q245) | Row 297 GitHub grant method #1803 | Registered in violet/row297; merge-chained row198 14fe7513c then 4d8123b0a unchanged. Q-B3 S1-S6 proposal prepared for Dewey/Megavolt and Sage; no product code, credentials, node or tests; shared runs require CLEAR.
-2026-10-23 | Violet (6229eb89) | Row297 #1803 protected GitHub grant candidate | Q-B3 read by Dewey/Megavolt, sage-3620 scope applied. Candidate and fake HTTPS tests written, no Node/tests run; one Mos-authorized old-test regex 1/1 (mos-1518). Review manifest and consumer gap recorded. Verification/gate remain pending Sage CLEAR; no acceptance or landing claim.
+2026-10-23T21:08:32Z | Filbert (048f3c63) | Rows 220 and 216 round 2 verdicts, r5 static deltas, replay drift check | 220 APPROVE 739b868b6 (comment 31383 #1721, rev 3696), 216 APPROVE dae76ccc2 (comment 31384 #1717, rev 3697) on Researcher's r5 reruns and mutants and Sage's joint gate GREEN on fbe57a05b (sage-3748); static r5 deltas clean; 216 N3 (get returns a universe's own supporting files on 283's base) binds C2-05c; no tests run by me
+2026-10-23 | Gladstone (433058fc-9cea-46e3-8554-6ddefb312762, Codex gpt-6.1-sol) | #1816 / Vikunja 614, mos-1531 | Built hostcheck octal-mode fix and two bare-scratch bundle verifies on gladstone/hostcheck-item5 from 93694c518. Three append-only test blocks; Node/tests held by Sage-3738, untested push authorized sage-3740. Queue number pending; Morgana static review, Sage gate/landing.

docs/guides/host-run-sheet.md

@@ -40,8 +40,8 @@ install -d -o root -g root -m 0755 /etc/mosaic-stack/node-keys /opt/mosaic-stack
 cd "$(mktemp -d)"
 curl -fsSLO https://nodejs.org/dist/<v>/node-<v>-linux-x64.tar.xz
 curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt
-curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt.asc
-gpg --no-default-keyring --keyring /etc/mosaic-stack/node-keys/pubring.kbx --verify SHASUMS256.txt.asc SHASUMS256.txt
+curl -fsSLO https://nodejs.org/dist/<v>/SHASUMS256.txt.sig
+gpg --no-default-keyring --keyring /etc/mosaic-stack/node-keys/pubring.kbx --verify SHASUMS256.txt.sig SHASUMS256.txt
 grep " node-<v>-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
 echo "<pinned sha256>  node-<v>-linux-x64.tar.xz" | sha256sum -c -
 tar -xJf node-<v>-linux-x64.tar.xz --no-same-owner
@@ -189,7 +189,12 @@ First install:
 ```sh
 # Copy the bundle in, then check it before anything reads it.
 echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
-git bundle verify /root/<sha>.bundle
+(
+  bundle_check="$(mktemp -d)" || exit 1
+  trap 'rm -rf "$bundle_check"' EXIT
+  git init -q --bare "$bundle_check" &&
+    git -C "$bundle_check" bundle verify /root/<sha>.bundle
+) || echo "STOP: bundle verify failed; do not continue"
 
 # Root's checkout. stack-upgrade.sh and case2-unit.sh run from here, never from a copy.
 git clone -q -b refactor /root/<sha>.bundle /root/mosaic-stack
@@ -206,7 +211,12 @@ Each upgrade, before `stack-upgrade.sh upgrade`:
 
 ```sh
 echo "<bundle sha256>  /root/<sha>.bundle" | sha256sum -c -
-git bundle verify /root/<sha>.bundle
+(
+  bundle_check="$(mktemp -d)" || exit 1
+  trap 'rm -rf "$bundle_check"' EXIT
+  git init -q --bare "$bundle_check" &&
+    git -C "$bundle_check" bundle verify /root/<sha>.bundle
+) || echo "STOP: bundle verify failed; do not continue"
 git -C /root/mosaic-stack fetch -q /root/<sha>.bundle refs/heads/refactor:refs/remotes/origin/refactor
 git -C /root/mosaic-stack checkout -q --detach <sha>
 install -o mosaic -g mosaic -m 0600 /root/<sha>.bundle /srv/mosaic/incoming/<sha>.bundle
@@ -231,13 +241,34 @@ When a run doesn't exit 0, send Mos the exit and the last lines of `/var/log/mos
   the old copy. The next run refuses `args-differ`, and a render from that file would put the old copy back.
   Move the file the result line names into place with `mv -f`. The two differ only in the `--copy` value.
 
+After `case2-install.sh` succeeds, create the human CLI wrapper before running
+`stack-copy.sh check --units external`. Creating this wrapper is a separate live
+step requiring Mos's go (`scripts/stack-copy.sh:3`); the install does not create it. Run only on that go:
+
+```sh
+sudo -u mosaic -H /bin/sh <<'MOSAIC_WRAPPER'
+cd / || exit 1
+mkdir -p -- "$HOME/.npm-global/bin" || exit 1
+"$HOME/src/mosaic-stack/scripts/stack-copy.sh" wrapper <sha> --create
+MOSAIC_WRAPPER
+```
+
+`--create` refuses an existing wrapper; stop and review it rather than replacing
+it. The wrapper must name the same `<sha>` copy as the units.
+
 Precheck lines: none. Root's checkout at `<sha>` and the stack's user's clone: precheck line missing.
 After install, `stack-copy.sh check --units external` reads the copy the units run.
 
+The stack's user's `scripts/case2-install.sh` (C2-13b, design 10 step 2b) makes the first copy with
+`stack-copy.sh copy <sha>`. The copy runs `npm ci` from `package-lock.json`, which installs the pinned
+harness, so the host needs to reach the npm registry during the install. The install runs no
+`release.sh package` or `activate`.
+
 ## 7. The args file
 
 `/etc/mosaic-stack/dev.args` holds the `case2-unit.sh` arguments, one per line, with the serve flags after a
-line holding `--`. I2's install writes it; ops-01 doesn't write it by hand. It must be root's, with no group
+line holding `--`. Root writes it at the unit render, from the values the go names. The stack's user's
+install never writes it: that user can't write `/etc`, and root reads nothing that user wrote. It must be root's, with no group
 or other write (`chmod 0644` or tighter). Before `--` it takes only `--user`, `--home`, `--business`,
 `--copy` (exactly once), `--node`, `--profile`, `--claude` and `--pm`. `stack-upgrade.sh` changes only the
 `--copy` line, and only after confirm passes.
@@ -272,13 +303,37 @@ file with `stat -c '%U %a %n' PATH`, never `cat`. `<business>` is the host's bus
 |---|---|---|---|---|---|
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | `claude-session.env`, one line `ZAI_API_KEY=...` | 0600 | mosaic | library | `<path> sets ZAI_API_KEY` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/` | the Console's proof file, the path the args file's `--proof-file` names | 0600 or 0400 | mosaic | library | none. `case2-unit.sh` refuses at render. Precheck line missing. |
-| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | C2-13b's `library.sync` (not landed) |
+| `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` | `library-gitea` | 0600 | mosaic | library | `case2-precheck.sh --business <business> --library-status`, after the bus is up: `library-last-error library-credential-missing` until it's placed, then `library <project> last fetched ...` |
 | `/srv/mosaic/.config/mosaic-dev/secrets/agents/<business>/<agent>/` | one file per service | 0600, dirs 0700 | mosaic | both | none. Filled only by `mosaic credentials issue`, or Approve after #436. Never by hand. |
 
 The installer key, `<configDir>/secrets/hosts/<business>/<hostId>/installer`, is not a slot anyone places.
 Enrollment (section 8) writes it under the enrolling stack's config directory and deletes it when the host
 leaves.
 
+## 9a. Notifier decision, before starting units
+
+Make the explicit per-host decision before section 10: the default below is
+`binding: null`, so the bus runs without DMs. A named binding is a later per-host
+choice that needs Mos's go. The installer does not make this decision or write
+this file. Replace `<dataRoot>` with the configured data root and `<business>`
+with this host's business id. If the file already exists, stop and review the
+existing decision; this command refuses to overwrite it.
+
+```sh
+sudo -u mosaic -H /bin/sh <<'MOSAIC_NOTIFY'
+cd / || exit 1
+umask 077
+notify_root='<dataRoot>/notify'
+notify_dir="$notify_root/<business>"
+mkdir -p -m 0700 -- "$notify_root" && chmod 0700 -- "$notify_root" || exit 1
+mkdir -p -m 0700 -- "$notify_dir" && chmod 0700 -- "$notify_dir" || exit 1
+(set -C; printf '%s\n' '{"notifyVersion": 1, "binding": null}' > "$notify_dir/notify.json") || exit 1
+chmod 0600 -- "$notify_dir/notify.json"
+MOSAIC_NOTIFY
+```
+
+Precheck line: `ok      notifier config <dataRoot>/notify/<business>/notify.json validates (directory 0700, file 0600)`.
+
 ## 10. Console start
 
 None by hand. I2's `case2-unit.sh` enables both units, starts the bus, then the Console (Q189, mos-1122).

docs/plans/2026-10-23_github-consumer-brief.md

@@ -0,0 +1,31 @@
+# Brief: a GitHub consumer for row 297's protected token callback
+
+Sage, 2026-10-23, filed for Mos (mos-1525). Post-10-27.
+
+## Brief: a GitHub consumer for Broker.githubWithToken
+
+Row 297 builds the GitHub grant method and stops at the trusted host API
+`Broker.githubWithToken(business, agent, fn)` in `packages/bus/src/broker.mjs`.
+Nothing calls it yet: no git helper, mirror push or publication uses a GitHub
+token (violet BUILD.md, "Consumer gap for Sage's follow-up row").
+
+This row adds the first consumer.
+
+- It gets the token only through `githubWithToken`. It never reads the
+  protected generation files, and never routes GitHub through the generic
+  Gitea Credentials path, which has calendar-day dates and fork-specific
+  identity.
+- It honors the callback's cancellation signal. The signal aborts on revoke and
+  at the token safety deadline, so the consumer stops work and drops the token
+  when it fires. No operation is retried with a token past its expiry.
+- No socket verb returns a token, and no consumer output, log or run record
+  holds one.
+
+Design comes first, with the consumer named (a git helper or mirror push), for
+Dewey's review. Tests cover: a revoke mid-call aborts the consumer; a call
+straddling the safety deadline aborts; an expired grant refuses before any
+network call; and no token text appears in output or the store.
+
+Gate: Dewey approves the design and the manifest. The touched suites and every
+`scripts/test-*.sh` are green on Sage's gate, and mutants that drop the signal
+check or the expiry check are killed. Starts after row 297 is done.

docs/plans/2026-10-23_host-fixes-1816-brief.md

@@ -0,0 +1,57 @@
+# Brief: Case 1/2 host fixes for the 433 P1 rerun
+
+Sage, 2026-10-23, filed for Mos (mos-1532). Issue #1816, Vikunja 614. On the 10-27 path.
+
+## Brief: hostcheck item 5, bundle verify, case2-unit @, stack-copy cwd
+
+ops-01 found two defects in the 433 P1 Run A on VM 1013 (ops-0256). Row 240 (c515273db) introduced the first one.
+
+1. `scripts/case1-hostcheck.sh:117` compares `dpkg-statoverride --list /usr/bin/bwrap` to the literal
+   `root mosaic 0750 /usr/bin/bwrap`. dpkg 1.22.6 on Ubuntu 24.04 prints `750`, so item 5 FAILs on every
+   correctly built host. The apt hook and mosaic-hostcheck.service then close bwrap and write DRIFT. The fake
+   at `packages/cli/tests/case1-hostcheck.test.mjs:73` writes `0750`, so the suite missed it.
+2. `docs/guides/host-run-sheet.md:192` and `:209` run `git bundle verify` outside a repository, which fails on
+   a fresh host.
+
+The fix:
+- Item 5 accepts `750` and `0750` as the same mode for the statoverride line. Owner, group and path stay exact,
+  and every other mode still fails. The stat check at :118 is unchanged.
+- The run sheet verifies the bundle inside an empty bare scratch repo, as `scripts/stack-copy.sh:91-93` does.
+  A failure there prints a FAIL line and does not `exit` the interactive root shell (Morgana N1, sage-3743).
+
+Tests are append-only blocks in case1-hostcheck.test.mjs (mos-1272 pre-approved by Mos: 0 lines deleted, the :73
+fake unchanged). They cover: a `750` statoverride passes; `0750` still passes; `755`, `0755`, `7500`, `075`, `00750`, a tab
+or doubled space, and a wrong owner or group fail. Any other change to an existing test goes to Mos first.
+
+Scope add (mos-1534):
+3. F3: `scripts/case2-unit.sh:62` plain() rejects `@`, so the run sheet's required `--claude` path
+   (host-run-sheet.md:85-89, `@anthropic-ai`) refuses on every host (ops-0258, section 10). plain() accepts `@`.
+   The :61 comment doesn't list it as unsafe, so no requirement changes.
+4. F4: `scripts/stack-copy.sh` fails when run as mosaic from a cwd mosaic can't read: the sheet's `sudo -u mosaic`
+   lines and stack-upgrade.sh AS_USER at :154 and :293. It works from any cwd.
+Specs and test terms are in mos-1534. Mos pre-approved append-only test blocks in case2-unit.test.mjs under mos-1272.
+One new N carries F1 to F4 for the #433 rerun.
+
+Owner Gladstone. Reviewer Morgana. Gate: Morgana approves. Mutants are killed: dropping the `750` form, widening the
+match to any mode, rejecting `@` again in plain(), and the F4 cwd fix reverted. The touched test files run whole, and Sage's full landing gate runs every
+package suite and every `scripts/test-*.sh`. After landing, Mos sends ops-01 the new N for a full 433 P1 rerun.
+No hostcheck install on .53 or .54 until it lands.
+
+Scope add (mos-1536, ops-0260):
+5. F5: on a host that follows the run sheet, `mosaic-bus@<business>` exits 3 because nothing writes
+   `<dataRoot>/notify/<business>/notify.json` (bus cli.mjs:104-122 requires it, README :876-892), and case2-precheck
+   has no line for it, so it passed with the bus down. The run sheet gains a step that writes binding `null` as the
+   default, and case2-precheck gains a notify line with tests. Install does not write the file: the README wants an
+   explicit decision. A named binding for .53 is a later per-host choice that needs Mos's go. Spec in mos-1536.
+Gate adds a mutant: the precheck notify line removed or passing on a missing file. #1816 carries F1 to F5.
+
+Scope add (mos-1537, ops-0261):
+- F5 fixture: Mos OK under mos-1272 for the host(t) notify fixture in case2-unit.test.mjs and the world(t) one in
+  case2-install.test.mjs (a 0700 notify/acme dir and a null notify.json, with no assertion changed or deleted).
+  Conditions: the negative F5 tests build their host without the file; one append-only install test shows
+  notify.json bytes and mode are unchanged after install; the fixture lines are their own follow-up commit.
+- Section 9a creates both `notify/` and `notify/<business>` at 0700 (ops-0261 measured a 755 parent).
+6. F6: sheet :235 runs `stack-copy.sh check`, which requires `$HOME/.npm-global/bin/mosaic` (stack-copy.sh:160-173).
+   Nothing creates it: install runs only `copy` (:178), bootstrap has no .npm-global, and the sheet has no wrapper
+   step. The sheet gains a step after install: as mosaic from cwd `/`, create the bin dir, then run
+   `wrapper <sha> --create`, naming the Mos gate (stack-copy.sh:3). No requirement change. #1816 carries F1 to F6.

docs/plans/CURRENT.md

@@ -586,4 +586,3 @@ git history + Gitea issues.
 
 - 2026-09-26 (sage, lead): Jason's ruling: Sage leads the project, Darkwing is a collaborating seat, more seats to follow, development stays in T3 for now. The fleet Sage seat that took Invoice Ninja coordination outside Jason's instructions is being decommissioned; moving work onto the new stack is the fix. Suites all green. Rows 24 and 25 pushed (1685deb4..43d7574d). Open: about 11 days of uncommitted agent work in the tree (row 16 launch files, row 22, #1512, WUI evidence), 23 untracked aws-* skill directories in skills/ from 2026-09-21, and Jason's target for the next phase.
 - 2026-10-13 (sage, lead): Jason's PM re-test on 664199f7 is finished (Mos; PM run rcc0f72be8b17; Vikunja #228). Paging, the Board's held roles, the Messages page and the #229 loop (coder push 010d30cb, review, approve, PM close) all worked; #230 and #231 are done, #232 stays open for the secrets-path probe. Two faults checked and dropped: the reviewer did run the tests before its verdict, and the PM's clone did hold the row 95 Board code. Two filed: row 104 (#1598) seat git identity, row 105 (#1599) a review request says whether a reviewer is running. Rows 96, 101-105 briefed; row 85 released to build. Row 85's live steps, any bus restart and row 102's public/ change each need Mos's go. Row 100 waits on Jason (Vikunja #257). Formatting, Jason's direction: no formatting row now. Chat output will be formatted in the TUI and WebUI the way chat interfaces usually do it, made our own; T3 Code's chat is his example. Carry it into the TUI and WebUI chat work.
-- 2026-10-22 (bushroot, row 198 r3): the board runs in-process in the Console (webui, port 7332); control-board `serve` is retired and exits 2, and the Console refuses `--board`. Docs: packages/webui/README.md and packages/control-board/README.md now give the Console start and drop the 7331 serve text. Built on bushroot/row198-r3 from aca16404c; not run, awaiting Sage's CLEAR.

docs/plans/DEFERRED.md

@@ -678,3 +678,36 @@ claim aren't one (design D1's alternative). Bound to the next row that changes t
 Morgana, row 306 BUILD.md (#1813, landed 2d0318a44). A revoked run that also has a pending limit stop gets
 `#limitStop`'s `not-holder` on `message.receive` and `state`, because that check runs before `#agent`. It's
 rare and the run still stops. Bound to the next row that changes `#limitStop` or the order of those checks.
+
+## Row226 N1: the install id regex is narrower than ID_PATTERN
+
+Webby, row 226 round 1 (webby-0225, #1727, landed 661890e90). case2-install.sh:56 refuses a business id
+with `.` or `_`, which ID_PATTERN (vocabulary.mjs:199) and case2-precheck.sh:67 accept. Gosalyn confirmed
+it isn't deliberate (gosalyn-0208). It fails closed, so a real id with either character is refused, not
+mishandled. Bound to the next row that changes case2-install.sh: take the ID_PATTERN set, and add a test.
+
+## Row226 N2: a first-run validate refusal leaves personas and the slot dir
+
+Webby, row 226 round 1 (webby-0225). After a validate refusal on a first run, the staged personas and the
+empty token slot dir stay behind, and a re-run counts them as present. Bound to the same follow-up as N1:
+remove what this run created, as the business file path already does (install.sh:198/:202/:218).
+
+## Row226 N3: the run sheet doesn't pin the clone to the copy's sha
+
+Webby, row 226 round 1 (webby-0225). install.sh:217 validates with the checkout's scripts/mosaic, not the
+copy's, and host-run-sheet.md:237 never says the clone must be at `<sha>`. Bound to the same follow-up:
+a HEAD check in the install or one clause on the run sheet.
+
+## Row226 N4: --library-status refuses after a 5 s lock wait
+
+Webby, row 226 round 1 (webby-0225). If the bus holds the library lock for more than 5 s,
+`case2-precheck.sh --library-status` refuses with `ERROR library-sync-busy`. A re-run clears it. Recorded
+as a known operator step, no fix bound.
+
+## Row283 N1: SURVEY-RUN.md shows the scopes line without supporting
+
+Webby, row 283 round 1 (webby-0267, #1788, review note queue-283/REVIEW-manifest-b2a1f4092.md on
+webby/reviews c6ea27aab). docs/case2/SURVEY-RUN.md:96 documents the `--mapping` line as
+`scopes canon .., playground .., unmapped ..; indexed ..`, which predates the supporting scope 283 adds.
+Nothing reads the file (decision 137). Bound to the next docs commit that touches SURVEY-RUN.md: add the
+supporting count to that line.

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 3636 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 3677 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -252,18 +252,18 @@ Generated from `docs/plans/queue.json` revision 3636 by `queue render`. Do not e
 | 213 | Case 2 C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | morgana; reviewers webby | #1714 | done | — | Webby approves the manifest. The business, bus and harness suites, `scripts/test-config.sh` and every `scripts/test-*.sh` are green on Sage's gate, and the `models` mutant is killed. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | LANDED 361ba2387 (39 paths incl. 4 packet files). Patch-id f313e69b6f7e = c771a36f4..2b3e67e36; verify-commit ok, 35 manifest paths. Same combined gate as 195: business 200/0 bus 542/0 harness 140/0 cli 663/0, test-config 31/0 and all 10 scripts green, models mutant L1 killed. Webby N2 is row 235 acceptance (mos-1163). |
 | 214 | Case 2 C2-11a editor wikilink node, after measuring whether [[ round-trips | herb; reviewers filbert | #1715 | in-progress | — | Filbert approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11a editor wikilink node, after measuring whether [[ round-trips | — |
 | 215 | Case 2 C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | herb; reviewers filbert | #1716 | done | — | Filbert approves the manifest. The business, seat, cli, project, bus and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | LANDED e54e05463 on 6096b051b (sage-2094). Patch-id 2f68188b6c9d equals a36523713..dde3445ab; 118 paths, blobs and modes equal; tree 5b1613245 equals merge-tree. No path overlap with rows 66/243; no hash pins either way. Gate: Filbert APPROVE rev 2924; herb-0095 grant sage-2071 2634 pass 0 fail, 1 webui skip (editor rebuild needs esbuild 0.28.2, env, not a 215 path), accepted. |
-| 216 | Case 2 C2-05a lookup index and queries | researcher; reviewers filbert | #1717 | briefed | 268 done | Filbert approves the manifest. The library suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05a lookup index and queries | Rulings on phase A: agents/sage/work/queue-216/RULINGS.md (da9555ca2). r2 rebases on row 268's landing and adds the four PRD 1.14 playground tests. |
-| 217 | Case 2 C2-06 the citation guard, the page store, the runner texts and the retry | launchpad; reviewers webby | #1718 | briefed | 268 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the citation guard, the page store, the runner texts and the retry | — |
+| 216 | Case 2 C2-05a lookup index and queries | researcher; reviewers filbert | #1717 | in-review, round 1, request posted | 268 done | Filbert approves the manifest. The library suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05a lookup index and queries | Rulings on phase A: agents/sage/work/queue-216/RULINGS.md (da9555ca2). r2 rebases on row 268's landing and adds the four PRD 1.14 playground tests. |
+| 217 | Case 2 C2-06 the citation guard, the page store, the runner texts and the retry | beakley; reviewers webby | #1718 | briefed | 268 done, 283 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the citation guard, the page store, the runner texts and the retry | — |
 | 218 | Case 2 C2-12 the setup sheet for Melanie and the survey run sheet | sage; reviewers webby | #1719 | done | — | Doc only. Webby approves it against C2-01's real flags. Before landing, grep `packages/*/tests` and `scripts/test-*.sh` to confirm no test reads either file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12 the setup sheet for Melanie and the survey run sheet | LANDED f8276c5eb (pushed, on Darkwing sessions b65f3a0e8). Webby APPROVE r1-r3 (revs 2848, 2856, 2860; r3 candidate 1a38baf5af2a = 89ba79d94). Patch-id 18ba1e40ad29 seat 5c6f73ed7..89ba79d94 equals landed b65f3a0e8..f8276c5eb; three blobs equal 89ba79d94. Gate: doc only, 0 test readers (control 3). Melanie handover waits on C2-06 and Jason (#419). |
 | 219 | Case 2 C2-09a one thread per creative instance | rocko; reviewers dewey | #1720 | done | — | Dewey approves the manifest. The bus, cli and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. Watch for hash pins on `bus.js` and `broker.mjs` (`packages/bus/tests/channel-proof.test.mjs` pins a webui file). (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09a one thread per creative instance | LANDED 5fdfd7275 on refactor 10:40Z 10-23 (8 row commits cherry-picked onto 2efd127ce, range-diff all =, patch-ids match, tree e86a84a85 = gated merge 054da642f; top commit packet-only evidence). Gate manifest 4a2271dd: node 2523/0/2, ten shells 449/0, 24 mutants killed, audit ok (Rocko). Dewey approve rev 3507 c31108. N1 U6 persona label DEFERRED line follows. Slug fix Vikunja 590 and network leak 591 rows next. |
-| 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | briefed | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | Rulings on phase A: agents/sage/work/queue-220/RULINGS.md (da9555ca2). Scope adds packages/business/src/library-seats.mjs (imported by path, no index export), its test, and control-board serve.mjs. r2 building as a Haiku subagent. |
+| 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | in-review, round 1, request posted | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | Rulings on phase A: agents/sage/work/queue-220/RULINGS.md (da9555ca2). Scope adds packages/business/src/library-seats.mjs (imported by path, no index export), its test, and control-board serve.mjs. r2 building as a Haiku subagent. |
 | 221 | Case 2 C2-20 Bean and Chet persona import, with a count-only dry run | gosalyn; reviewers webby | #1722 | done | — | Webby approves the manifest. The test file runs green on its own and the cli suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-20 Bean and Chet persona import, with a count-only dry run | LANDED 300766450, pushed. Cand 8f403d0d4, manifest 20f05e3a6ad5, 22 paths, verify-commit ok, patch-id dfbb754c6fb4 equals 62ddc96cc..8f403d0d4. Gate 11:07:50-11:19Z on b1fece6f0: test file alone 11/0, harness 140/0, cli 677/0, all scripts green. Brief Gate met: webby-0073 approve, test file alone, cli, scripts. No live run in the Gate; the import itself waits on Jason. N1 N2 N4 go to C2-20b, N3 to DEFERRED. |
 | 222 | Case 2 C2-03a fetch-only sync | megavolt; reviewers dewey | #1723 | done | — | Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every `scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03a fetch-only sync | sage-2024 on megavolt-0089: core.createObject=rename in the fetch argv is accepted as a brief departure, since C2-04 inspectMirror refuses nlink 2. Dewey checks it. The askpass env keys, export SAFE in project/src/git.mjs, bus/tests/library-sync.test.mjs and the SURVEY-RUN user line are accepted. The 5 s client timeout residual goes in BUILD.md and Dewey rules fix or defer. Slot after 197 proof 3 and the 249 gate. |
 | 223 | Case 2 C2-07 runner retry on a guard refusal, and the runner's notices | researcher; reviewers filbert | #1724 | blocked (from briefed): Q226: C2-07 folded into C2-06 (row 217). No work here; Jason parks it. | — | Filbert approves the manifest. The harness suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-07 folded into C2-06 | — |
 | 224 | Case 2 C2-05b broker lookup verbs and typed tools | della; reviewers dewey | #1725 | in-progress | 216 done | Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05b broker lookup verbs and typed tools | — |
-| 225 | Case 2 C2-10b Console chat: replies, citations, write notices and the status line | researcher; reviewers dewey | #1726 | briefed | — | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: replies, citations, write notices and the status line | — |
-| 226 | Case 2 C2-13 install script and precheck for the host | gosalyn; reviewers webby | #1727 | in-progress | 215 done, 221 done, 222 done, 230 done | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. The run on the host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13b install script and library precheck | — |
-| 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | launchpad; reviewers dewey | #1728 | briefed | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
+| 225 | Case 2 C2-10b Console chat: replies, citations, write notices and the status line | fethry; reviewers dewey | #1726 | briefed | 217 done | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: replies, citations, write notices and the status line | — |
+| 226 | Case 2 C2-13 install script and precheck for the host | gosalyn; reviewers webby | #1727 | done | 215 done, 221 done, 222 done, 230 done | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. The run on the host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13b install script and library precheck | landed 661890e90 (replay of bfed0aa6c 893b4fd25 f3fabf51b onto 8352da88c, patch-ids equal, four blobs and modes equal to f3fabf51b) and fd3d2a99f (Darkwing 8a6321790 replay, mos-1519), tree 78fc5ad21 equals merge-tree. Webby APPROVE rev 3641. Sage gate GREEN 19:56Z on f3fabf51b: 17 package suites and 10 scripts, 0 fail. Webby N1-N4 DEFERRED e2b873390. #1727 closed. |
+| 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | gizmoduck; reviewers dewey | #1728 | in-progress | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
 | 228 | Row A: ZAI_API_KEY passes through ENV_ALLOW to sessions, README line, pass-through test (XS, Haiku high) | researcher; reviewers webby | #1729 | done | — | Webby approves the manifest. The mutant is killed. The seat suite and the cli suite are green on Sage's gate with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row A, ZAI_API_KEY in the session env allowlist | Landed 86249ac55 (pushed 07:25Z) on 59f817c32: the 3 manifest paths from cf18c42b9. Patch-id b6ffe31feb0d equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. |
 | 229 | Row B: per-instance pi agent dir for Chet's Codex login, design only, starts after 10-27 (#428) | gosalyn; reviewers webby | #1730 | briefed | — | A live check, with Jason's or Mos's go, that two clients on one ChatGPT login don't revoke each other's refresh tokens. No build row starts before it passes. Held until after 10-27. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row B, a per-instance pi agent dir for Chet's Codex login (#428) | — |
 | 230 | Case 2 C2-13a unit render and host precheck (case2-unit.sh, case2-precheck.sh) | gosalyn; reviewers webby | #1732 | done | — | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every scripts/test-*.sh. A run on a host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13a unit render and host precheck | Landed c8bc5cf4c on refactor (base 390ea5261), pushed. Patch-id f4b49eb68997 matches git diff 722136772..96768766c on the 5 manifest paths (manifest fbb0d7e42c67, Webby approve r2 rev 2563). packages/cli/README.md 3-way with row 199, hunks apart. Gosalyn gate on 96768766c: cli 541/0, scripts 429/0, mutants 10/10. Merged tree check: case2-unit 30/0, host 42/0. |
@@ -319,12 +319,12 @@ Generated from `docs/plans/queue.json` revision 3636 by `queue render`. Do not e
 | 280 | Bus tests: the scratch sshd proves it owns its port (194 gate follow-up, MVP, mos-1270) | rocko; reviewers duckworth | #1785 | done | — | Duckworth approves the manifest. Both files run whole, the bus suite is green on Sage's gate, the 30-run repeat has no timeout, and M1 is killed. Row 194 b17's full gate then runs on top. Any red goes to Mos (mos-1270). (sage) | `docs/plans/2026-10-22_sshd-port-race.md` § Brief: the scratch sshd's port is ours before a test uses it | Landed b0fd28b6f 07:57:30Z, ff from da5d3651d: b765f5cb8 (Duckworth approve rev 3153, manifest 27806c05) + slim packet. Sage gate bus 656/0/0, ge 41, hr 26 (c30431). Repeat 2010/2010 under cli 1588/1588, no timeout; M1/M2 killed 4/4. Full evidence d6c924764 on rocko/row280-da5d-20261022. N2-N4 carry in BUILD.md. 194 b17 rebases on b0fd28b6f. |
 | 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
 | 282 | PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | gosalyn; reviewers webby | #1787 | done | — | Webby approves against the ruling. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Jason gets a report. (sage) | `docs/plans/2026-10-20_case2-rows.md` § PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | Landed 647424442 on 86a665bdf: 1841f7d4e and 6b5b06819 rebased, patch-ids equal (4e50b4b6, 16a7a02f), range-diff =, tree 4f30ed10a = Gosalyn's gated trial tree. Webby APPROVE rev 3308 c30764 on 6b5b06819. Gate 19:06Z on the tip tree: bus+tasks requirements and tasks verbs 37/0/0, 0 skips; no scripts/test-*.sh reads the PRD (control ok). PRD 1.15. 1.16 is row 291, waits for Jason. |
-| 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | briefed | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | — |
+| 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | in-review, round 1, request posted | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | E1 (webby-0227): the manifest's existing test changes are survey.test.mjs:73 (mos-1330 re-pin, 28918824c) and business.test.mjs +4 (T7, library-supporting-other-universe). Candidate b2a1f4092. T2 receipts in agents/honker/work/queue-283/BUILD.md. |
 | 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers dewey | #1789 | briefed | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | — |
 | 285 | Case 2 C2-08b role changes for agent writes and the chief's read grant | scrooge; reviewers webby | #1790 | briefed | 213 done, 291 done | Webby approves the manifest. Business suite, test-config.sh and every scripts/test-*.sh green on Sage's gate. Grep for CREATIVE_KINDS and 64-hex pins of changed role files. Sage checks it against mos-1309 item 5. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08b role changes for agent writes and the chief's read grant (mos-1309 item 5) | — |
 | 286 | Case 2 C2-03b push and per-seat credentials for the library mirror (with R4, mos-1323) | ludwig; reviewers dewey | #1791 | briefed | 222 done | Dewey approves the manifest. Library and bus suites and every scripts/test-*.sh green on Sage's gate, mutant killed. A search of the run output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03b push and per-seat credentials for the library mirror | — |
 | 287 | Case 2 C2-21 the grant executor for a library project | megavolt; reviewers dewey | #1792 | briefed | 226 done, 285 done | Dewey approves the manifest. Bus suite, Gitea Docker test, install test and every scripts/test-*.sh green on Sage's gate. A search of the run output for the fixture admin and seat tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-21 the grant executor for a library project | — |
-| 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | honker; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | — |
+| 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | bubba; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | A2 revert contract (morgana-0199, sage-3596): library.revert is a human verb. Args {project, commit}, strict keys; project is the business.projects key (the chat repo link), not a UUID. Result {project, path, reverted, commit}. Refusals: 409 stale-base, and 409 library-revert-not-agent for an agent caller. Owner Bubba under Q245 (mos-1506). |
 | 289 | Case 2 C2-11b Console library pages and her saves (Haiku subagent, decision 129) | researcher; reviewers filbert | #1794 | briefed | 214 done, 288 done | Filbert approves the manifest. The webui suite and every scripts/test-*.sh are green on Sage's gate. Grep for hash pins on bus.js and serve.mjs before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11b Console library pages and her saves | — |
 | 290 | Case 2 C2-12b the setup sheet rewrite for free chat, supporting folders and saves | louie; reviewers webby | #1795 | briefed | 217 done, 218 done, 285 done, 291 done | Doc only. Webby approves it against the ruling. Before landing, grep packages/*/tests and scripts/test-*.sh to confirm no test reads the file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12b the setup sheet rewrite for free chat, supporting folders and saves | — |
 | 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | done | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | Landed 4874d1e83 on e909ef51a: 482e865ac replayed, patch-id equal (cef7de74), range-diff =. Webby APPROVE c30848 on 482e865ac; Jason approved the text in Q229. Gate 16:15Z on the tip tree: every package suite but queue, 0 fail 0 skipped (tasks 100, bus 891, cli 941, plugins 119, webui 392, business 231), every scripts/test-*.sh rc 0 (queue-root and row 244 skips only). PRD 1.16. 1.17 is row 308. |
@@ -332,9 +332,9 @@ Generated from `docs/plans/queue.json` revision 3636 by `queue render`. Do not e
 | 293 | 574: maintenance-free test fixture commits (Vikunja 574) | gander; reviewers filbert | #1805 | done | — | Filbert approves. The four whole files, then the seat and cli suites, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 574, maintenance-free test fixture commits (Vikunja 574) | LANDED e51d11640 03:55Z 10-23 (cherry-pick of gander b23783f39..a9cae2bd6 onto 464010fbe; range-diff 6/6 equal, range patch-id equal). Filbert APPROVE c30982 cdda41f5; run 2 4 files 153/0, seat 202/0, cli 905/0, 312 flagged/0 maintenance children. N1: lifecycle.test needs TMPDIR of 50 bytes or less. Residual: queue store.mjs, discord git.mjs, harness tools.mjs unflagged. #1805 closed c31013, P19 574 c888. |
 | 294 | FED R6: Console granted-user sign-in, user-cli transport, peer links | launchpad; reviewers duckworth | #1800 | done | — | Duckworth approves the manifest. The webui, cli and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R6, Console granted-user sign-in | landed d3059c2c3 on refactor 07:04Z: cherry-pick of c902a767d..24b745447 onto 09d0d6faf, range-diff 11 =, patch-id 8371405a equal. Duckworth approve c31053 rev 3469 on a1ff5d67, C1/C2 met. Run 4 on 8616b9a4f from npm ci: webui 365, cli 909, bus 873, 10 scripts, M1-M11 killed. Merged tree: stack-release-external 25, stack-upgrade 21, stack-release 223/224 (R9 transient, row 1810) then 224/224 rerun under mos-1422. Follow-ups rows 300, 301. Closes #1800. |
 | 295 | FED R4: revocation | morgana; reviewers dewey | #1801 | done | — | Dewey approves the manifest. The bus, cli and business suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R4, revocation | LANDED 2efd127ce on refactor 10:10Z 10-23 (9 commits cherry-picked onto 07802dc57, range-diff all =, patch-ids match, HEAD~1 tree a86592ffc = gated tree, top commit BUILD.md doc-only). Gate d68b4300d manifest e94c9aeb: 13 whole files, bus 886/0, business 231/0, cli 924/0, harness 151/0, all test-*.sh rc 0, M1-M16 killed, M8 per mos-1436. Dewey approve rev 3500 c31102. Re-pin precheck mos-1436 cond 11 binds. |
-| 296 | FED R7: scratch two-instance acceptance | quackerjack; reviewers filbert | #1802 | briefed | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
-| 297 | GitHub grant method (Bushroot's half of #436b) | bushroot; reviewers dewey | #1803 | briefed | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
-| 298 | Q228: chief-of-staff grant scope | megavolt; reviewers dewey | #1804 | briefed | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
+| 296 | FED R7: scratch two-instance acceptance | lena; reviewers filbert | #1802 | briefed | 190 done, 294 done, 295 done | Filbert approves the manifest. The script test and every scripts/test-*.sh are green on Sage's gate, and no unit, port or socket of the script's outlives the run. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: FED R7, scratch two-instance acceptance | — |
+| 297 | GitHub grant method (Bushroot's half of #436b) | violet; reviewers dewey | #1803 | briefed | 198 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the GitHub grant method (Bushroot's half of #436b) | — |
+| 298 | Q228: chief-of-staff grant scope | boyd; reviewers dewey | #1804 | in-review, round 1, request posted | 252 done | Dewey approves the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: the chief-of-staff grant scope (Q228) | — |
 | 299 | 573: the P10 hop band (Vikunja 573) | gander; reviewers filbert | #1806 | done | 293 done | Filbert approves. The whole file under load at least 3 times, then the cli suite, are green on Sage's gate. (sage) | `docs/plans/2026-10-23_mvp-readiness-rows.md` § Brief: 573, the P10 hop band (Vikunja 573) | landed ffb2fedfb 08:03Z on 15e688cc0 via Filbert SESSIONS c1f910b4c; 5 commits = gander/row299-gate-277ace0b 63db96d8b (range-diff 5/5 =, tree differs only BUILD-LOG/SESSIONS); manifest 277ace0b sha256 -c OK. Gate green on ffa93b054: case1 whole 3x 53/0/0, cli whole 917/0/0 (59 files), P10 inner 2.27 outer 4.01, M1-M6 killed (gander-0189). Filbert approve rev 3485 c31084; N1 M1 1.23 s margin. |
 | 300 | R6-N1: HTTP-level test of the user-session option swap (294 N1) | launchpad; reviewers duckworth | #1807 | done | 294 done | Duckworth approves the manifest; new test file whole, webui suite, mutant M12 killed (sage) | `docs/plans/2026-10-23_r6-followup-rows.md` § Brief: R6-N1, an HTTP-level test of the user-session option swap | Landed on refactor as 9d929911c..07315e651 (from launchpad/row300 a00b25b37, range-diff equal), pushed 5b846b048 12:28Z. Duckworth approved r2 (c31158, rev 3559). Sage gate on bcf3c1dac: user-option-swap 1/0, webui 375/0 with pinned esbuild and MOSAIC_REQUIRE_EDITOR_BUILD=1, M12 killed at :151. Run 1 red placed under mos-1272 (headers). N1 deferred: board proxy upstream has no recorder. |
 | 301 | R6-N4: fold user-bus.mjs back into bus.mjs (294 N4) | launchpad; reviewers duckworth | #1808 | done | 294 done | Duckworth approves the manifest; channel-proof.test, webui suite and 294 user-transport tests whole and green; re-pin only with Mos go (sage) | `docs/plans/2026-10-23_r6-followup-rows.md` § Brief: R6-N4, fold user-bus.mjs back into bus.mjs | Landed on refactor as bb031ec84..5b846b048 (from launchpad/row301 acc97fb9c, range-diff equal), pushed 12:28Z. Re-pin of webui bus.mjs to 39fcb27c is its own commit 59f0e44f4 (mos-1449); fixture stubs per mos-1451. Duckworth approved r2 (c31159, rev 3560). Sage gate: channel-proof 2/0, webui 374/0 pinned esbuild, granted-user 19/0. Live unchanged; 301 makes its own re-pin window. |
@@ -355,6 +355,7 @@ Generated from `docs/plans/queue.json` revision 3636 by `queue render`. Do not e
 | 316 | 571 W5: read-only flags, citations and chat suggestions (post-10-27) | unassigned | — | queued | 315 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W5 read-only flags, citations and chat suggestions | — |
 | 317 | 571 W7: human one-way chapter import and Case 2 format routing, production import closed; the first real import opens only after W8 lands (post-10-27, mos-1470) | unassigned | — | queued | 314 done, 315 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W7 human one-way chapter import and Case 2 format routing | — |
 | 318 | 571 W8: Console Connections view for Markdown and DOCX story files, before W7's first real import (post-10-27, mos-1470) | unassigned | — | queued | 314 done, 315 done, 317 done | Independent Opus 5.5 reviewer, not the author, approves the manifest; the brief section's Gate and G1 pass on Sage's slot: touched test files whole, affected package suites green, named mutants killed. Post-10-27; MVP rows keep slot priority (sage) | `docs/plans/2026-10-21_q195-writing-editor.md` § W8 Console Connections view for Markdown and DOCX story files | fenton-0017 carry: connections.test.mjs must test that links inside comments and tracked deletions are excluded. W8 follows W7's closed routing candidate and lands before W7's first real import opens (mos-1470) |
+| 319 | GitHub consumer for row 297's protected githubWithToken callback, honoring expiry and cancellation (post-10-27) | unassigned; reviewers dewey | — | queued | 297 done | Dewey approves the design and the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and the signal and expiry mutants are killed. (sage) | `docs/plans/2026-10-23_github-consumer-brief.md` § Brief: a GitHub consumer for Broker.githubWithToken | — |
 
 <!-- mosaic-queue:end -->
 

packages/bus/README.md

@@ -1071,59 +1071,3 @@ TERM concurrently, then KILL after five seconds and observe for two more.
 Unknown targets remain visible and prevent resume. Existing run evidence is
 not synthesized or rewritten. First activation stops old processing before
 trusted initialization and aligns the copy and image in the human's window.
-
-### GitHub App grants (row 297)
-
-The `github` method uses the same chief raise, human Approve, reserved `grant.call`
-then `grant.result`, and local-first revoke boundary as Gitea. Its tokens expire
-within an hour, so the durable grant authorizes protected renewal up to its
-`rotateBy` day. Every generation remains bound to the original configuration.
-A changed definition, allowed-project list, repository ID/remote or admin metadata
-requires another human decision. No account or fork is created.
-
-A role definition declares `{ "service": "github" }` without scopes. Its business
-role names `"github": { "projects": ["app"] }`, and that project supplies its HTTPS
-`remote` and positive integer `githubId`. No generic `credentials.github` reference
-is accepted. Code fixes the token permissions to `contents: write, metadata: read`,
-with exact selected repository IDs. Workflow-file writes (`.github/workflows/`),
-PR/issue writes and administration are excluded. A workflow push refusal is intended.
-
-Jason alone sets the App private key, through bounded stdin, after creating and
-installing the App. Agents do not perform this live step:
-
-```sh
-mosaic grants admin set github --url https://api.github.com --app-id APP_ID \
-  --installation-id INSTALLATION_ID --account-id ACCOUNT_ID --rotate-by YYYY-MM-DD --business BUSINESS
-mosaic grants status github --business BUSINESS
-mosaic grants revoke AGENT github --reason REASON --business BUSINESS
-mosaic grants sweep github --business BUSINESS
-```
-
-Admin rotation takes a replacement RSA private key on stdin with `admin rotate
-github --rotate-by DATE`. It preserves App/installation/account/origin identity and
-invalidates old bindings. GitHub App key creation and deletion remain Jason's own
-GitHub administration step. Admin remove removes the local slot; it does not claim
-to delete the App or remotely revoke its private keys.
-
-Only trusted protected code can call `githubWithToken(business, agent, fn)`. It
-checks approval/configuration/expiry, renews when required, and passes the token
-and cancellation signal to that trusted callback. No socket verb returns a token
-or exposes renewal. Tokens stay in private generation files outside run evidence;
-RSA keys, JWTs and token values are never audit fields. Revoke blocks use and
-renewal before its remote undo. An interrupted mint with no recoverable token value
-stays visible in `serviceLeft` until its conservative expiry bound; a new token
-does not hide it. `sweep` retries known tokens and records expiry cleanup.
-
-Consumer gap (sage-3620): this row supplies the protected method and renewal
-function, but adds no GitHub mirror push, publication or credential helper. The
-existing Gitea credential path has day-level dates and Gitea fork identity; those
-cannot safely carry a one-hour GitHub token. GitHub publication therefore needs a
-separate consumer row and is not enabled by approving this method.
-
-`sweep` also closes an active generation's private file after its conservative
-expiry bound, recording reason `expired` while keeping the durable grant. A
-later guarded use renews from the same unchanged approval. Before that cleanup,
-status can show an expired generation; its timestamp guard still refuses use.
-Removing the admin slot while grants/residue exist invalidates renewal and stops
-remote cleanup until a matching slot is restored or the conservative bound
-elapses. Remove does not claim remote revocation or delete the App's keys.

packages/bus/src/broker.mjs

@@ -415,7 +415,6 @@ export class Broker {
   // Row 236 (#436b): giteaGrant and giteaKeys from gitea-grant.mjs, or null, and the remote halves of
   // section 5's restart rows and of revokes a restart cut short, for reconcileGitea.
   #giteaGrant;
-  #githubGrant;
   #giteaKeys;
   #giteaUndo = [];
   // Row 281 (#1786, d6 section 3b): each tracked Gitea promise and the business/agent it acts for, or
@@ -440,7 +439,7 @@ export class Broker {
   #clock = 0;
   #processing;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, roleFile = null, giteaGrant = null, giteaKeys = null, githubGrant = null, access = null, accessStamp = null, compactions = null }) {
+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null }) {
     if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
     // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
     if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
@@ -467,16 +466,6 @@ export class Broker {
     this.#hostKeys = hostKeys;
     this.#giteaGrant = giteaGrant;
     this.#giteaKeys = giteaKeys;
-    this.#githubGrant = githubGrant;
-    githubGrant?.configure({
-      store,
-      business: (business) => this.#business(business),
-      event: (business, body) => store.transaction(() => this.#grantEvent(business, body, body.agent ?? null)),
-      approved: (business, decision) => this.#approvedGrant(business, decision),
-      consume: (business, decision) => store.transaction(() => this.#consumeGrant(business, decision, 'github')),
-      grantable: (business, agent) => this.#grantableAgent(business, agent),
-      working: () => { this.#processingWork(); return true; },
-    });
     this.#access = access;
     this.#accessStamp = accessStamp;
     this.#compactions = compactions;
@@ -2034,16 +2023,6 @@ export class Broker {
       for (const m of this.#openRevokes(business)) this.#revokeUndo.push({ business, ...m });
       // Row 236 (#436b r5 section 5): the Gitea grants' local part.
       if (this.#giteaGrant && this.#giteaKeys) ended.push(...this.#giteaReconcileLocal(business));
-      if (this.#githubGrant) {
-        this.#githubGrant.reconcile(business);
-        for (const decision of this.#openGrantDecisions(business, 'github')) {
-          this.#store.transaction(() => {
-            const g = this.#consumeGrant(business, decision, 'github');
-            this.#grantEvent(business, { action: 'grant.failed', method: 'github', grantDecision: decision, agent: g.agent, code: 'interrupted' }, g.agent);
-          });
-          ended.push(decision);
-        }
-      }
       this.#interruptedJobs(business);
     }
     return ended;
@@ -2223,8 +2202,6 @@ export class Broker {
     for (const d of open) if (d.grant.method === 'host') hosts.add(d.grant.host);
     for (const host of [...hosts].sort()) set.push({ label: 'host:' + host, kind: 'host', host });
     if (this.#giteaPending(business, agent, open)) set.push({ label: 'gitea', kind: 'gitea' });
-    if (this.#githubGrant && (open.some((d) => d.grant.method === 'github') || this.#githubGrant.pending(business, agent)))
-      set.push({ label: 'github', kind: 'github' });
     if (this.#hostGrant)
       for (const { host } of this.#store.all('SELECT host FROM hosts WHERE business=? ORDER BY host', business)) {
         if (hosts.has(host)) continue;
@@ -2243,10 +2220,9 @@ export class Broker {
       .map((d) => ({ id: d.id, raise: this.#raised(business, d.id) }))
       .filter(({ id, raise }) => {
         const g = raise?.grant;
-        if (g?.agent !== agent || (g.method !== 'host' && g.method !== 'gitea' && g.method !== 'github')) return false;
+        if (g?.agent !== agent || (g.method !== 'host' && g.method !== 'gitea')) return false;
         const r = this.#closed(id);
         if (r && !(r.op === 'resolved' && r.choice === raise.approvalChoice)) return false;
-        if (g.method === 'github') return !this.#spent(business, id) && !this.#githubGrant?.decisionRevoked(business, g);
         if (
           this.#store.get(
             `SELECT 1 FROM events WHERE business=? AND ${GRANT_EVIDENCE} AND json_extract(body,'$.grantDecision')=? AND json_extract(body,'$.action') IN ('grant.applied','grant.failed') LIMIT 1`,
@@ -2335,12 +2311,6 @@ export class Broker {
         at = 'gitea';
         grants.push(...(await this.#stepGGitea(business, agent, { job, reason, by, flag }, refuse)));
       }
-      if (set.some((x) => x.kind === 'github')) {
-        at = 'github';
-        const result = await this.#githubGrant.revoke(business, agent, reason, by);
-        if (result.serviceLeft.length) refuse('github', 'github-left');
-        grants.push({ grant: 'github', granted: true });
-      }
       for (const g of set.filter((x) => x.kind === 'line')) {
         at = g.label;
         const record = this.#hostRecord(business, g.host);
@@ -2590,15 +2560,6 @@ export class Broker {
       this.#store.transaction(() => this.#agent(s));
       if (a.action !== 'credential.mint' || 'spec_path' in a || 'spec_commit' in a) fail('invalid-request');
       if (this.#business(s.business).roles[s.role]?.definition !== STAFF_TO) fail('grant-chief-only');
-      // Row297: the same chief/human grant gate, with a method-specific protected executor.
-      if (a.grant?.method === 'github') {
-        if (!this.#githubGrant) fail('github-not-configured');
-        return this.#store.transaction(() => {
-          const result = this.#dispatch(s, 'decision.raise', a, null, this.#githubGrant.raiseBinding(s.business, a.grant));
-          this.#secretCheck(result);
-          return result;
-        });
-      }
       // Row 236 (#436b section 2): no network call at raise, so every check runs in the raise transaction.
       if (a.grant?.method === 'gitea') {
         if (!this.#giteaGrant) fail('gitea-not-configured');
@@ -2861,7 +2822,6 @@ export class Broker {
   async grantsIdle() {
     while (this.#grantJobs.size || this.#giteaRuns.size || this.#hostRuns.size)
       await Promise.allSettled([...this.#grantJobs, ...this.#giteaRuns.keys(), ...[...this.#hostRuns.values()].flatMap((s) => [...s])]);
-    await this.#githubGrant?.idle();
   }
   // Section 4 steps 0 (the remote half) to 8. Never throws: the outcome is in the store and the
   // notices, and the return value is 'applied', 'settle-pending' or the code grant.failed records.
@@ -3589,75 +3549,10 @@ export class Broker {
     if (this.#business(s.business).roles[s.role]?.definition !== STAFF_TO) fail('grant-chief-only');
     return s.role;
   }
-  // Row297 trusted host API. No socket verb returns tokens or renews grants.
-  githubWithToken(business, agent, fn) {
-    if (!this.#githubGrant) fail('github-not-configured');
-    return this.#githubGrant.withToken(business, agent, fn);
-  }
-  async reconcileGithub() {
-    if (!this.#githubGrant) return;
-    for (const business of Object.keys(this.#businesses))
-      if (this.#githubGrant.status(business).serviceLeft.length) await this.#githubGrant.sweep(business, 'restart');
-  }
-  async closeGithub() { await this.#githubGrant?.close(); }
-  #startGithub(business, decision) {
-    if (!this.#githubGrant) fail('github-not-configured');
-    const g = this.#approvedGrant(business, decision);
-    if (g?.method !== 'github') fail('not-authorized');
-    const job = this.#track(this.#githubGrant.run(business, decision), business + '/' + g.agent);
-    job.then(
-      () => this.#store.transaction(() => this.#grantNotice(business, decision, `GitHub grant to ${g.agent} applied; protected renewal stays within the approved binding.`)),
-      (e) => this.#store.transaction(() => this.#grantNotice(business, decision, `GitHub grant to ${g.agent} failed: ${e instanceof BusError ? e.code : 'github-failed'}.`)),
-    ).catch(() => {});
-    return job;
-  }
-  async #requestGithub(s, verb, a, by) {
-    if (!this.#githubGrant) fail('github-not-configured');
-    const manager = this.#githubGrant;
-    if (verb === 'grants.status' || verb === 'grants.sweep') {
-      keys(a, ['service'], ['service']);
-      return verb === 'grants.status' ? manager.status(s.business) : manager.sweep(s.business, by);
-    }
-    if (verb === 'grants.revoke') {
-      keys(a, ['service', 'agent', 'reason'], ['service', 'agent', 'reason']);
-      identifier(a.agent); string(a.reason, 500);
-      if (!Object.hasOwn(this.#business(s.business).roles, a.agent)) fail('credential-unknown');
-      if (this.#revoking.has(s.business + '/' + a.agent)) fail('grant-revoke-running');
-      return manager.revoke(s.business, a.agent, a.reason, by);
-    }
-    if (verb === 'grants.admin.remove') {
-      keys(a, ['service'], ['service']);
-      manager.api.removeAdmin(s.business);
-      this.#store.transaction(() => this.#grantEvent(s.business, { action: 'grant.admin', method: 'github', verb: 'remove', by }));
-      return { removed: true };
-    }
-    const replace = verb === 'grants.admin.rotate';
-    keys(a, replace ? ['service', 'rotateBy', 'token'] : ['service', 'url', 'appId', 'installationId', 'accountId', 'rotateBy', 'token'],
-      replace ? ['service', 'rotateBy', 'token'] : ['service', 'url', 'appId', 'installationId', 'accountId', 'rotateBy', 'token']);
-    const previous = replace ? manager.api.adminMeta(s.business) : null;
-    if (replace && !previous) fail('grant-admin-missing');
-    const meta = { url: replace ? previous.url : a.url, appId: replace ? previous.appId : a.appId,
-      installationId: replace ? previous.installationId : a.installationId, accountId: replace ? previous.accountId : a.accountId,
-      rotateBy: a.rotateBy, setAt: this.#now() };
-    const voided = this.#openGrantDecisions(s.business, 'github').length;
-    await manager.api.setAdmin(s.business, meta, a.token, manager.audit(s.business, 'admin:' + by), { replace });
-    this.#store.transaction(() => this.#grantEvent(s.business, { action: 'grant.admin', method: 'github', verb: replace ? 'rotate' : 'set', ...meta, voided, by }));
-    return { ...meta, voided };
-  }
   // Row 236: the grants verbs. Async, because each one may call Gitea.
   async #requestGrants(s, verb, a) {
     try {
       const by = this.#grantsCaller(s, verb);
-      if (verb === 'grants.run') {
-        keys(a, ['decision'], ['decision']); identifier(a.decision);
-      }
-      if (verb === 'grants.run' && this.#approvedGrant(s.business, a.decision)?.method === 'github') {
-        if (this.#spent(s.business, a.decision)) fail('decision-consumed');
-        const g = this.#approvedGrant(s.business, a.decision);
-        this.#startGithub(s.business, a.decision).catch(() => {});
-        return { decision: a.decision, agent: g.agent, started: true };
-      }
-      if (a.service === 'github') return await this.#requestGithub(s, verb, a, by);
       if (!this.#giteaGrant || !this.#giteaKeys) fail('gitea-not-configured');
       if (verb === 'grants.run') {
         keys(a, ['decision'], ['decision']);
@@ -4898,8 +4793,6 @@ export class Broker {
       throw new BusError('outcome-unknown');
     }
     this.#secretCheck(result);
-    if (verb === 'credentials.delete' && this.#githubGrant?.pending(s.business, a.agent))
-      this.#track(this.#githubGrant.revoke(s.business, a.agent, a.reason, s.tester ? 'tester' : s.human), s.business + '/' + a.agent).catch(() => {});
     // Row 236 (#436b section 6): a gitea revoke, or a fire, of an agent this stack made a Gitea user for
     // takes the grant away too. Credentials has done step 1. Step 2 runs here; step 3 and the fire's
     // steps run once this returns.
@@ -5764,7 +5657,6 @@ export class Broker {
         if (grant?.method === 'host-enroll') setImmediate(() => this.#runEnrollment(s.business, d.id));
         if (grant?.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
         if (grant?.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
-        if (grant?.method === 'github') setImmediate(() => Promise.resolve().then(() => this.#startGithub(s.business, d.id)).catch(() => {}));
         // Row 115 (#1609): a close by anyone but the raising run tells the raising role, routed like message.send's.
         // Row 133 (#1627): no messaging check here. decision.raise refused a route that can't message the
         // raiser, definitions change only with a pinned copy and arbiters only through the business

packages/bus/src/github-api.mjs

@@ -1,143 +0,0 @@
-// Row297 GitHub App HTTPS boundary. No PATs, user creation or fork calls.
-import { createPrivateKey, sign } from 'node:crypto';
-import { request } from 'node:https';
-import { BusError } from './broker.mjs';
-import { day } from './credentials.mjs';
-import { githubDirectory, githubRead, githubWrite, githubUnlink } from './github-files.mjs';
-
-export const FIXED_PERMISSIONS = Object.freeze({ contents: 'write', metadata: 'read' });
-export const API_VERSION = '2026-03-10';
-export const CALL_TIMEOUT_MS = 15000;
-const META_KEYS = ['accountId', 'appId', 'installationId', 'rotateBy', 'setAt', 'url'];
-const id = (v) => Number.isSafeInteger(v) && v > 0;
-const fail = (code) => { throw new BusError(code); };
-export function githubOrigin(value) {
-  try {
-    const url = new URL(value);
-    if (url.protocol !== 'https:' || url.username || url.password || value !== url.origin) fail('invalid-request');
-    return url.origin;
-  } catch { fail('invalid-request'); }
-}
-export function githubMeta(meta) {
-  if (!meta || typeof meta !== 'object' || Array.isArray(meta) || Object.keys(meta).sort().join() !== META_KEYS.join()) fail('invalid-request');
-  githubOrigin(meta.url);
-  if (![meta.appId, meta.installationId, meta.accountId].every(id) || !day(meta.rotateBy) ||
-    typeof meta.setAt !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(meta.setAt) || !Number.isFinite(Date.parse(meta.setAt)) || new Date(meta.setAt).toISOString() !== meta.setAt) fail('invalid-request');
-  return { ...meta };
-}
-export function githubRsa(text) {
-  try {
-    if (typeof text !== 'string' || text.length > 16384 || !/^-----BEGIN (RSA )?PRIVATE KEY-----\n/.test(text)) fail('credential-format');
-    const key = createPrivateKey(text);
-    if (key.asymmetricKeyType !== 'rsa' || key.asymmetricKeyDetails.modulusLength < 2048) fail('credential-format');
-    return key;
-  } catch { fail('credential-format'); }
-}
-export function githubJwt(key, appId, now) {
-  const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
-  const secs = Math.floor(now / 1000);
-  const input = encode({ alg: 'RS256', typ: 'JWT' }) + '.' + encode({ iat: secs - 60, exp: secs + 540, iss: String(appId) });
-  return input + '.' + sign('RSA-SHA256', Buffer.from(input), key).toString('base64url');
-}
-// Never follows redirects or returns headers/error text. Body limit and whole-call timeout.
-export function sendGithub({ url, method, path, token, body, ca, timeoutMs = CALL_TIMEOUT_MS }) {
-  return new Promise((resolve) => {
-    let req, ended = false;
-    const end = (status = 0, json = null) => {
-      if (ended) return;
-      ended = true; clearTimeout(timer); resolve({ status, json });
-    };
-    const timer = setTimeout(() => { req?.destroy(); end(); }, timeoutMs);
-    try {
-      githubOrigin(url);
-      if (!path.startsWith('/') || path.startsWith('//')) fail('invalid-request');
-      const data = body === undefined ? null : Buffer.from(JSON.stringify(body));
-      req = request(new URL(path, url), { method, ca, agent: false, headers: {
-        accept: 'application/vnd.github+json', authorization: 'Bearer ' + token,
-        'x-github-api-version': API_VERSION, 'user-agent': 'Mosaic-grant',
-        ...(data ? { 'content-type': 'application/json', 'content-length': String(data.length) } : {}),
-      } }, (res) => {
-        let size = 0; const chunks = [];
-        res.on('data', (part) => {
-          size += part.length;
-          if (size > 4 * 1024 * 1024) { req.destroy(); end(); }
-          else chunks.push(part);
-        });
-        res.on('end', () => {
-          let json = null;
-          try { json = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch {}
-          end(res.statusCode, json);
-        });
-        res.on('error', () => end());
-      });
-      req.on('error', () => end()); req.end(data ?? undefined);
-    } catch { end(); }
-  });
-}
-
-export function githubApi({ configDir, ca, transport = sendGithub, now = () => Date.now(), timeoutMs = CALL_TIMEOUT_MS }) {
-  const directory = (business, create = false) => githubDirectory(configDir, ['grants', business, 'github'], create);
-  const adminMeta = (business) => {
-    const text = githubRead(directory(business), 'admin.json');
-    if (text === null) return null;
-    try { return githubMeta(JSON.parse(text)); } catch { fail('credential-file'); }
-  };
-  const call = async (meta, key, log, method, path, { token, body, installation = false } = {}) => {
-    if (typeof log !== 'function') fail('not-configured');
-    if (installation && (typeof token !== 'string' || token.length < 16 || token.length > 16384 || !/^[-A-Za-z0-9._~]+$/.test(token))) fail('credential-format');
-    const authorization = installation ? token : githubJwt(key, meta.appId, now());
-    return log({ method, path }, () => transport({ url: meta.url, method, path, token: authorization, body, ca, timeoutMs }));
-  };
-  const check = async (meta, key, log) => {
-    if (meta.rotateBy <= new Date(now()).toISOString().slice(0, 10)) fail('grant-admin-rotation-due');
-    const app = await call(meta, key, log, 'GET', '/app');
-    if ([401, 403].includes(app.status)) fail('grant-admin-account');
-    if (app.status !== 200) fail('github-failed');
-    if (app.json?.id !== meta.appId) fail('grant-admin-account');
-    const install = await call(meta, key, log, 'GET', `/app/installations/${meta.installationId}`);
-    if (install.status !== 200) fail([401, 403, 404].includes(install.status) ? 'grant-admin-account' : 'github-failed');
-    const i = install.json;
-    if (i?.id !== meta.installationId || i.app_id !== meta.appId || i.account?.id !== meta.accountId || i.suspended_at !== null) fail('grant-admin-account');
-    if (!i.permissions || !Object.entries(FIXED_PERMISSIONS).every(([k, v]) => i.permissions[k] === v || (v === 'read' && i.permissions[k] === 'write'))) fail('grant-admin-scope');
-  };
-  const admin = (business) => {
-    const meta = adminMeta(business);
-    if (!meta) fail('grant-admin-missing');
-    const key = githubRsa(githubRead(directory(business), 'admin'));
-    return { meta, key };
-  };
-  return {
-    adminMeta,
-    async setAdmin(business, input, text, log, { replace = false } = {}) {
-      const meta = githubMeta(input); const key = githubRsa(text);
-      const old = adminMeta(business);
-      if (!replace && (old || githubRead(directory(business), 'admin') !== null)) fail('grant-admin-exists');
-      if (replace && (!old || ['url', 'appId', 'installationId', 'accountId'].some((k) => old[k] !== meta[k]))) fail('grant-admin-account');
-      await check(meta, key, log);
-      const dir = directory(business, true);
-      // Rotation invalidates approved bindings before replacing the signing key.
-      if (replace) githubWrite(dir, 'admin.json', JSON.stringify(meta) + '\n');
-      githubWrite(dir, 'admin', text.replace(/\n?$/, '\n'));
-      if (!replace) githubWrite(dir, 'admin.json', JSON.stringify(meta) + '\n');
-      return meta;
-    },
-    removeAdmin(business) {
-      const dir = directory(business);
-      githubUnlink(dir, 'admin.json'); githubUnlink(dir, 'admin');
-    },
-    async checkAdmin(business, log) { const { meta, key } = admin(business); await check(meta, key, log); return meta; },
-    mint(business, repositoryIds, log) {
-      const { meta, key } = admin(business);
-      return call(meta, key, log, 'POST', `/app/installations/${meta.installationId}/access_tokens`,
-        { body: { repository_ids: repositoryIds, permissions: { ...FIXED_PERMISSIONS } } });
-    },
-    repos(business, token, page, log) {
-      const { meta, key } = admin(business);
-      return call(meta, key, log, 'GET', `/installation/repositories?per_page=30&page=${page}`, { token, installation: true });
-    },
-    revoke(business, token, log) {
-      const { meta, key } = admin(business);
-      return call(meta, key, log, 'DELETE', '/installation/token', { token, installation: true });
-    },
-  };
-}

packages/bus/src/github-files.mjs

@@ -1,64 +0,0 @@
-// Row297 protected files. Values never enter the bus event store.
-import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync } from 'node:fs';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { BusError } from './broker.mjs';
-import { privateDir } from './credentials.mjs';
-
-const fail = () => { throw new BusError('credential-file'); };
-const checkName = (name) => { if (typeof name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(name) || name === '..') fail(); };
-export function githubDirectory(configDir, parts, create = false) {
-  let dir = configDir;
-  for (const part of ['secrets', ...parts]) {
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(part) || part === '..') fail();
-    dir = join(dir, part);
-    if (!privateDir(dir, { missing: true })) {
-      if (!create) return null;
-      mkdirSync(dir, { mode: 0o700 });
-    }
-    privateDir(dir);
-  }
-  return dir;
-}
-export function githubRead(dir, name) {
-  checkName(name);
-  if (!dir) return null;
-  let fd;
-  try { fd = openSync(join(dir, name), constants.O_RDONLY | constants.O_NOFOLLOW); }
-  catch (e) { if (e.code === 'ENOENT') return null; fail(); }
-  try {
-    const stat = fstatSync(fd);
-    if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o600 || stat.size > 65536) fail();
-    return readFileSync(fd, 'utf8');
-  } catch (e) { if (e instanceof BusError) throw e; fail(); }
-  finally { closeSync(fd); }
-}
-export function githubWrite(dir, name, text) {
-  checkName(name);
-  const target = join(dir, name);
-  // A foreign/symlink existing file is a refusal, never something to repair silently.
-  try {
-    const stat = lstatSync(target);
-    if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o600) fail();
-  } catch (e) { if (e.code !== 'ENOENT') throw e; }
-  const tmp = target + '.' + randomUUID() + '.tmp';
-  let fd;
-  try {
-    fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    writeSync(fd, text); fsyncSync(fd); closeSync(fd); fd = undefined;
-    renameSync(tmp, target);
-    const parent = openSync(dir, constants.O_RDONLY);
-    try { fsyncSync(parent); } finally { closeSync(parent); }
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-    try { unlinkSync(tmp); } catch (e) { if (e.code !== 'ENOENT') throw e; }
-  }
-}
-export function githubUnlink(dir, name) {
-  if (!dir) return;
-  // Apply the same checks before deleting any protected file.
-  if (githubRead(dir, name) === null) return;
-  unlinkSync(join(dir, name));
-  const fd = openSync(dir, constants.O_RDONLY);
-  try { fsyncSync(fd); } finally { closeSync(fd); }
-}

packages/bus/src/github-grant.mjs

@@ -1,298 +0,0 @@
-// Row297: protected, event-backed GitHub grants. No worker-facing token or renewal verb.
-import { createHash, randomUUID } from 'node:crypto';
-import { BusError, GRANT_EVIDENCE } from './broker.mjs';
-import { canonicalJson } from '../../business/src/util.mjs';
-import { CREATIVE_DEFINITIONS, ID_PATTERN } from '../../business/src/vocabulary.mjs';
-import { day } from './credentials.mjs';
-import { FIXED_PERMISSIONS, CALL_TIMEOUT_MS } from './github-api.mjs';
-import { githubDirectory, githubRead, githubWrite, githubUnlink } from './github-files.mjs';
-export { CALL_TIMEOUT_MS };
-export const TOKEN_LIFETIME_MS = 3600000;
-export const CLOCK_SKEW_MS = 60000;
-export const TOKEN_MARGIN_MS = 60000;
-const PAGE_SIZE = 30;
-const fail = (code) => { throw new BusError(code); };
-const hash = (v) => createHash('sha256').update(canonicalJson(v)).digest('hex');
-const isId = (v) => Number.isSafeInteger(v) && v > 0;
-const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
-const exact = (v, keys) => object(v) && Object.keys(v).sort().join() === [...keys].sort().join();
-const tokenText = (v) => typeof v === 'string' && v.length >= 16 && v.length <= 16384 && /^[-A-Za-z0-9._~]+$/.test(v);
-const sameIds = (rows, bound) => Array.isArray(rows) && rows.length === bound.length &&
-  rows.every((r) => isId(r?.id)) && new Set(rows.map((r) => r.id)).size === rows.length &&
-  rows.every((r) => bound.some((b) => b.id === r.id));
-const identity = (m) => Object.fromEntries(['url', 'appId', 'installationId', 'accountId'].map((k) => [k, m[k]]));
-const refusal = (e) => e instanceof BusError ? e.code : 'github-failed';
-
-export function githubGrant({ api, configDir, now = () => Date.now(), timeoutMs = CALL_TIMEOUT_MS }) {
-  let context = null;
-  const claims = new Map();
-  const jobs = new Set();
-  const key = (b, a) => b + '/' + a;
-  const at = () => new Date(now()).toISOString();
-  const ctx = () => context ?? fail('github-not-configured');
-  const event = (business, body) => ctx().event(business, { ...body, method: 'github' });
-  const rows = (business) => ctx().store.all(
-    `SELECT seq,body FROM events WHERE business=? AND ${GRANT_EVIDENCE} AND (json_extract(body,'$.method')='github' OR json_extract(body,'$.operation')='grant.github') ORDER BY seq`, business,
-  ).map((r) => ({ seq: r.seq, ...JSON.parse(r.body) }));
-  const state = (business) => {
-    const entries = rows(business), grants = new Map(), intents = new Map(), closed = new Set(), revoked = new Map();
-    for (const e of entries) {
-      if (['grant.applied', 'grant.renewed'].includes(e.action)) grants.set(e.agent, e);
-      if (e.action === 'grant.revoked') { grants.delete(e.agent); revoked.set(e.agent, e.seq); }
-      if (e.action === 'grant.step' && e.step === 'mint') intents.set(e.generation, e);
-      if (e.action === 'grant.token.closed') closed.add(e.generation);
-    }
-    return { entries, grants, intents, closed, revoked };
-  };
-  const log = (business, grantDecision, agent = null, generation = null) => async (op, fn) => {
-    const callId = randomUUID();
-    event(business, { action: 'grant.call', grantDecision, agent, generation, callId, op });
-    let result;
-    try { result = await fn(); } catch { result = { status: 0, json: null }; }
-    // Deliberately never include the response body or authorization header.
-    event(business, { action: 'grant.result', grantDecision, agent, generation, callId, status: result.status });
-    return result;
-  };
-  const tracked = (fn) => {
-    const job = (async () => fn())(); jobs.add(job);
-    job.finally(() => jobs.delete(job)).catch(() => {});
-    return job;
-  };
-  const claim = (business, agent) => {
-    const k = key(business, agent);
-    if (claims.has(k)) fail('grant-busy');
-    const controller = new AbortController(); claims.set(k, controller);
-    return controller;
-  };
-  const release = (business, agent, controller) => {
-    if (claims.get(key(business, agent)) === controller) claims.delete(key(business, agent));
-  };
-  const generationDir = (business, agent, create = false) => githubDirectory(configDir, ['grants', business, 'github', 'tokens', agent], create);
-  const readToken = (business, intent) => {
-    const text = githubRead(generationDir(business, intent.agent), intent.generation);
-    if (text === null) return null;
-    if (!tokenText(text.trimEnd()) || text !== text.trimEnd() + '\n') fail('credential-format');
-    return text.trimEnd();
-  };
-  const roleSnapshot = (business, agent) => {
-    if (typeof agent !== 'string' || !ID_PATTERN.test(agent)) fail('invalid-request');
-    const b = ctx().business(business);
-    const role = Object.hasOwn(b.roles ?? {}, agent) ? b.roles[agent] : null;
-    const definition = role && Object.hasOwn(b.definitions ?? {}, role.definition) ? b.definitions[role.definition] : null;
-    if (!definition?.credentials?.some((c) => exact(c, ['service']) && c.service === 'github') ||
-      CREATIVE_DEFINITIONS.includes(role.definition) || !exact(role.github, ['projects']) ||
-      !Array.isArray(role.github.projects) || !role.github.projects.length || role.github.projects.some((p) => typeof p !== 'string' || !ID_PATTERN.test(p)) ||
-      new Set(role.github.projects).size !== role.github.projects.length) fail('github-not-declared');
-    const meta = api.adminMeta(business);
-    if (!meta) fail('grant-admin-missing');
-    if (meta.rotateBy <= at().slice(0, 10)) fail('grant-admin-rotation-due');
-    const origin = meta.url === 'https://api.github.com' ? 'https://github.com' : meta.url;
-    const repositories = role.github.projects.map((project) => {
-      const entry = b.projects?.[project];
-      if (!isId(entry?.githubId) || typeof entry.remote !== 'string' || entry.kind === 'library') fail('remote-not-granted');
-      let url;
-      try { url = new URL(entry.remote); } catch { fail('remote-not-granted'); }
-      if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password || url.search || url.hash ||
-        !/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(url.pathname) || entry.remote !== url.origin + url.pathname) fail('remote-host-mismatch');
-      const name = url.pathname.slice(1).replace(/\.git$/, '');
-      if (name.split('/').some((p) => p === '.' || p === '..' || p === '')) fail('remote-not-granted');
-      return { project, id: entry.githubId, name, remote: entry.remote };
-    });
-    if (new Set(repositories.map((r) => r.id)).size !== repositories.length) fail('remote-not-granted');
-    return { meta, repositories, configSha256: hash({ definition, github: role.github, repositories }) };
-  };
-  const binding = (business, grant) => {
-    if (!exact(grant, ['method', 'agent', 'rotateBy', 'target']) || grant.method !== 'github' ||
-      !exact(grant.target, ['projects']) || !Array.isArray(grant.target.projects) || grant.target.projects.length < 1 ||
-      grant.target.projects.length > 50 || grant.target.projects.some((p) => typeof p !== 'string' || !ID_PATTERN.test(p)) ||
-      new Set(grant.target.projects).size !== grant.target.projects.length || !day(grant.rotateBy) || grant.rotateBy <= at().slice(0, 10)) fail('invalid-request');
-    ctx().grantable(business, grant.agent);
-    const snap = roleSnapshot(business, grant.agent);
-    const repositories = grant.target.projects.map((project) => snap.repositories.find((r) => r.project === project) ?? fail('remote-not-granted'));
-    const body = { ...structuredClone(grant), repositories, configSha256: snap.configSha256,
-      adminSha256: hash(snap.meta), admin: identity(snap.meta), revocationSeq: state(business).revoked.get(grant.agent) ?? 0 };
-    return { body, block: `\n\nGrant ${grant.agent} GitHub App ${snap.meta.appId}, installation ${snap.meta.installationId}, account ${snap.meta.accountId}.` +
-      repositories.map((r) => `\nRepository ${r.project}: ${r.remote} (id ${r.id}).`).join('') +
-      `\nPermissions: contents:write, metadata:read. Protected renewal until ${grant.rotateBy}.` +
-      '\nNo workflow-file writes (.github/workflows/), account creation or fork creation. No GitHub publication consumer is installed by this grant.' };
-  };
-  const recheck = (business, g, epoch, controller) => {
-    if (controller.signal.aborted || g.revocationSeq !== epoch || (state(business).revoked.get(g.agent) ?? 0) !== epoch) fail('revoked');
-    if (g.rotateBy <= at().slice(0, 10)) fail('grant-expired');
-    if (ctx().working && !ctx().working()) fail('processing-halted');
-    ctx().grantable(business, g.agent);
-    const snap = roleSnapshot(business, g.agent);
-    if (snap.configSha256 !== g.configSha256 || hash(snap.meta) !== g.adminSha256 ||
-      !sameIds(g.repositories, snap.repositories.filter((r) => g.target.projects.includes(r.project)))) fail('decision-mismatch');
-  };
-  const closeToken = async (business, intent, by) => {
-    if (state(business).closed.has(intent.generation)) return true;
-    const done = (reason) => {
-      githubUnlink(generationDir(business, intent.agent), intent.generation);
-      event(business, { action: 'grant.token.closed', agent: intent.agent, generation: intent.generation, reason, by });
-      return true;
-    };
-    if (now() >= Date.parse(intent.until)) return done('expired');
-    const token = readToken(business, intent);
-    if (!token) return false; // Lost response: only bounded expiry can close it.
-    try {
-      const meta = api.adminMeta(business);
-      if (!meta || hash(identity(meta)) !== hash(intent.admin)) return false;
-      const audit = log(business, intent.grantDecision, intent.agent, intent.generation);
-      await api.checkAdmin(business, audit);
-      const result = await api.revoke(business, token, audit);
-      if (result.status === 204) return done('revoked');
-      // Do not interpret a 401/403 as proof of revocation, especially with clock drift.
-    } catch {}
-    return false;
-  };
-  const mint = async (business, decision, g, controller, epoch, initial) => {
-    recheck(business, g, epoch, controller);
-    const audit = log(business, decision, g.agent);
-    await api.checkAdmin(business, audit);
-    recheck(business, g, epoch, controller);
-    if (initial) ctx().consume(business, decision);
-    const generation = randomUUID(), started = now();
-    const intent = { action: 'grant.step', step: 'mint', agent: g.agent, grantDecision: decision, generation,
-      until: new Date(started + timeoutMs + TOKEN_LIFETIME_MS + CLOCK_SKEW_MS).toISOString(), admin: g.admin };
-    event(business, intent);
-    const callLog = log(business, decision, g.agent, generation);
-    let candidate;
-    try {
-      const response = await api.mint(business, g.repositories.map((r) => r.id), callLog);
-      if (response.status !== 201) {
-        // An answered rejection cannot have minted a token. An unanswered call can.
-        if ([401, 403, 404, 422].includes(response.status))
-          event(business, { action: 'grant.token.closed', agent: g.agent, generation, reason: 'not-issued' });
-        fail('github-failed');
-      }
-      const body = response.json;
-      if (tokenText(body?.token)) {
-        candidate = body.token;
-        githubWrite(generationDir(business, g.agent, true), generation, candidate + '\n');
-      }
-      recheck(business, g, epoch, controller);
-      const expires = typeof body?.expires_at === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/.test(body.expires_at) ? Date.parse(body.expires_at) : NaN;
-      if (!candidate || !object(body.permissions) || canonicalJson(body.permissions) !== canonicalJson(FIXED_PERMISSIONS) ||
-        body.repository_selection !== 'selected' || !sameIds(body.repositories, g.repositories) ||
-        !Number.isFinite(expires) || expires <= now() + TOKEN_MARGIN_MS || expires > started + TOKEN_LIFETIME_MS + CLOCK_SKEW_MS) fail('github-token-invalid');
-      const seen = [];
-      for (let page = 1; page <= 20; page++) {
-        const response = await api.repos(business, candidate, page, callLog);
-        recheck(business, g, epoch, controller);
-        if (response.status !== 200 || !object(response.json) || response.json.total_count !== g.repositories.length ||
-          !Array.isArray(response.json.repositories) || !response.json.repositories.length || response.json.repositories.length > PAGE_SIZE) fail('github-reach-unknown');
-        seen.push(...response.json.repositories);
-        if (seen.length >= response.json.total_count) break;
-        if (response.json.repositories.length < PAGE_SIZE) fail('github-reach-unknown');
-      }
-      if (!sameIds(seen, g.repositories) || seen.some((r) => !g.repositories.some((b) => b.id === r.id && b.name === r.full_name))) fail('github-reach-wider');
-      recheck(business, g, epoch, controller);
-      if (now() >= expires - TOKEN_MARGIN_MS) fail('github-token-invalid');
-      const old = state(business).grants.get(g.agent);
-      event(business, { action: initial ? 'grant.applied' : 'grant.renewed', agent: g.agent, grantDecision: decision,
-        generation, binding: g, expiresAt: new Date(expires).toISOString() });
-      if (old) {
-        const oldIntent = state(business).intents.get(old.generation);
-        if (oldIntent) await closeToken(business, oldIntent, 'replacement');
-      }
-      recheck(business, g, epoch, controller);
-      return { agent: g.agent, decision, generation, expiresAt: new Date(expires).toISOString() };
-    } catch (e) {
-      await closeToken(business, intent, 'failed');
-      event(business, { action: 'grant.failed', agent: g.agent, grantDecision: decision, generation, code: refusal(e) });
-      throw e instanceof BusError ? e : new BusError('github-failed');
-    }
-  };
-  const status = (business) => {
-    const s = state(business);
-    const active = new Set([...s.grants.values()].map((g) => g.generation));
-    return {
-      admin: api.adminMeta(business),
-      unclosedCalls: s.entries.filter((e) => e.action === 'grant.call' && !s.entries.some((r) => r.action === 'grant.result' && r.callId === e.callId))
-        .map((e) => ({ callId: e.callId, op: e.op, generation: e.generation })),
-      grants: [...s.grants.values()].map((g) => ({ agent: g.agent, decision: g.grantDecision,
-        generation: g.generation, repositoryIds: g.binding.repositories.map((r) => r.id), projects: g.binding.target.projects,
-        rotateBy: g.binding.rotateBy, expiresAt: g.expiresAt })),
-      serviceLeft: [...s.intents.values()].filter((i) => !active.has(i.generation) && !s.closed.has(i.generation))
-        .map((i) => ({ agent: i.agent, generation: i.generation, until: i.until })),
-      running: [...claims.keys()].filter((k) => k.startsWith(business + '/')).map((k) => ({ agent: k.slice(business.length + 1) })),
-    };
-  };
-  const manager = {
-    configure(c) { if (context) fail('github-already-configured'); context = c; },
-    raiseBinding: binding,
-    status,
-    decisionRevoked(business, g) { return g.revocationSeq !== (state(business).revoked.get(g.agent) ?? 0); },
-    pending(business, agent) {
-      const s = status(business);
-      return s.grants.some((g) => g.agent === agent) || s.serviceLeft.some((g) => g.agent === agent) || s.running.some((g) => g.agent === agent);
-    },
-    run(business, decision) { return tracked(async () => {
-      const g = ctx().approved(business, decision);
-      if (g?.method !== 'github') fail('not-authorized');
-      if (state(business).entries.some((e) => e.operation === 'grant.github' && e.decision === decision)) fail('decision-consumed');
-      const controller = claim(business, g.agent), epoch = state(business).revoked.get(g.agent) ?? 0;
-      try { return await mint(business, decision, g, controller, epoch, true); }
-      catch (e) {
-        // Preflight failures are unspent and retryable before restart, like row236.
-        if (!state(business).entries.some((e) => e.operation === 'grant.github' && e.decision === decision))
-          event(business, { action: 'grant.failed', agent: g.agent, grantDecision: decision, code: refusal(e), unspent: true });
-        throw e;
-      } finally { release(business, g.agent, controller); }
-    }); },
-    withToken(business, agent, fn) { return tracked(async () => {
-      const controller = claim(business, agent), epoch = state(business).revoked.get(agent) ?? 0;
-      try {
-        let g = state(business).grants.get(agent);
-        if (!g) fail('github-not-granted');
-        if (ctx().approved(business, g.grantDecision)?.method !== 'github') fail('not-authorized');
-        recheck(business, g.binding, epoch, controller);
-        if (now() >= Date.parse(g.expiresAt) - TOKEN_MARGIN_MS) {
-          await mint(business, g.grantDecision, g.binding, controller, epoch, false);
-          if (controller.signal.aborted) fail('revoked');
-          g = state(business).grants.get(agent);
-          if (!g) fail('revoked');
-        }
-        const intent = state(business).intents.get(g.generation);
-        const token = intent && readToken(business, intent);
-        if (!token) fail('credential-file');
-        recheck(business, g.binding, epoch, controller);
-        if (now() >= Date.parse(g.expiresAt) - TOKEN_MARGIN_MS) fail('github-token-expired');
-        const expiryTimer = setTimeout(() => controller.abort(), Math.max(0, Date.parse(g.expiresAt) - TOKEN_MARGIN_MS - now()));
-        try { return await fn(token, controller.signal); } finally { clearTimeout(expiryTimer); }
-      } finally { release(business, agent, controller); }
-    }); },
-    revoke(business, agent, reason, by) { return tracked(async () => {
-      if (typeof agent !== 'string' || !ID_PATTERN.test(agent) || typeof reason !== 'string' || !reason.length || reason.length > 500) fail('invalid-request');
-      claims.get(key(business, agent))?.abort();
-      event(business, { action: 'grant.revoked', agent, reason, by });
-      // The live claim owns cleanup of its in-flight candidate when it returns.
-      const s = state(business);
-      for (const intent of s.intents.values()) if (intent.agent === agent && !s.closed.has(intent.generation))
-        await closeToken(business, intent, by);
-      return { agent, serviceLeft: status(business).serviceLeft.filter((e) => e.agent === agent) };
-    }); },
-    sweep(business, by) { return tracked(async () => {
-      const s = state(business), active = new Set([...s.grants.values()].map((g) => g.generation));
-      for (const intent of s.intents.values())
-        if (!s.closed.has(intent.generation) && (!active.has(intent.generation) || now() >= Date.parse(intent.until)) && !claims.has(key(business, intent.agent))) await closeToken(business, intent, by);
-      event(business, { action: 'grant.swept', by, left: status(business).serviceLeft });
-      return status(business);
-    }); },
-    reconcile(business) {
-      // A generation with no applied/renewed record is never loaded or adopted.
-      const s = state(business);
-      for (const e of s.entries.filter((e) => e.operation === 'grant.github')) {
-        if (s.entries.some((r) => r.grantDecision === e.decision && ['grant.applied', 'grant.failed'].includes(r.action) && r.seq > e.seq)) continue;
-        const intent = [...s.intents.values()].findLast((i) => i.grantDecision === e.decision);
-        event(business, { action: 'grant.failed', grantDecision: e.decision, agent: intent?.agent ?? null, code: 'interrupted' });
-      }
-    },
-    async idle() { while (jobs.size) await Promise.allSettled([...jobs]); },
-    async close() { for (const c of claims.values()) c.abort(); await manager.idle(); },
-    api,
-    audit: log,
-  };
-  return manager;
-}

packages/bus/src/runtime.mjs

@@ -25,8 +25,6 @@ import { webService } from './web.mjs';
 import { hostExecutor, sweepRunDir } from './host-run.mjs';
 import { grantKeys, hostGrant, hostReference, sweepHostKeys } from './host-grant.mjs';
 import { giteaGrant, giteaKeys, giteaStart } from './gitea-grant.mjs';
-import { githubApi } from './github-api.mjs';
-import { githubGrant } from './github-grant.mjs';
 import { verifyPrincipal } from './principal.mjs';
 import { loadAccess } from '../../business/src/access.mjs';
 import { inspectInterpreter, recordInterpreterStart } from './interpreter.mjs';
@@ -124,7 +122,7 @@ export async function startBroker({
       || (Object.hasOwn(librarySync, 'intervalMs') && !(Number.isSafeInteger(librarySync.intervalMs) && librarySync.intervalMs > 0))
       || (Object.hasOwn(librarySync, 'configDir') && typeof librarySync.configDir !== 'string')))
     throw new BusError('invalid-host-request');
-  let store, credentials, server, adapter, processing, github = null, syncTimer = null, syncPass = null, accessTimer = null;
+  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null;
   try {
     const references = {};
     for (const [business, b] of Object.entries(businesses)) {
@@ -273,7 +271,6 @@ export async function startBroker({
         return false;
       }
     }
-    github = organization ? githubGrant({ api: githubApi({ configDir: organization.dir }), configDir: organization.dir }) : null;
     broker = new Broker({
       // FED R3: the access file is read per user request; a refusal leaves the user no grant.
       access: access ? () => loadAccess(access.file, access.context) : null,
@@ -299,7 +296,6 @@ export async function startBroker({
       // Row 236 (#1742): the Gitea grant path. The admin slot is <configDir>/secrets/grants/<business>/gitea.
       giteaGrant: organization ? giteaGrant({ configDir: organization.dir }) : null,
       giteaKeys: storeRoot ? giteaKeys({ credentials, storeRoot }) : null,
-      githubGrant: github,
       usage,
       limits,
       store,
@@ -463,7 +459,6 @@ export async function startBroker({
     broker.reconcileHosts();
     // Row 236 (#436b r5 section 5): the Gitea grants' remote undo, settle and open revokes, likewise.
     broker.reconcileGitea();
-    broker.reconcileGithub().catch(() => {});
     // S6 launcher operations. The host decides capacity and the instance list; the broker
     // authorizes role.launch and keeps the evidence, refusals included.
     // A refusal is recorded against the caller, as request() records one.
@@ -654,7 +649,6 @@ export async function startBroker({
         await stopSync();
         await server.close();
         await adapter?.close?.();
-        await github?.close();
         await processing?.close();
         store.close();
         credentials.close();
@@ -664,7 +658,6 @@ export async function startBroker({
     clearInterval(accessTimer);
     await server?.close();
     await adapter?.close?.();
-    await github?.close();
     await processing?.close();
     store?.close();
     credentials?.close();

packages/bus/tests/fake-github-api.mjs

@@ -1,70 +0,0 @@
-// Row297: fake GitHub over HTTPS, scratch CA only. No live credentials or provider calls.
-import { generateKeyPairSync, randomBytes, verify } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { createServer } from 'node:https';
-import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
-
-export async function fakeGithubApi(t, dir, { now = () => Date.now() } = {}) {
-  const tls = scratchCa(dir);
-  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
-  const key = privateKey.export({ type: 'pkcs8', format: 'pem' });
-  const tokens = new Map();
-  const requests = [];
-  const state = { appId: 10, installationId: 20, accountId: 30, suspended: false,
-    permissions: { contents: 'write', metadata: 'read' }, repositories: [{ id: 101, full_name: 'acme/app' }] };
-  let intercept = null;
-  const server = createServer({ key: tls.key, cert: tls.cert }, async (req, res) => {
-    const url = new URL(req.url, 'https://fake.test');
-    let body = '';
-    for await (const part of req) body += part;
-    let json;
-    try { json = body ? JSON.parse(body) : null; } catch { res.writeHead(400).end(); return; }
-    const auth = (req.headers.authorization ?? '').replace(/^Bearer /, '');
-    const bits = auth.split('.');
-    let jwt = null;
-    if (bits.length === 3) {
-      try {
-        if (verify('RSA-SHA256', Buffer.from(bits.slice(0, 2).join('.')), publicKey, Buffer.from(bits[2], 'base64url')))
-          jwt = JSON.parse(Buffer.from(bits[1], 'base64url'));
-      } catch {}
-    }
-    const token = tokens.get(auth);
-    const entry = { method: req.method, path: url.pathname, query: url.search, body: json,
-      jwt: jwt ? { ...jwt } : null, auth: jwt ? 'app' : token ? 'installation' : 'none' };
-    requests.push(entry);
-    const answer = (status, value) => {
-      res.writeHead(status, { 'content-type': 'application/json' });
-      res.end(value === undefined ? '' : JSON.stringify(value));
-    };
-    if (intercept && await intercept(entry, answer, { req, res, tokens })) return;
-    if (url.pathname === '/installation/token' && req.method === 'DELETE' && token) {
-      tokens.delete(auth); answer(204); return;
-    }
-    if (url.pathname === '/installation/repositories' && token && Date.parse(token.expires_at) > now()) {
-      const page = Number(url.searchParams.get('page') ?? 1);
-      const per = Number(url.searchParams.get('per_page') ?? 100);
-      answer(200, { total_count: token.repositories.length, repositories: token.repositories.slice((page - 1) * per, page * per) }); return;
-    }
-    const secs = Math.floor(now() / 1000);
-    if (!jwt || String(jwt.iss) !== String(state.appId) || jwt.iat > secs || jwt.exp <= secs || jwt.exp > secs + 600) {
-      answer(401, {}); return;
-    }
-    if (url.pathname === '/app') { answer(200, { id: state.appId }); return; }
-    if (url.pathname === `/app/installations/${state.installationId}` && req.method === 'GET') {
-      answer(200, { id: state.installationId, app_id: state.appId, account: { id: state.accountId },
-        suspended_at: state.suspended ? '2026-10-23T00:00:00Z' : null, permissions: state.permissions }); return;
-    }
-    if (url.pathname === `/app/installations/${state.installationId}/access_tokens` && req.method === 'POST') {
-      const value = 'ghs_fake_' + randomBytes(24).toString('hex');
-      const result = { token: value, expires_at: new Date(now() + 3600000).toISOString(),
-        permissions: json.permissions, repository_selection: 'selected',
-        repositories: state.repositories.filter((r) => json.repository_ids?.includes(r.id)) };
-      tokens.set(value, structuredClone(result)); answer(201, result); return;
-    }
-    answer(404, {});
-  });
-  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-  t.after(async () => { server.closeAllConnections(); await new Promise((resolve) => server.close(resolve)); });
-  return { url: `https://127.0.0.1:${server.address().port}`, ca: readFileSync(tls.ca, 'utf8'),
-    key, tokens, requests, state, intercept: (fn) => { intercept = fn; } };
-}

packages/bus/tests/github-api.test.mjs

@@ -1,113 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { generateKeyPairSync } from 'node:crypto';
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync, symlinkSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { githubApi, githubMeta, githubJwt, FIXED_PERMISSIONS } from '../src/github-api.mjs';
-import { fakeGithubApi } from './fake-github-api.mjs';
-
-const at = Date.parse('2026-10-23T12:00:00Z');
-const refuses = (fn, code) => assert.throws(fn, (e) => e.code === code);
-async function fixture(t) {
-  const dir = mkdtempSync(join(tmpdir(), 'github297-api-'));
-  t.after(() => rmSync(dir, { recursive: true, force: true }));
-  const fake = await fakeGithubApi(t, join(dir, 'tls'), { now: () => at });
-  const cfg = join(dir, 'config'); mkdirSync(cfg, { mode: 0o700 });
-  const api = githubApi({ configDir: cfg, ca: fake.ca, now: () => at });
-  const meta = { url: fake.url, appId: 10, installationId: 20, accountId: 30,
-    rotateBy: '2026-11-23', setAt: new Date(at).toISOString() };
-  const calls = [];
-  const log = async (op, fn) => { calls.push(['call', op]); const r = await fn(); calls.push(['result', r.status]); return r; };
-  return { fake, api, meta, cfg, calls, log };
-}
-
-test('R2 admin metadata refuses HTTP without a loopback exception', () => {
-  refuses(() => githubMeta({ url: 'http://127.0.0.1:1234', appId: 1, installationId: 2, accountId: 3,
-    rotateBy: '2026-11-23', setAt: new Date(at).toISOString() }), 'invalid-request');
-});
-
-test('R4 JWT uses the controlled clock, RS256, 60s backdate and bounded expiry', () => {
-  const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
-  const encoded = githubJwt(privateKey, 10, at);
-  const [header, body] = encoded.split('.').slice(0, 2).map((s) => JSON.parse(Buffer.from(s, 'base64url')));
-  assert.equal(header.alg, 'RS256');
-  assert.equal(body.iat, at / 1000 - 60);
-  assert.equal(body.exp, at / 1000 + 540);
-  assert.equal(body.iss, '10');
-});
-
-test('admin set checks the fake HTTPS identity and stores private files only after checks', async (t) => {
-  const f = await fixture(t);
-  await f.api.setAdmin('demo', f.meta, f.fake.key, f.log);
-  assert.deepEqual(f.api.adminMeta('demo'), f.meta);
-  assert.equal(statSync(join(f.cfg, 'secrets/grants/demo/github/admin')).mode & 0o777, 0o600);
-  assert.equal(f.calls.length, 4);
-  assert.deepEqual(f.fake.requests.map((r) => r.path), ['/app', '/app/installations/20']);
-  assert.equal(JSON.stringify(f.calls).includes('PRIVATE KEY'), false);
-});
-
-for (const [name, mutate, code] of [
-  ['App identity', (f) => { f.meta.appId = 11; }, 'grant-admin-account'],
-  ['installation account identity', (f) => { f.meta.accountId = 31; }, 'grant-admin-account'],
-  ['suspended installation', (f) => { f.fake.state.suspended = true; }, 'grant-admin-account'],
-  ['permission floor', (f) => { f.fake.state.permissions.contents = 'read'; }, 'grant-admin-scope'],
-]) test(`C1-C4 replacement: admin set refuses ${name} and writes no slot`, async (t) => {
-  const f = await fixture(t); mutate(f);
-  await assert.rejects(f.api.setAdmin('demo', f.meta, f.fake.key, f.log), (e) => e.code === code);
-  assert.equal(existsSync(join(f.cfg, 'secrets/grants/demo/github/admin')), false);
-});
-
-test('admin set refuses a non-RSA key without making an API call', async (t) => {
-  const f = await fixture(t);
-  const { privateKey } = generateKeyPairSync('ed25519');
-  await assert.rejects(f.api.setAdmin('demo', f.meta, privateKey.export({ type: 'pkcs8', format: 'pem' }), f.log), (e) => e.code === 'credential-format');
-  assert.equal(f.fake.requests.length, 0);
-});
-
-test('admin set refuses HTTP before any call, and refuses to overwrite a slot', async (t) => {
-  const f = await fixture(t);
-  await assert.rejects(f.api.setAdmin('demo', { ...f.meta, url: f.fake.url.replace('https:', 'http:') }, f.fake.key, f.log), (e) => e.code === 'invalid-request');
-  assert.equal(f.fake.requests.length, 0);
-  await f.api.setAdmin('demo', f.meta, f.fake.key, f.log);
-  await assert.rejects(f.api.setAdmin('demo', f.meta, f.fake.key, f.log), (e) => e.code === 'grant-admin-exists');
-});
-
-test('mint sends fixed permissions and explicit repository IDs using an App JWT', async (t) => {
-  const f = await fixture(t);
-  await f.api.setAdmin('demo', f.meta, f.fake.key, f.log);
-  const r = await f.api.mint('demo', [101], f.log);
-  assert.equal(r.status, 201);
-  const req = f.fake.requests.at(-1);
-  assert.deepEqual(req.body, { repository_ids: [101], permissions: FIXED_PERMISSIONS });
-  assert.equal(req.auth, 'app');
-  assert.equal(f.fake.requests.every((x) => !JSON.stringify(x).includes('PRIVATE KEY')), true);
-});
-
-test('C2 validates the App response ID even with a successful JWT authentication', async (t) => {
-  const f = await fixture(t);
-  f.fake.intercept(async (r, answer) => {
-    if (r.path === '/app') { answer(200, { id: 11 }); return true; }
-    return false;
-  });
-  await assert.rejects(f.api.setAdmin('demo', f.meta, f.fake.key, f.log), (e) => e.code === 'grant-admin-account');
-});
-
-test('admin slot refuses unsafe file modes and symbolic links', async (t) => {
-  const f = await fixture(t); await f.api.setAdmin('demo', f.meta, f.fake.key, f.log);
-  const metaFile = join(f.cfg, 'secrets/grants/demo/github/admin.json');
-  chmodSync(metaFile, 0o644);
-  assert.throws(() => f.api.adminMeta('demo'), (e) => e.code === 'credential-file');
-  chmodSync(metaFile, 0o600);
-  const keyFile = join(f.cfg, 'secrets/grants/demo/github/admin');
-  rmSync(keyFile); symlinkSync(metaFile, keyFile);
-  await assert.rejects(f.api.checkAdmin('demo', f.log), (e) => e.code === 'credential-file');
-});
-
-for (const method of ['repos', 'revoke']) test(`N2 ${method} refuses a missing installation token before any call`, async (t) => {
-  const f = await fixture(t); await f.api.setAdmin('demo', f.meta, f.fake.key, f.log);
-  const before = f.fake.requests.length;
-  const run = () => method === 'repos' ? f.api.repos('demo', undefined, 1, f.log) : f.api.revoke('demo', undefined, f.log);
-  await assert.rejects(Promise.resolve().then(run), (e) => e.code === 'credential-format');
-  assert.equal(f.fake.requests.length, before);
-});

packages/bus/tests/github-broker.test.mjs

@@ -1,158 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Broker, GRANT_EVIDENCE } from '../src/broker.mjs';
-import { Store } from '../src/store.mjs';
-import { githubApi } from '../src/github-api.mjs';
-import { githubGrant } from '../src/github-grant.mjs';
-import { fakeGithubApi } from './fake-github-api.mjs';
-
-async function fixture(t) {
-  const dir = mkdtempSync(join(tmpdir(), 'github297-broker-'));
-  t.after(() => rmSync(dir, { recursive: true, force: true }));
-  const fake = await fakeGithubApi(t, join(dir, 'tls'));
-  const configDir = join(dir, 'cfg'); mkdirSync(configDir, { mode: 0o700 });
-  mkdirSync(join(dir, 'data'), { mode: 0o700 });
-  const store = new Store(join(dir, 'data')); t.after(() => store.close());
-  const api = githubApi({ configDir, ca: fake.ca });
-  const manager = githubGrant({ api, configDir });
-  const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
-  const business = { id: 'demo', human: 'jason', arbiters: { technical: 'pm', delivery: 'pm' },
-    roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send', 'role.fire'], crossRole: [] } }, pm: { definition: 'pm', ...none },
-      coder: { definition: 'coder', github: { projects: ['app'] }, ...none } },
-    definitions: { 'chief-of-staff': { roleVersion: 2, credentials: [] }, pm: { roleVersion: 2, credentials: [] },
-      coder: { roleVersion: 2, credentials: [{ service: 'github' }] } },
-    projects: { app: { remote: fake.url + '/acme/app', githubId: 101 } }, launch: { by: 'chief', instances: ['pm', 'coder'] }, vars: { 'bus.tester': true } };
-  const writes = [];
-  let broker;
-  const organization = (id, op, args) => {
-    writes.push(op);
-    if (op === 'instance.fire') business.launch.instances = business.launch.instances.filter((n) => n !== args.name);
-    if (op === 'instances.set' && args.op === 'delete') {
-      delete business.roles[args.instance];
-      business.launch.instances = business.launch.instances.filter((n) => n !== args.instance);
-    }
-    broker.reloadBusiness('demo', business);
-    return { revision: 'b'.repeat(64), transaction: 'fake-transaction' };
-  };
-  broker = new Broker({ store, businesses: { demo: business }, githubGrant: manager, organization });
-  const caps = { human: broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
-    tester: broker.bindTester({ business: 'demo' }) };
-  for (const role of ['chief', 'pm']) {
-    caps[role] = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
-    await broker.request(caps[role], { verb: 'role.claim' });
-  }
-  const call = (who, verb, args) => broker.request(caps[who], { verb, args });
-  const admin = { service: 'github', url: fake.url, appId: 10, installationId: 20, accountId: 30,
-    rotateBy: '2099-01-01', token: fake.key };
-  await call('human', 'grants.admin.set', admin);
-  const raise = () => call('chief', 'decision.raise', { action: 'credential.mint', question: 'Grant GitHub?',
-    options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false,
-    grant: { method: 'github', agent: 'coder', target: { projects: ['app'] }, rotateBy: '2098-01-01' } });
-  const idle = async () => { await new Promise((resolve) => setImmediate(resolve)); await broker.grantsIdle(); };
-  const events = () => store.all(`SELECT body FROM events WHERE business='demo' AND ${GRANT_EVIDENCE} ORDER BY seq`).map((e) => JSON.parse(e.body));
-  return { fake, store, broker, manager, business, call, raise, idle, events, admin, writes };
-}
-
-test('chief raise and human Approve start GitHub without a Gitea admin or host executor', async (t) => {
-  const f = await fixture(t);
-  const d = await f.raise();
-  assert.equal(f.fake.tokens.size, 0);
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  const status = await f.call('chief', 'grants.status', { service: 'github' });
-  assert.equal(status.grants.length, 1);
-  assert.equal(status.grants[0].decision, d.id);
-  await f.call('human', 'grants.revoke', { service: 'github', agent: 'coder', reason: 'test' });
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal((await f.call('human', 'grants.status', { service: 'github' })).grants.length, 0);
-});
-
-test('GitHub admin and manual run are human-only; arbitrary agents cannot raise', async (t) => {
-  const f = await fixture(t);
-  for (const who of ['chief', 'tester']) {
-    await assert.rejects(Promise.resolve().then(() => f.call(who, 'grants.admin.remove', { service: 'github' })), (e) => e.code === 'human-required');
-    await assert.rejects(Promise.resolve().then(() => f.call(who, 'grants.run', { decision: 'unapproved' })), (e) => e.code === 'human-required');
-  }
-  await assert.rejects(Promise.resolve().then(() => f.call('pm', 'decision.raise', { action: 'credential.mint',
-    question: 'no', options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false,
-    grant: { method: 'github', agent: 'coder', target: { projects: ['app'] }, rotateBy: '2098-01-01' } })), (e) => e.code === 'grant-chief-only');
-});
-
-test('changing repository config after raise refuses before consume, then restart spends interrupted', async (t) => {
-  const f = await fixture(t); const d = await f.raise();
-  f.business.projects.app.githubId = 102; f.broker.reloadBusiness('demo', f.business);
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(f.events().some((e) => e.operation === 'grant.github'), false);
-  f.broker.reconcileGrants();
-  assert.equal(f.events().filter((e) => e.operation === 'grant.github' && e.decision === d.id).length, 1);
-});
-
-test('no socket verb exposes a token or protected renewal', async (t) => {
-  const f = await fixture(t);
-  for (const verb of ['grants.token', 'grants.renew', 'github.token'])
-    await assert.rejects(Promise.resolve().then(() => f.call('human', verb, { agent: 'coder' })), (e) => e.code === 'unknown-verb');
-});
-
-test('an open approval revoked before Yes cannot be used by the late automatic executor', async (t) => {
-  const f = await fixture(t); const d = await f.raise();
-  await f.call('human', 'grants.revoke', { service: 'github', agent: 'coder', reason: 'cancel' });
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(f.manager.status('demo').grants.length, 0);
-});
-
-test('grant evidence remains reserved from an agent or direct human record insert', async (t) => {
-  const f = await fixture(t);
-  assert.throws(() => f.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES('forged','2026-10-23T00:00:00Z','demo','action.allowed',NULL,NULL,NULL,?)",
-    JSON.stringify({ action: 'grant.applied', method: 'github', agent: 'coder' })));
-  assert.equal(f.manager.status('demo').grants.length, 0);
-});
-
-for (const failDelete of [false, true]) test(`fire revokes GitHub locally and ${failDelete ? 'stops on remote leftovers' : 'completes only after remote cleanup'}`, async (t) => {
-  const f = await fixture(t); const d = await f.raise();
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  if (failDelete) f.fake.intercept(async (r, answer) => { if (r.method === 'DELETE') { answer(503, {}); return true; } return false; });
-  await f.call('chief', 'instance.fire', { name: 'coder', reason: 'test' }); await f.idle();
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  assert.equal(f.writes.includes('instance.fire'), !failDelete);
-  assert.equal(f.manager.status('demo').serviceLeft.length, failDelete ? 1 : 0);
-});
-
-test('lifecycle delete waits for the protected GitHub revoke job', async (t) => {
-  const f = await fixture(t); const d = await f.raise();
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  const { request } = await f.call('human', 'instances.set', { revision: 'b'.repeat(64), instance: 'coder', op: 'delete' });
-  assert.equal(f.broker.lifecycleTake({ business: 'demo', request }).go, true);
-  assert.throws(() => f.broker.lifecycleDelete({ business: 'demo', request }), (e) => e.code === 'grants-revoking');
-  f.broker.lifecycleDone({ business: 'demo', request, refusal: 'grants-revoking' });
-  await f.idle();
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(Object.hasOwn(f.business.roles, 'coder'), true);
-  const second = await f.call('human', 'instances.set', { revision: 'b'.repeat(64), instance: 'coder', op: 'delete' });
-  assert.equal(f.broker.lifecycleTake({ business: 'demo', request: second.request }).go, true);
-  const removed = f.broker.lifecycleDelete({ business: 'demo', request: second.request });
-  assert.equal(removed.retry, false);
-  assert.equal(removed.transaction, 'fake-transaction');
-  assert.equal(Object.hasOwn(f.business.roles, 'coder'), false);
-  assert.equal(f.writes.filter((op) => op === 'instances.set').length, 1);
-});
-
-test('admin rotate preserves installation identity and invalidates open approved bindings', async (t) => {
-  const f = await fixture(t); const d = await f.raise();
-  await f.call('human', 'grants.admin.rotate', { service: 'github', rotateBy: '2099-02-01', token: f.fake.key });
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }); await f.idle();
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(f.manager.status('demo').admin.installationId, 20);
-  assert.equal(f.manager.status('demo').grants.length, 0);
-});
-
-for (const args of [{}, { decision: null }, { decision: 'bad/id' }, { decision: 'valid', extra: true }])
-  test('N7 manual run validates shape and identifier before approval lookup: ' + JSON.stringify(args), async (t) => {
-    const f = await fixture(t);
-    await assert.rejects(Promise.resolve().then(() => f.call('human', 'grants.run', args)), (e) => e.code === 'invalid-request');
-    assert.equal(f.fake.tokens.size, 0);
-  });

packages/bus/tests/github-grant.test.mjs

@@ -1,412 +0,0 @@
-// Row297 contract tests. Run only under Sage CLEAR; fake HTTPS API, no live token.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { Store } from '../src/store.mjs';
-import { GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
-import { githubApi, FIXED_PERMISSIONS } from '../src/github-api.mjs';
-import { githubGrant, TOKEN_LIFETIME_MS, CLOCK_SKEW_MS, TOKEN_MARGIN_MS, CALL_TIMEOUT_MS } from '../src/github-grant.mjs';
-import { fakeGithubApi } from './fake-github-api.mjs';
-import { githubDirectory, githubWrite } from '../src/github-files.mjs';
-
-const START = Date.parse('2026-10-23T12:00:00Z');
-const rejectCode = (p, code) => assert.rejects(p, (e) => e.code === code);
-async function fixture(t, options = {}) {
-  const dir = mkdtempSync(join(tmpdir(), 'github297-grant-'));
-  t.after(() => rmSync(dir, { recursive: true, force: true }));
-  let time = START;
-  const now = () => time;
-  const fake = await fakeGithubApi(t, join(dir, 'tls'), { now });
-  const configDir = join(dir, 'config'); mkdirSync(configDir, { mode: 0o700 });
-  mkdirSync(join(dir, 'data'), { mode: 0o700 });
-  const store = new Store(join(dir, 'data'));
-  t.after(() => store.close());
-  const business = { id: 'demo', roles: { coder: { definition: 'coder', github: { projects: ['app'] } } },
-    definitions: { coder: { roleVersion: 2, credentials: [{ service: 'github' }] } },
-    projects: { app: { remote: fake.url + '/acme/app', githubId: 101 } } };
-  const approved = new Map();
-  const event = (id, body) => store.transaction(() => writeGrantEvent(store, new Date(now()).toISOString(), id, body, body.agent ?? null));
-  const api = githubApi({ configDir, ca: fake.ca, now, timeoutMs: options.timeoutMs ?? CALL_TIMEOUT_MS });
-  const meta = { url: fake.url, appId: 10, installationId: 20, accountId: 30,
-    rotateBy: '2026-11-23', setAt: new Date(now()).toISOString() };
-  const log = async (op, fn) => fn(); // Initial admin fixture; executor calls use reserved event writer.
-  await api.setAdmin('demo', meta, fake.key, log);
-  const spent = new Set();
-  let working = true;
-  const create = () => {
-    const manager = githubGrant({ api, configDir, now, timeoutMs: options.timeoutMs ?? CALL_TIMEOUT_MS });
-    manager.configure({ store, business: () => business, event,
-      approved: (id, decision) => approved.get(decision) ?? null,
-      consume: (id, decision) => {
-        if (spent.has(decision)) throw Object.assign(new Error('decision-consumed'), { code: 'decision-consumed' });
-        spent.add(decision); event(id, { operation: 'grant.github', decision }); return approved.get(decision);
-      }, grantable: () => {}, working: () => working });
-    return manager;
-  };
-  const manager = create();
-  const grant = { method: 'github', agent: 'coder', target: { projects: ['app'] }, rotateBy: '2026-11-20' };
-  const raise = () => {
-    const decision = randomUUID();
-    approved.set(decision, manager.raiseBinding('demo', grant).body);
-    return decision;
-  };
-  const events = () => store.all(`SELECT body FROM events WHERE business='demo' AND ${GRANT_EVIDENCE} ORDER BY seq`).map((r) => JSON.parse(r.body));
-  const apply = async () => { const decision = raise(); await manager.run('demo', decision); return decision; };
-  return { dir, configDir, store, business, fake, api, manager, meta, grant, now, raise, apply,
-    events, approved, spent, create, advance: (ms) => { time += ms; }, working: (v) => { working = v; } };
-}
-
-test('R4 lifetime, skew, margin and request bounds are explicit constants', () => {
-  assert.equal(TOKEN_LIFETIME_MS, 3600000);
-  assert.equal(CLOCK_SKEW_MS, 60000);
-  assert.equal(TOKEN_MARGIN_MS, 60000);
-  assert.equal(CALL_TIMEOUT_MS, 15000);
-});
-
-test('grant binding cannot name scopes, accounts or fork creation', async (t) => {
-  const f = await fixture(t);
-  for (const extra of [{ scopes: ['all'] }, { account: 'foreign' }, { fork: true }])
-    assert.throws(() => f.manager.raiseBinding('demo', { ...f.grant, ...extra }), (e) => e.code === 'invalid-request');
-  assert.equal(f.events().length, 0);
-});
-
-test('initial approval creates an exact durable grant and guarded token use', async (t) => {
-  const f = await fixture(t);
-  const decision = await f.apply();
-  const [g] = f.manager.status('demo').grants;
-  assert.equal(g.agent, 'coder');
-  assert.equal(g.decision, decision);
-  assert.deepEqual(g.repositoryIds, [101]);
-  assert.equal(g.expiresAt, new Date(START + TOKEN_LIFETIME_MS).toISOString());
-  let used = false;
-  await f.manager.withToken('demo', 'coder', async (token, signal) => {
-    used = f.fake.tokens.has(token); assert.equal(signal.aborted, false);
-  });
-  assert.ok(used);
-  const events = f.events();
-  const calls = events.filter((e) => e.action === 'grant.call');
-  assert.ok(calls.length >= 4);
-  for (const call of calls) {
-    const result = events.find((e) => e.action === 'grant.result' && e.callId === call.callId);
-    assert.ok(result);
-    assert.ok(events.indexOf(result) > events.indexOf(call));
-  }
-  assert.equal(events.filter((e) => Object.hasOwn(e, 'decision')).length, 1);
-  const text = JSON.stringify(events);
-  for (const token of f.fake.tokens.keys()) assert.ok(!text.includes(token));
-  assert.ok(!text.includes('PRIVATE KEY'));
-  assert.ok(!text.includes('Bearer'));
-});
-
-for (const [label, mutation] of [
-  ['extra permission', (b) => { b.permissions.workflows = 'write'; }],
-  ['higher metadata level', (b) => { b.permissions.metadata = 'write'; }],
-  ['missing permission', (b) => { delete b.permissions.metadata; }],
-  ['all repositories', (b) => { b.repository_selection = 'all'; }],
-  ['extra repository', (b) => { b.repositories.push({ id: 102, full_name: 'acme/other' }); }],
-  ['missing repository', (b) => { b.repositories = []; }],
-  ['duplicate repository', (b) => { b.repositories.push({ ...b.repositories[0] }); }],
-  ['past expiry', (b) => { b.expires_at = new Date(START).toISOString(); }],
-  ['missing expiry', (b) => { delete b.expires_at; }],
-  ['excessive lifetime', (b) => { b.expires_at = new Date(START + TOKEN_LIFETIME_MS + CLOCK_SKEW_MS + 1).toISOString(); }],
-]) test(`R1/R4 mint refuses ${label} before any guarded use and revokes candidate`, async (t) => {
-  const f = await fixture(t);
-  let repoReads = 0;
-  f.fake.intercept(async (r, answer, { tokens }) => {
-    if (r.path === '/installation/repositories') repoReads++;
-    if (r.method !== 'POST') return false;
-    const token = 'ghs_fake_candidate_12345678901234567890';
-    const body = { token, expires_at: new Date(START + TOKEN_LIFETIME_MS).toISOString(),
-      permissions: { ...FIXED_PERMISSIONS }, repository_selection: 'selected', repositories: [{ id: 101, full_name: 'acme/app' }] };
-    tokens.set(token, structuredClone(body)); mutation(body); answer(201, body); return true;
-  });
-  await rejectCode(f.apply(), 'github-token-invalid');
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  assert.equal(repoReads, 0);
-  assert.equal(f.fake.tokens.size, 0);
-});
-
-test('R4 renewal starts at the safety margin and uses a new token under the same decision', async (t) => {
-  const f = await fixture(t); const decision = await f.apply();
-  const old = [...f.fake.tokens.keys()][0];
-  f.advance(TOKEN_LIFETIME_MS - TOKEN_MARGIN_MS - 1);
-  await f.manager.withToken('demo', 'coder', () => {});
-  assert.equal(f.fake.tokens.size, 1);
-  f.advance(1);
-  await f.manager.withToken('demo', 'coder', (token) => { assert.ok(token !== old); });
-  assert.equal(f.fake.tokens.has(old), false);
-  assert.equal(f.manager.status('demo').grants[0].decision, decision);
-  assert.equal(f.events().filter((e) => e.operation === 'grant.github').length, 1);
-});
-
-for (const [label, change] of [
-  ['project repository ID', (b) => { b.projects.app.githubId = 102; }],
-  ['project remote', (b) => { b.projects.app.remote += '-changed'; }],
-  ['allowed projects', (b) => { b.roles.coder.github.projects.push('other'); }],
-  ['definition', (b) => { b.definitions.coder.title = 'changed'; }],
-]) test(`R5 config change to ${label} refuses renewal and never uses old token`, async (t) => {
-  const f = await fixture(t); await f.apply();
-  change(f.business); f.advance(TOKEN_LIFETIME_MS);
-  let used = false;
-  await rejectCode(f.manager.withToken('demo', 'coder', () => { used = true; }), 'decision-mismatch');
-  assert.equal(used, false);
-});
-
-test('renewal refuses after the durable grant deadline or processing halt', async (t) => {
-  const f = await fixture(t); await f.apply();
-  f.working(false);
-  await rejectCode(f.manager.withToken('demo', 'coder', () => {}), 'processing-halted');
-  f.working(true); f.advance(40 * 86400000);
-  await rejectCode(f.manager.withToken('demo', 'coder', () => {}), 'grant-expired');
-});
-
-test('local revoke wins a pending renewal; candidate is revoked and grant never revives', async (t) => {
-  const f = await fixture(t); await f.apply(); f.advance(TOKEN_LIFETIME_MS);
-  let release, entered;
-  const held = new Promise((resolve) => { entered = resolve; });
-  const gate = new Promise((resolve) => { release = resolve; });
-  f.fake.intercept(async (r) => {
-    if (r.method === 'POST') { entered(); await gate; }
-    return false;
-  });
-  const pending = f.manager.withToken('demo', 'coder', () => assert.fail('late token used'));
-  // Attach the rejection handler before releasing the network call.
-  const refused = rejectCode(pending, 'revoked');
-  await held;
-  await f.manager.revoke('demo', 'coder', 'test', 'jason');
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  release(); await refused;
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  assert.equal(f.fake.tokens.size, 0);
-});
-
-test('revoke blocks guarded use before a remote delete completes; failure is serviceLeft', async (t) => {
-  const f = await fixture(t); await f.apply();
-  let localGone = false;
-  f.fake.intercept(async (r, answer) => {
-    if (r.method === 'DELETE') { localGone = f.manager.status('demo').grants.length === 0; answer(503, {}); return true; }
-    return false;
-  });
-  await f.manager.revoke('demo', 'coder', 'test', 'jason');
-  assert.ok(localGone);
-  await rejectCode(f.manager.withToken('demo', 'coder', () => assert.fail('revoked token used')), 'github-not-granted');
-  assert.equal(f.manager.status('demo').serviceLeft.length, 1);
-  f.fake.intercept(null); await f.manager.sweep('demo', 'jason');
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(f.manager.status('demo').serviceLeft.length, 0);
-});
-
-test('lost mint response stays visible through restart until conservative expiry equality', async (t) => {
-  const f = await fixture(t);
-  f.fake.intercept(async (r, answer, { req }) => {
-    if (r.method === 'POST') { req.socket.destroy(); return true; }
-    return false;
-  });
-  await rejectCode(f.apply(), 'github-failed');
-  const status = f.manager.status('demo');
-  assert.equal(status.serviceLeft.length, 1);
-  const until = Date.parse(status.serviceLeft[0].until);
-  assert.equal(until, START + CALL_TIMEOUT_MS + TOKEN_LIFETIME_MS + CLOCK_SKEW_MS);
-  const restarted = f.create(); restarted.reconcile('demo');
-  f.advance(until - f.now() - 1); await restarted.sweep('demo', 'jason');
-  assert.equal(restarted.status('demo').serviceLeft.length, 1);
-  f.advance(1); await restarted.sweep('demo', 'jason');
-  assert.equal(restarted.status('demo').serviceLeft.length, 0);
-});
-
-// Kills removal of the approval/revocation boundary check.
-test('a revoke invalidates an older unspent approval, even when no token was issued', async (t) => {
-  const f = await fixture(t); const decision = f.raise();
-  await f.manager.revoke('demo', 'coder', 'cancel approval', 'jason');
-  await rejectCode(f.manager.run('demo', decision), 'revoked');
-  assert.equal(f.spent.has(decision), false);
-  assert.equal(f.fake.tokens.size, 0);
-});
-
-test('verification reads every page and binds repository IDs to their configured names', async (t) => {
-  const f = await fixture(t);
-  const projects = [];
-  f.fake.state.repositories = [];
-  for (let i = 0; i < 31; i++) {
-    const p = 'repo' + i; projects.push(p);
-    f.business.projects[p] = { githubId: 1000 + i, remote: f.fake.url + '/acme/' + p };
-    f.fake.state.repositories.push({ id: 1000 + i, full_name: 'acme/' + p });
-  }
-  f.business.roles.coder.github.projects = projects;
-  f.grant.target.projects = projects;
-  await f.apply();
-  assert.deepEqual(f.fake.requests.filter((r) => r.path === '/installation/repositories').map((r) => r.query),
-    ['?per_page=30&page=1', '?per_page=30&page=2']);
-  assert.equal(f.manager.status('demo').grants[0].repositoryIds.length, 31);
-});
-
-test('verification refuses wider reach and deletes the candidate', async (t) => {
-  const f = await fixture(t);
-  f.fake.intercept(async (r, answer) => {
-    if (r.path !== '/installation/repositories') return false;
-    answer(200, { total_count: 2, repositories: [{ id: 101, full_name: 'acme/app' }, { id: 102, full_name: 'acme/foreign' }] });
-    return true;
-  });
-  await rejectCode(f.apply(), 'github-reach-unknown');
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(f.manager.status('demo').grants.length, 0);
-});
-
-test('token replacement is usable before old-token delete and not after grant revocation', async (t) => {
-  const f = await fixture(t); await f.apply();
-  const oldGeneration = f.manager.status('demo').grants[0].generation;
-  f.fake.intercept(async (r) => {
-    if (r.method === 'DELETE') {
-      const active = f.manager.status('demo').grants[0];
-      assert.ok(active.generation !== oldGeneration);
-      assert.equal(f.fake.tokens.size, 2);
-    }
-    return false;
-  });
-  f.advance(TOKEN_LIFETIME_MS - TOKEN_MARGIN_MS);
-  await f.manager.withToken('demo', 'coder', () => {});
-  assert.equal(f.fake.tokens.size, 1);
-});
-
-test('failed renewal never calls the consumer with the previous token', async (t) => {
-  const f = await fixture(t); await f.apply();
-  f.advance(TOKEN_LIFETIME_MS - TOKEN_MARGIN_MS);
-  f.fake.intercept(async (r, answer) => {
-    if (r.method === 'POST') { answer(503, {}); return true; }
-    return false;
-  });
-  let called = false;
-  await rejectCode(f.manager.withToken('demo', 'coder', () => { called = true; }), 'github-failed');
-  assert.equal(called, false);
-});
-
-test('admin metadata replacement invalidates an approved durable binding', async (t) => {
-  const f = await fixture(t); await f.apply();
-  await f.api.setAdmin('demo', { ...f.meta, setAt: new Date(START + 1).toISOString() }, f.fake.key, async (op, fn) => fn(), { replace: true });
-  f.advance(TOKEN_LIFETIME_MS);
-  await rejectCode(f.manager.withToken('demo', 'coder', () => {}), 'decision-mismatch');
-});
-
-test('preflight identity or permission failure is unspent and a retry can run before restart', async (t) => {
-  const f = await fixture(t); const decision = f.raise();
-  f.fake.state.permissions.contents = 'read';
-  await rejectCode(f.manager.run('demo', decision), 'grant-admin-scope');
-  assert.equal(f.spent.has(decision), false);
-  f.fake.state.permissions.contents = 'write';
-  await f.manager.run('demo', decision);
-  assert.equal(f.spent.has(decision), true);
-});
-
-test('an active generation restarts only under its recorded durable approval and timestamp', async (t) => {
-  const f = await fixture(t); await f.apply();
-  const restarted = f.create(); restarted.reconcile('demo');
-  await restarted.withToken('demo', 'coder', (token) => { assert.ok(f.fake.tokens.has(token)); });
-  f.advance(TOKEN_LIFETIME_MS);
-  f.business.projects.app.githubId = 102;
-  await rejectCode(restarted.withToken('demo', 'coder', () => {}), 'decision-mismatch');
-});
-
-test('look-alike applied evidence under another kind cannot make a live grant', async (t) => {
-  const f = await fixture(t); const decision = f.raise();
-  f.store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'action.refused',NULL,'grant',NULL,?)",
-    randomUUID(), new Date(START).toISOString(), 'demo', JSON.stringify({ action: 'grant.applied', method: 'github',
-      agent: 'coder', grantDecision: decision, generation: randomUUID(), binding: f.approved.get(decision), expiresAt: new Date(START + TOKEN_LIFETIME_MS).toISOString() }));
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  await rejectCode(f.manager.withToken('demo', 'coder', () => {}), 'github-not-granted');
-});
-
-test('mint intent and grant.call are durable before the fake sees each request', async (t) => {
-  const f = await fixture(t); const observed = [];
-  f.fake.intercept(async (r) => {
-    const events = f.events();
-    const call = events.findLast((e) => e.action === 'grant.call' && e.method === 'github' && e.op.method === r.method && e.op.path === r.path + r.query);
-    observed.push(Boolean(call && !events.some((e) => e.action === 'grant.result' && e.callId === call.callId)));
-    if (r.method === 'POST') observed.push(events.some((e) => e.action === 'grant.step' && e.step === 'mint'));
-    return false;
-  });
-  await f.apply();
-  assert.ok(observed.length >= 5);
-  assert.ok(observed.every(Boolean));
-});
-
-test('an interrupted service call without its result stays visible after restart', async (t) => {
-  const f = await fixture(t); const callId = randomUUID();
-  writeGrantEvent(f.store, new Date(START).toISOString(), 'demo', { action: 'grant.call', method: 'github', callId,
-    grantDecision: null, agent: null, generation: null, op: { method: 'GET', path: '/app' } });
-  const restarted = f.create(); restarted.reconcile('demo');
-  assert.deepEqual(restarted.status('demo').unclosedCalls.map((e) => e.callId), [callId]);
-});
-
-test('restart never adopts a known token from an interrupted mint and sweep revokes it', async (t) => {
-  const f = await fixture(t); const decision = f.raise(), generation = randomUUID();
-  const result = await f.api.mint('demo', [101], async (op, fn) => fn());
-  writeGrantEvent(f.store, new Date(START).toISOString(), 'demo', { operation: 'grant.github', decision });
-  writeGrantEvent(f.store, new Date(START).toISOString(), 'demo', { action: 'grant.step', method: 'github', step: 'mint', agent: 'coder',
-    grantDecision: decision, generation, until: new Date(START + CALL_TIMEOUT_MS + TOKEN_LIFETIME_MS + CLOCK_SKEW_MS).toISOString(), admin: f.approved.get(decision).admin });
-  githubWrite(githubDirectory(f.configDir, ['grants', 'demo', 'github', 'tokens', 'coder'], true), generation, result.json.token + '\n');
-  const restarted = f.create(); restarted.reconcile('demo');
-  assert.equal(restarted.status('demo').grants.length, 0);
-  await rejectCode(restarted.withToken('demo', 'coder', () => {}), 'github-not-granted');
-  await restarted.sweep('demo', 'restart');
-  assert.equal(f.fake.tokens.size, 0);
-  assert.equal(restarted.status('demo').serviceLeft.length, 0);
-});
-
-test('the per-agent claim refuses a second guarded use while the first callback is live', async (t) => {
-  const f = await fixture(t); await f.apply();
-  let release, entered;
-  const held = new Promise((r) => { entered = r; }), gate = new Promise((r) => { release = r; });
-  const first = f.manager.withToken('demo', 'coder', async () => { entered(); await gate; });
-  await held;
-  await rejectCode(f.manager.withToken('demo', 'coder', () => assert.fail('second consumer')), 'grant-busy');
-  release(); await first;
-  await f.manager.withToken('demo', 'coder', () => {});
-});
-
-test('N1 sweep closes an expired active generation while preserving its renewable grant', async (t) => {
-  const f = await fixture(t); const decision = await f.apply();
-  const active = f.manager.status('demo').grants[0];
-  const file = join(f.configDir, 'secrets/grants/demo/github/tokens/coder', active.generation);
-  const intent = f.events().find((e) => e.action === 'grant.step' && e.generation === active.generation);
-  f.advance(Date.parse(intent.until) - f.now() - 1); await f.manager.sweep('demo', 'jason');
-  assert.ok(existsSync(file));
-  f.advance(1); await f.manager.sweep('demo', 'jason');
-  assert.equal(existsSync(file), false);
-  assert.equal(f.manager.status('demo').grants[0].decision, decision);
-  assert.ok(f.events().some((e) => e.action === 'grant.token.closed' && e.generation === active.generation && e.reason === 'expired'));
-  await f.manager.withToken('demo', 'coder', (token) => assert.ok(f.fake.tokens.has(token)));
-  assert.ok(f.manager.status('demo').grants[0].generation !== active.generation);
-});
-
-test('mutant: closeToken must not count a 401 as proven revocation', async (t) => {
-  const f = await fixture(t); await f.apply();
-  f.fake.intercept(async (r, answer) => { if (r.method === 'DELETE') { answer(401, {}); return true; } return false; });
-  await f.manager.revoke('demo', 'coder', 'test', 'jason');
-  assert.equal(f.manager.status('demo').serviceLeft.length, 1);
-  assert.equal(f.fake.tokens.size, 1);
-});
-
-for (const status of [500, 503]) test(`mutant: mint ${status} is uncertain issuance and stays serviceLeft`, async (t) => {
-  const f = await fixture(t);
-  f.fake.intercept(async (r, answer) => { if (r.method === 'POST') { answer(status, {}); return true; } return false; });
-  await rejectCode(f.apply(), 'github-failed');
-  assert.equal(f.manager.status('demo').serviceLeft.length, 1);
-  assert.equal(f.events().some((e) => e.action === 'grant.token.closed' && e.reason === 'not-issued'), false);
-});
-
-test('mutant: shutdown abort alone prevents a pending generation from applying', async (t) => {
-  const f = await fixture(t); const decision = f.raise();
-  let release, entered;
-  const held = new Promise((resolve) => { entered = resolve; }), gate = new Promise((resolve) => { release = resolve; });
-  f.fake.intercept(async (r) => { if (r.method === 'POST') { entered(); await gate; } return false; });
-  const pending = f.manager.run('demo', decision);
-  const refused = rejectCode(pending, 'revoked');
-  await held;
-  const closed = f.manager.close(); release();
-  await refused; await closed;
-  assert.equal(f.manager.status('demo').grants.length, 0);
-  assert.equal(f.fake.tokens.size, 0);
-});

packages/business/src/business.mjs

@@ -129,7 +129,7 @@ function checkRoles(roles, file, rolesDir, business) {
     requireId(instance, `${where} instance name`);
     const at = `${where}.${instance}`;
     requireObject(entry, at);
-    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish", "hosts", "github"], at);
+    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish", "hosts"], at);
     requireId(entry.definition, `${at}.definition`);
     const definition = Object.hasOwn(definitions, entry.definition) ? definitions[entry.definition] : loadRole(rolesDir, entry.definition);
     definitions[entry.definition] = definition;
@@ -137,7 +137,7 @@ function checkRoles(roles, file, rolesDir, business) {
     const services = definition.credentials.map((c) => c.service);
     if (entry.hosts !== undefined) refuse(`${at}.hosts ${HOSTS_MOVED}`);
     // A host.<id> key reference comes from the agent's grant record at bus start (r6 X4), never from here.
-    const kinds = services.filter((s) => s !== HOST_SERVICE && s !== "github");
+    const kinds = services.filter((s) => s !== HOST_SERVICE);
     let tracker = null;
     if (services.includes("vikunja")) {
       if (entry.tracker === undefined) refuse(`${at} needs "tracker" with its Vikunja bot, because ${entry.definition} uses vikunja`);
@@ -166,14 +166,6 @@ function checkRoles(roles, file, rolesDir, business) {
       if (!out[instance].identity || !services.includes("gitea")) refuse(`${at}.publish needs identity and a gitea definition`);
       out[instance].publish = requireDistinctList(entry.publish, `${at}.publish`, (p) => requireId(p, `${at}.publish entry`), { nonEmpty: true });
     }
-    // Row297: App grants have fixed scopes and protected token storage, not a generic credential ref.
-    if (entry.github !== undefined) {
-      if (!services.includes("github")) refuse(`${at}.github needs a github definition`);
-      requireObject(entry.github, `${at}.github`);
-      rejectUnknownKeys(entry.github, ["projects"], `${at}.github`);
-      out[instance].github = { projects: requireDistinctList(entry.github.projects, `${at}.github.projects`,
-        (p) => requireId(p, `${at}.github.projects entry`), { nonEmpty: true }) };
-    }
     checkPersonaVars(out[instance].vars, entry.definition, at);
   }
   return { roles: out, definitions };
@@ -275,7 +267,7 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
       projects[id] = checkMapping(entry, `${file} projects.${id}`, { fail: (code, message) => refuse(`${code}: ${message}`) });
       continue;
     }
-    rejectUnknownKeys(entry, ["root", "repo", "remote", "githubId"], `${file} projects.${id}`);
+    rejectUnknownKeys(entry, ["root", "repo", "remote"], `${file} projects.${id}`);
     if (typeof entry.root !== "string" || !isAbsolute(entry.root) || normalize(entry.root) !== entry.root || entry.root.includes("\0")) {
       refuse(`${file} projects.${id}.root must be a normalized absolute path`);
     }
@@ -285,16 +277,10 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
     }
     // Row 199 (#1697, design D9 step 2): the upstream; a granted agent's work goes to its fork.
     if (Object.hasOwn(entry, "remote")) httpsUrl(entry.remote, `${file} projects.${id}.remote`, { repo: true });
-    if (entry.githubId !== undefined) requirePositiveInt(entry.githubId, `${file} projects.${id}.githubId`);
-    projects[id] = { root: entry.root, ...(entry.githubId !== undefined ? { githubId: entry.githubId } : {}), ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}),
+    projects[id] = { root: entry.root, ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}),
       ...(Object.hasOwn(entry, "remote") ? { remote: entry.remote } : {}) };
   }
   for (const [instance, role] of Object.entries(roles)) {
-    for (const project of role.github?.projects ?? []) {
-      const p = projects[project];
-      if (!p || p.kind === 'library' || !p.remote || !Number.isSafeInteger(p.githubId) || p.githubId <= 0)
-        refuse(`${file} roles.${instance}.github names ${project}, which needs a repository remote and githubId`);
-    }
     for (const project of role.publish ?? []) {
       if (!Object.hasOwn(projects, project)) refuse(`${file} roles.${instance}.publish names ${project}, which the business file doesn't declare`);
       if (projects[project].kind === 'library') refuse(`${file} roles.${instance}.publish names library project ${project}; library repositories cannot be published by agents`);

packages/business/src/index.mjs

@@ -13,3 +13,4 @@ export { configDir, businessFilePath, validateBusinessDocument, loadBusiness } f
 export { LEVELS, accessFilePath, checkAccess, loadAccess, covers } from "./access.mjs";
 export { projectFilePath, validateProjectDocument, loadProject } from "./project.mjs";
 export { systemVars, resolveInstance, classify } from "./resolve.mjs";
+export { loadSeatSets } from "./library-seats.mjs";

packages/business/src/instance-settings.mjs

@@ -108,7 +108,7 @@ function definitionFor(rolesDir, name, { credentials = false } = {}) {
 // Vikunja bot the human names. The add makes no Vikunja account. Any other definition refuses it.
 function createdCredentials(old, instance, definition, args) {
   // webby-0094 N2: a host grant is no token reference (business.mjs checkRoles drops it too).
-  const services = definition.credentials.map(c => c.service).filter(service => service !== HOST_SERVICE && service !== "github");
+  const services = definition.credentials.map(c => c.service).filter(service => service !== HOST_SERVICE);
   const out = {};
   if (services.includes("vikunja")) {
     if (!Object.hasOwn(args, "tracker")) {

packages/business/src/library-seats.mjs

@@ -0,0 +1,51 @@
+// Case 2 design 5.1 (M7, M8, row 220): which seats work in a library business,
+// and which of those hold a creative definition. Read from the business files on
+// every call, so an edit takes effect without a restart. Fail closed: a business
+// file that can't be read or validated throws. So does anything at the businesses
+// path that can't be listed: a file, a dangling symlink, or a directory that can't
+// be read. Only a path with nothing at it (lstat ENOENT) holds no library business,
+// so both sets are empty. No caller turns a throw into an empty set.
+import { lstatSync, readdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { BusinessError } from "./errors.mjs";
+import { configDir, loadBusiness } from "./business.mjs";
+import { CREATIVE_DEFINITIONS } from "./vocabulary.mjs";
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+
+export function defaultRolesDir(env = process.env) {
+  return resolve(env.MOSAIC_ROLES_DIR || join(REPO, "roles"));
+}
+
+// Returns { librarySeats, creativeSeats }: Sets of seat names (the role keys of
+// each business). A seat in two businesses counts when either one puts it in a
+// set. creativeSeats is a subset of librarySeats.
+export function loadSeatSets({ dir = configDir(), rolesDir = defaultRolesDir() } = {}) {
+  // lstat first: only nothing at the path is an absent directory. Anything else
+  // there (a file, a dangling symlink, a directory) must list, or it throws.
+  const businesses = join(dir, "businesses");
+  try {
+    lstatSync(businesses);
+  } catch (err) {
+    if (err.code === "ENOENT") return { librarySeats: new Set(), creativeSeats: new Set() };
+    throw new BusinessError(`cannot list businesses in ${dir}: ${err.message}`);
+  }
+  let names;
+  try {
+    names = readdirSync(businesses).filter((name) => name.endsWith(".json"));
+  } catch (err) {
+    throw new BusinessError(`cannot list businesses in ${dir}: ${err.message}`);
+  }
+  const librarySeats = new Set();
+  const creativeSeats = new Set();
+  for (const name of names.sort()) {
+    const business = loadBusiness(name.slice(0, -".json".length), { dir, rolesDir });
+    if (!Object.values(business.projects).some((project) => project.kind === "library")) continue;
+    for (const [seat, role] of Object.entries(business.roles)) {
+      librarySeats.add(seat);
+      if (CREATIVE_DEFINITIONS.includes(role.definition)) creativeSeats.add(seat);
+    }
+  }
+  return { librarySeats, creativeSeats };
+}

packages/business/src/role.mjs

@@ -131,15 +131,13 @@ function checkCredentials(credentials) {
     requireObject(entry, `role credentials[${i}]`);
     // Row 210 (#1707, design D1): "host" takes no scopes; the business file names the hosts.
     const host = entry.service === HOST_SERVICE;
-    const github = entry.service === "github";
-    rejectUnknownKeys(entry, (host || github) ? ["service"] : ["service", "scopes"], `role credentials[${i}]`);
-    if (!host && !github && !SERVICES.includes(entry.service)) {
-      refuse(`role credentials[${i}].service must be one of: ${[...SERVICES, HOST_SERVICE, "github"].join(", ")}`);
+    rejectUnknownKeys(entry, host ? ["service"] : ["service", "scopes"], `role credentials[${i}]`);
+    if (!host && !SERVICES.includes(entry.service)) {
+      refuse(`role credentials[${i}].service must be one of: ${[...SERVICES, HOST_SERVICE].join(", ")}`);
     }
     if (seen.has(entry.service)) refuse(`role credentials name ${entry.service} twice`);
     seen.add(entry.service);
     if (host) return { service: HOST_SERVICE };
-    if (github) return { service: "github" };
     const scopes = entry.service === "gitea" ? checkGiteaScopes(entry.scopes) : checkVikunjaScopes(entry.scopes);
     return { service: entry.service, scopes };
   });

packages/business/tests/business.test.mjs

@@ -27,6 +27,10 @@ test('C2-04: library mappings load without roots, remain frozen, and retain mapp
   assert.deepEqual(validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }).projects.books.universes.harbor.playground, ['Elsewhere/Playground/']);
   doc.projects.books.universes.harbor.playground = ['Second World/Playground/'];
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-other-universe/);
+  // C2-01d: a supporting prefix inside another universe's book refuses with its own code.
+  doc.projects.books = mappingEntry();
+  doc.projects.books.universes.harbor.supporting = ['Second World/Notes/'];
+  refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-supporting-other-universe/);
   doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
   refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
 });

packages/business/tests/github.test.mjs

@@ -1,73 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { loadRole, validateBusinessDocument } from '../src/index.mjs';
-import { instanceSettings } from '../src/instance-settings.mjs';
-import { businessDoc, rolesCopy, systemFor, tmp, writeJson } from './helpers.mjs';
-
-function fixture(t) {
-  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
-  const rolesDir = rolesCopy(root);
-  const file = join(rolesDir, 'coder.json');
-  const definition = JSON.parse(readFileSync(file, 'utf8'));
-  definition.credentials.push({ service: 'github' });
-  writeJson(file, definition);
-  const doc = businessDoc(root);
-  doc.roles.coder.github = { projects: ['stack'] };
-  doc.projects.stack.remote = 'https://github.com/acme/stack';
-  doc.projects.stack.githubId = 101;
-  const validate = () => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir });
-  return { root, rolesDir, file, definition, doc, validate };
-}
-
-test('GitHub fixed declaration and repository binding load without generic token references', (t) => {
-  const f = fixture(t);
-  assert.deepEqual(loadRole(f.rolesDir, 'coder').credentials.at(-1), { service: 'github' });
-  const b = f.validate();
-  assert.deepEqual(b.roles.coder.github, { projects: ['stack'] });
-  assert.equal(b.projects.stack.githubId, 101);
-  assert.equal(Object.hasOwn(b.roles.coder.credentials, 'github'), false);
-});
-
-test('GitHub declaration refuses caller scopes and role account/fork requests', (t) => {
-  const f = fixture(t);
-  f.definition.credentials.at(-1).scopes = ['all']; writeJson(f.file, f.definition);
-  assert.throws(() => loadRole(f.rolesDir, 'coder'), /unsupported.*scopes/);
-  delete f.definition.credentials.at(-1).scopes; writeJson(f.file, f.definition);
-  for (const field of ['account', 'fork']) {
-    f.doc.roles.coder.github[field] = true;
-    assert.throws(f.validate, new RegExp('unsupported.*' + field));
-    delete f.doc.roles.coder.github[field];
-  }
-});
-
-test('GitHub bindings refuse absent declaration, unknown project and missing repository ID', (t) => {
-  const f = fixture(t);
-  delete f.doc.projects.stack.githubId;
-  assert.throws(f.validate, /githubId/);
-  f.doc.projects.stack.githubId = 101;
-  f.doc.roles.coder.github.projects = ['missing'];
-  assert.throws(f.validate, /github.*missing/);
-  f.doc.roles.coder.github.projects = ['stack'];
-  f.definition.credentials.pop(); writeJson(f.file, f.definition);
-  assert.throws(f.validate, /github.*definition/);
-});
-
-// mos-1518: preserve closed-service-list coverage when github becomes a fixed declaration.
-test('a service outside the closed list still refuses with service must be one of', (t) => {
-  const f = fixture(t); f.definition.credentials.at(-1).service = 'not-a-service';
-  writeJson(f.file, f.definition);
-  assert.throws(() => loadRole(f.rolesDir, 'coder'), /service must be one of/);
-});
-
-test('human add of a GitHub-declaring definition creates only generic service references', (t) => {
-  const f = fixture(t), dir = join(f.root, 'config');
-  const file = writeJson(join(dir, 'businesses/acme.json'), f.doc);
-  const settings = instanceSettings({ dir, rolesDir: f.rolesDir, system: systemFor(f.root) });
-  settings.set('acme', { revision: settings.read('acme').revision, instance: 'coder-two', op: 'add', definition: 'coder',
-    tracker: { bot: 'bot-acme-coder-two', botId: 40 } }, 'jason');
-  const entry = JSON.parse(readFileSync(file, 'utf8')).roles['coder-two'];
-  assert.deepEqual(Object.keys(entry.credentials).sort(), ['gitea', 'vikunja']);
-  assert.equal(Object.hasOwn(entry, 'github'), false);
-});

packages/business/tests/library-seats.test.mjs

@@ -0,0 +1,107 @@
+// Case 2 M7/M8 (design 5.1, row 220): loadSeatSets reads every business file in
+// the config directory. A seat is a library seat when a business with a library
+// project names it; a creative seat is a library seat whose definition is creative.
+// Any file it can't read or validate throws, and so does a businesses path that is
+// not a directory. An absent businesses directory gives empty sets.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadSeatSets } from "../src/library-seats.mjs";
+import { BusinessError } from "../src/index.mjs";
+import { businessDoc, writeJson, REPO_ROLES } from "./helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(join(dir, "businesses"), { recursive: true });
+  return { root, dir };
+}
+
+const sets = (dir) => loadSeatSets({ dir, rolesDir: REPO_ROLES });
+
+test("M7/M8: library seats come from library businesses, creative seats from their creative definitions", (t) => {
+  const { root, dir } = fixture(t);
+  const doc = businessDoc(root, "acme");
+  doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "acme.json"), doc);
+  const found = sets(dir);
+  assert.deepEqual([...found.librarySeats].sort(), ["bean", "chief", "coder", "cto", "pm", "reviewer"]);
+  assert.deepEqual([...found.creativeSeats], ["bean"]);
+  assert.ok([...found.creativeSeats].every((seat) => found.librarySeats.has(seat)));
+});
+
+test("M8: a business with no library project puts no seat in either set", (t) => {
+  const { root, dir } = fixture(t);
+  const doc = businessDoc(root, "other");
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "other.json"), doc);
+  const found = sets(dir);
+  assert.equal(found.librarySeats.size, 0);
+  assert.equal(found.creativeSeats.size, 0);
+});
+
+test("M7/M8: a business file that is not valid JSON throws; no empty set", (t) => {
+  const { root, dir } = fixture(t);
+  writeJson(join(dir, "businesses", "acme.json"), businessDoc(root, "acme"));
+  const broken = join(dir, "businesses", "broken.json");
+  writeFileSync(broken, "{");
+  chmodSync(broken, 0o600);
+  assert.throws(() => sets(dir), BusinessError);
+});
+
+test("M7/M8: an absent businesses directory gives empty sets", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-none-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const found = sets(join(root, "config"));
+  assert.equal(found.librarySeats.size, 0);
+  assert.equal(found.creativeSeats.size, 0);
+});
+
+test("M7/M8: a businesses path that is not a directory throws; no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-file-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(dir);
+  writeFileSync(join(dir, "businesses"), "not a directory");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a businesses symlink to a missing target throws; no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-dangling-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  mkdirSync(dir);
+  symlinkSync(join(root, "missing"), join(dir, "businesses"));
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a config directory under a regular file throws (lstat fails with ENOTDIR); no empty set", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "row220-seats-notdir-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  writeFileSync(dir, "not a directory");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /cannot list businesses/.test(err.message));
+});
+
+test("M7/M8: a business file that can't be read throws; no empty set", (t) => {
+  const { root, dir } = fixture(t);
+  writeJson(join(dir, "businesses", "acme.json"), businessDoc(root, "acme"));
+  const file = join(dir, "businesses", "acme.json");
+  chmodSync(file, 0o000);
+  t.after(() => {
+    // The fixture's rmSync hook can run first, so the file may already be gone.
+    try {
+      chmodSync(file, 0o600);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  });
+  // Root reads a mode 000 file, so the check cannot hold there.
+  if (process.getuid?.() === 0) return t.skip("running as root: mode 000 files stay readable");
+  assert.throws(() => sets(dir), (err) => err instanceof BusinessError && /must be a regular, non-symbolic-link file/.test(err.message));
+});

packages/business/tests/role.test.mjs

@@ -206,7 +206,7 @@ test("credentials: Vikunja scopes are a group-to-verbs map from the grantable li
 });
 
 test("credentials: services", () => {
-  refuses(() => check({ credentials: [{ service: "github", scopes: [] }] }), /unsupported.*scopes/);
+  refuses(() => check({ credentials: [{ service: "github", scopes: [] }] }), /service must be one of/);
   refuses(() => check({ credentials: [{ service: "gitea", scopes: ["read:issue"] }, { service: "gitea", scopes: ["read:user"] }] }), /twice/);
   refuses(() => check({ credentials: [{ service: "gitea", scopes: ["read:issue"], token: "x" }] }), /unsupported role credentials\[0\] key/);
   assert.deepEqual(check({ credentials: [] }).credentials, []);

packages/cli/src/github-grants.mjs

@@ -1,43 +0,0 @@
-// Row297 CLI shapes. Only the broker parses/uses the RSA private key.
-import { CliError } from './errors.mjs';
-const USAGE = 'mosaic grants status|sweep github [--json] [--tester] | revoke AGENT github --reason R | admin set github --url HTTPS_ORIGIN --app-id ID --installation-id ID --account-id ID --rotate-by DATE | admin rotate github --rotate-by DATE | admin remove github';
-const SHAPES = {
-  status: { n: 1, flags: ['--json', '--tester'], need: [] },
-  sweep: { n: 1, flags: ['--tester'], need: [] },
-  revoke: { n: 2, flags: ['--tester'], need: ['--reason'] },
-  'admin set': { n: 1, flags: [], need: ['--url', '--app-id', '--installation-id', '--account-id', '--rotate-by'] },
-  'admin rotate': { n: 1, flags: [], need: ['--rotate-by'] },
-  'admin remove': { n: 1, flags: [], need: [] },
-};
-const usage = () => { throw new CliError(USAGE, 4); };
-async function stdinKey(stdin) {
-  let text = '';
-  for await (const chunk of stdin) { text += chunk; if (text.length > 16384) throw new CliError('refused: App key on stdin is too long', 2); }
-  if (!text.trim()) throw new CliError('refused: no App key on stdin', 4);
-  return text;
-}
-const positive = (text) => {
-  if (typeof text !== 'string' || !/^[1-9][0-9]*$/.test(text) || !Number.isSafeInteger(Number(text))) usage();
-  return Number(text);
-};
-function format(status) {
-  const lines = [status.admin ? `admin: App ${status.admin.appId}, installation ${status.admin.installationId}, account ${status.admin.accountId} on ${status.admin.url}, rotate by ${status.admin.rotateBy}` : 'admin: none'];
-  for (const g of status.grants) lines.push(`grant\t${g.agent}\t${g.projects.join(',')}\texpires ${g.expiresAt}\trotate by ${g.rotateBy}\t${g.decision}`);
-  for (const g of status.serviceLeft) lines.push(`left\t${g.agent}\t${g.generation}\tuntil ${g.until}`);
-  return lines.join('\n') + '\n';
-}
-export async function githubGrantsCommand(parsed, verb, rest, io, callFor) {
-  const shape = Object.hasOwn(SHAPES, verb) ? SHAPES[verb] : null;
-  const v = parsed.values;
-  if (!shape || rest.length !== shape.n || [...parsed.flags].some((f) => !shape.flags.includes(f)) ||
-    Object.keys(v).some((k) => k !== '--business' && !shape.need.includes(k)) || shape.need.some((k) => !Object.hasOwn(v, k))) usage();
-  let args = { service: 'github' };
-  if (verb === 'revoke') args = { ...args, agent: rest[0], reason: v['--reason'] };
-  if (verb === 'admin set') args = { ...args, url: v['--url'], appId: positive(v['--app-id']), installationId: positive(v['--installation-id']), accountId: positive(v['--account-id']), rotateBy: v['--rotate-by'] };
-  if (verb === 'admin rotate') args.rotateBy = v['--rotate-by'];
-  if (verb === 'admin set' || verb === 'admin rotate') args.token = await stdinKey(io.stdin);
-  try {
-    const result = await callFor(parsed)('grants.' + verb.replace(' ', '.'), args);
-    io.stdout.write(verb === 'status' && !parsed.flags.has('--json') ? format(result) : JSON.stringify(result, null, 2) + '\n');
-  } catch (e) { if (e instanceof CliError) throw e; throw new CliError(e.message, 2); }
-}

packages/cli/src/grants.mjs

@@ -4,16 +4,14 @@
 // and sweep the human's or, with --tester, the tester's. admin set reads the admin token on stdin, never
 // argv, and nothing here prints a token: the answers carry ids and names only.
 import { CliError } from "./errors.mjs";
-import { githubGrantsCommand } from "./github-grants.mjs";
 
 export const GRANTS_USAGE =
   "mosaic grants status gitea [--json] [--tester] [--business ID] | run DECISION [--business ID] | " +
   "revoke AGENT gitea --reason R [--tester] [--business ID] | sweep gitea [--tester] [--business ID] | " +
   "admin set gitea --url URL --account NAME --rotate-by DATE [--business ID] | " +
-  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea | " +
-  "status|sweep github | revoke AGENT github --reason R | admin set github --url URL --app-id ID --installation-id ID --account-id ID --rotate-by DATE | admin rotate github --rotate-by DATE | admin remove github";
+  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea";
 const MAX_TOKEN = 16384;
-const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by", "--app-id", "--installation-id", "--account-id"];
+const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by"];
 
 function parse(args) {
   const out = { positional: [], flags: new Set(), values: {} };
@@ -74,7 +72,6 @@ export async function grantsCommand(args, io, callFor) {
     verb = `admin ${rest[0] ?? ""}`;
     rest = rest.slice(1);
   }
-  if (verb !== "run" && rest.at(-1) === "github") return githubGrantsCommand(parsed, verb, rest, io, callFor);
   // Own keys only, so `constructor` is a usage error, not a verb.
   const shape = Object.hasOwn(SHAPES, verb ?? "") ? SHAPES[verb] : null;
   if (

packages/cli/tests/case1-hostcheck.test.mjs

@@ -333,3 +333,51 @@ test("row 240 pins and usage: the shipped pins are r6's, the script reads the pi
     assert.deepEqual([u.status, u.stderr], [2, "hostcheck: refusing: run it as root\n"]);
   }
 });
+
+test("Vikunja 614 check: item 5 accepts dpkg's bare octal mode and leading-zero equivalents", (t) => {
+  for (const mode of ["750", "0750"]) {
+    const h = host(t);
+    put(join(h.hc, "statoverride"), `root mosaic ${mode} /usr/bin/bwrap\n`);
+    const r = run(h, "--check");
+    assert.equal(r.status, 0, r.out + r.err);
+    assert.deepEqual(fails(r), []);
+    assert.ok(r.lines.some((line) => line.startsWith("ok 5 ")), r.out);
+  }
+});
+
+test("Vikunja 614 enforce: dpkg's bare 750 leaves bwrap open and writes no DRIFT", (t) => {
+  const h = host(t);
+  put(join(h.hc, "statoverride"), "root mosaic 750 /usr/bin/bwrap\n");
+  const r = run(h, "--enforce");
+  assert.equal(r.status, 0, r.out + r.err);
+  assert.deepEqual(fails(r), []);
+  assert.equal(r.lines.at(-1), "hostcheck: all seven hold");
+  assert.deepEqual([calls(h, "apparmor_parser"), calls(h, "chown"), calls(h, "chmod")], [[], [], []]);
+  assert.equal(existsSync(drift(h)), false);
+  assert.equal(existsSync(hlog(h)), false);
+});
+
+test("Vikunja 614 check: item 5 refuses other modes, owners, groups, paths and malformed overrides", (t) => {
+  const overrides = [
+    ...["755", "0755", "4750", "75", "7500", "075", "00750", "000750", "0780", "8", "0o750", "+750", "-750", "7x0", "750+0", ""].map((mode) => `root mosaic ${mode} /usr/bin/bwrap\n`),
+    "root  mosaic 750 /usr/bin/bwrap\n",
+    "root\tmosaic 750 /usr/bin/bwrap\n",
+    "mosaic mosaic 750 /usr/bin/bwrap\n",
+    "root root 750 /usr/bin/bwrap\n",
+    "root mosaic 750 /usr/bin/other\n",
+    "root mosaic 750 /usr/bin/bwrap extra\n",
+    "root mosaic 750\n",
+    "root mosaic 750 /usr/bin/bwrap\nroot mosaic 750 /usr/bin/bwrap\n",
+    "\n",
+    "",
+    null,
+  ];
+  for (const override of overrides) {
+    const h = host(t);
+    if (override === null) rmSync(join(h.hc, "statoverride"));
+    else put(join(h.hc, "statoverride"), override);
+    const r = run(h, "--check");
+    assert.equal(r.status, 1, `${JSON.stringify(override)}: ${r.out}${r.err}`);
+    assert.deepEqual(fails(r).map((line) => line.split(" ")[1]), ["5"], r.out);
+  }
+});

packages/cli/tests/case2-install.test.mjs

@@ -0,0 +1,419 @@
+// Case 2 row C2-13b (#1727): scripts/case2-install.sh installs a hub as <user>, and
+// scripts/case2-precheck.sh's library checks and --library-status mode. Brief:
+// docs/plans/2026-10-20_case2-rows.md "C2-13b". Every case runs in a scratch home with its own
+// MOSAIC_CONFIG, a stub stack-copy and fake getent, sudo, id, node, bwrap and systemctl. The library
+// sync runs in-process against a local bare repo, as the bus would. Nothing here reads or writes
+// ~/.mosaic-dev, ~/.config/mosaic-dev, /etc or a network host, and no fixture value is a credential.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { BASE, MARKER, git, mappingEntry, repo } from "../../library/tests/helpers.mjs";
+import { ensureMirror, mirrorPath, sync } from "../../library/src/index.mjs";
+import { gitEnv } from "../../seat/src/checkout.mjs";
+import { SAFE } from "../../project/src/git.mjs";
+import { tmp } from "./helpers.mjs";
+
+const REPO = fileURLToPath(new URL("../../../", import.meta.url));
+const INSTALL = join(REPO, "scripts", "case2-install.sh");
+const PRECHECK = join(REPO, "scripts", "case2-precheck.sh");
+const COMMIT = "c".repeat(40);
+const UID = process.getuid();
+const GID = process.getgid();
+// Made-up values; no output may hold them.
+const FIXTURE_KEY = "fixture-zai-key-8d41a7";
+const PERSONA_TEXT = { bean: "Bean is warm and brief. PERSONA-TEXT-bean-61f0\n", chet: "Chet is dry and exact. PERSONA-TEXT-chet-2b9e\n" };
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const mode = (p) => statSync(p).mode & 0o777;
+
+function script(file, text) {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `#!/usr/bin/env bash\n${text}\n`);
+  chmodSync(file, 0o755);
+  return file;
+}
+
+// A scratch <user>: a home, an input business file, a persona staging dir and fakes.
+function world(t, { profile = "library" } = {}) {
+  const root = tmp(t, "case2-install-");
+  const home = join(root, "home");
+  const configDir = join(home, ".config", "mosaic-dev");
+  // claude-session.env is in place before the install, as 2d would leave it on a re-run.
+  const secrets = join(configDir, "secrets");
+  mkdirSync(secrets, { recursive: true, mode: 0o700 });
+  chmodSync(configDir, 0o700);
+  writeFileSync(join(secrets, "claude-session.env"), `ZAI_API_KEY=${FIXTURE_KEY}\n`, { mode: 0o600 });
+  const doc = businessDoc(root);
+  for (const r of Object.values(doc.roles)) r.vars = { ...r.vars, harness: "pi" };
+  if (profile === "library") {
+    doc.projects.books = { ...mappingEntry(), user: "writer" };
+    doc.roles.bean = { definition: "companion", vars: { harness: "pi" } };
+    doc.roles.chet = { definition: "companion", vars: { harness: "pi" } };
+  } else doc.vars["bus.tester"] = true;
+  const input = writeJson(join(root, "input", "acme.json"), doc);
+  const staging = join(root, "staging");
+  mkdirSync(staging, { mode: 0o700 });
+  const personas = [];
+  for (const [instance, name] of [["bean", "Bean"], ["chet", "Chet"]]) {
+    writeFileSync(join(staging, `${instance}.md`), PERSONA_TEXT[instance], { mode: 0o600 });
+    personas.push({ instance, name, bytes: Buffer.byteLength(PERSONA_TEXT[instance]), sha256: sha256(PERSONA_TEXT[instance]) });
+  }
+  writeFileSync(join(staging, "manifest.json"), `${JSON.stringify({ version: 1, personas }, null, 2)}\n`, { mode: 0o600 });
+  const bin = join(root, "bin");
+  const log = join(root, "calls.log");
+  script(join(bin, "stack-copy"), `echo "stack-copy $*" >>'${log}'
+[ "$1" = copy ] && [ "$3" = --copies ] || exit 4
+mkdir -p "$4/$2/scripts" && : >"$4/$2/scripts/mosaic" && echo "copied: $4/$2"`);
+  script(join(bin, "systemctl"), `echo "systemctl $*" >>'${log}'`);
+  const me = spawnSync("id", ["-un"], { encoding: "utf8" }).stdout.trim();
+  script(join(bin, "getent"), `[ "$1" = passwd ] && [ "$2" = '${me}' ] && echo '${me}:x:${UID}:${GID}::${home}:/bin/bash'`);
+  script(join(bin, "sudo"), "exit 1");
+  script(join(bin, "id"), `if [ "$1" = -G ]; then echo '${GID}'; elif [ "$1" = -u ] && [ -n "\${CASE2_TEST_UID:-}" ]; then echo "$CASE2_TEST_UID"; else exec /usr/bin/id "$@"; fi`);
+  script(join(bin, "node"), `if [ "$1" = --version ]; then echo v24.3.0; exit 0; fi\nexec '${process.execPath}' "$@"`);
+  script(join(bin, "bwrap"), "exit 0");
+  const units = join(root, "units");
+  mkdirSync(units);
+  writeFileSync(join(units, "mosaic-webui.service"), "[Service]\nExecStart=/usr/bin/node /x/cli.mjs serve --port 443 --business acme\n");
+  writeFileSync(join(units, "[email protected]"), "[Service]\nEnvironment=PATH=/usr/bin\n");
+  const sys = join(root, "sys");
+  mkdirSync(join(sys, "net", "ipv4"), { recursive: true });
+  mkdirSync(join(sys, "kernel"), { recursive: true });
+  writeFileSync(join(sys, "net", "ipv4", "ip_unprivileged_port_start"), "1024\n");
+  writeFileSync(join(sys, "kernel", "apparmor_restrict_unprivileged_userns"), "1\n");
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
+  return {
+    root, home, configDir, secrets, input, staging, bin, log, units, sys, doc,
+    config: join(configDir, "config.json"),
+    business: join(configDir, "businesses", "acme.json"),
+    personaDir: join(configDir, "personas", "acme"),
+    slot: join(secrets, "acme"),
+    dataRoot: join(home, ".mosaic-dev"),
+  };
+}
+
+function env(x, extra = {}) {
+  return { PATH: `${x.bin}:/usr/bin:/bin`, HOME: x.home, MOSAIC_CONFIG: x.config, CASE2_STACK_COPY: join(x.bin, "stack-copy"), ...extra };
+}
+
+function clean(out) {
+  assert.doesNotMatch(out, new RegExp(FIXTURE_KEY), "the output holds the fixture key");
+  assert.doesNotMatch(out, /PERSONA-TEXT/, "the output holds persona text");
+  assert.doesNotMatch(out, new RegExp(MARKER), "the output holds her text");
+}
+
+function install(x, { profile = "library", args = null, extra = {} } = {}) {
+  const argv = args ?? ["--business", "acme", "--business-file", x.input, "--commit", COMMIT, "--profile", profile,
+    ...(profile === "library" ? ["--personas", x.staging] : [])];
+  const r = spawnSync(INSTALL, argv, { encoding: "utf8", timeout: 120000, env: env(x, extra) });
+  const out = r.stdout + r.stderr;
+  clean(out);
+  return { code: r.status, out };
+}
+
+function precheck(x, { args = ["--business", "acme", "--profile", "library"] } = {}) {
+  const r = spawnSync(PRECHECK, args, {
+    encoding: "utf8",
+    timeout: 60000,
+    env: env(x, { CASE2_UNIT_DIR: x.units, CASE2_PROC_SYS: x.sys, CASE2_GETENT: join(x.bin, "getent") }),
+  });
+  const out = r.stdout + r.stderr;
+  clean(out);
+  return { code: r.status, out };
+}
+const status = (x) => precheck(x, { args: ["--business", "acme", "--library-status"] });
+
+function refused(r, pattern) {
+  assert.equal(r.code, 1, r.out);
+  assert.match(r.out, pattern);
+}
+
+const calls = (x) => (existsSync(x.log) ? readFileSync(x.log, "utf8") : "");
+
+// ---- case2-install.sh ----
+
+test("the library install writes the business file, personas and slot dir, makes the copy and starts nothing", (t) => {
+  const x = world(t);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.equal(mode(x.business), 0o600);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  for (const [instance, name] of [["bean", "Bean"], ["chet", "Chet"]]) {
+    assert.equal(doc.roles[instance].vars["persona.name"], name);
+    assert.equal(doc.roles[instance].vars["persona.sha256"], sha256(PERSONA_TEXT[instance]));
+    assert.equal(doc.roles[instance].vars.harness, "pi");
+    const file = join(x.personaDir, `${instance}.md`);
+    assert.equal(readFileSync(file, "utf8"), PERSONA_TEXT[instance]);
+    assert.equal(mode(file), 0o600);
+  }
+  assert.equal(mode(join(x.configDir, "personas")), 0o700);
+  assert.equal(mode(x.personaDir), 0o700);
+  assert.equal(mode(x.slot), 0o700);
+  assert.deepEqual(readdirSync(x.slot), []);
+  assert.equal(calls(x), `stack-copy copy ${COMMIT} --copies ${join(x.home, ".local", "share", "mosaic-stack", "copies")}\n`);
+  assert.doesNotMatch(r.out, /release/);
+  assert.match(r.out, /business acme validates/);
+  assert.match(r.out, /--library-status/);
+  assert.ok(existsSync(x.config));
+});
+
+test("a library re-run passes and leaves every file as it was", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const before = readFileSync(x.business);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /already matches/);
+  assert.match(r.out, /personas already installed/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+test("a re-run refuses business-file-differs and leaves the file unchanged", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  doc.vars["tracker.pollSeconds"] = 120;
+  writeJson(x.business, doc);
+  const before = readFileSync(x.business);
+  refused(install(x), /business-file-differs/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+test("a re-run refuses persona-differs when an installed persona isn't the staged one, and writes nothing", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  rmSync(x.business);
+  writeFileSync(join(x.personaDir, "bean.md"), "Someone else. PERSONA-TEXT-other\n");
+  refused(install(x), /persona-differs/);
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the factory install writes no library mapping, persona or slot dir", (t) => {
+  const x = world(t, { profile: "factory" });
+  const r = install(x, { profile: "factory" });
+  assert.equal(r.code, 0, r.out);
+  const doc = JSON.parse(readFileSync(x.business, "utf8"));
+  assert.equal(Object.values(doc.projects).some((p) => p.kind === "library"), false);
+  assert.equal(existsSync(join(x.configDir, "personas")), false);
+  assert.equal(existsSync(x.slot), false);
+  assert.doesNotMatch(r.out, /--library-status/);
+});
+
+test("the factory install refuses a library project and bus.tester off, before anything is written", (t) => {
+  const x = world(t, { profile: "factory" });
+  const doc = JSON.parse(readFileSync(x.input, "utf8"));
+  doc.projects.books = { ...mappingEntry(), user: "writer" };
+  writeJson(x.input, doc);
+  refused(install(x, { profile: "factory" }), /profile-library-business/);
+  delete doc.projects.books;
+  doc.vars["bus.tester"] = false;
+  writeJson(x.input, doc);
+  refused(install(x, { profile: "factory" }), /bus-tester-off/);
+  assert.equal(calls(x), "");
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the library install refuses bus.tester on and a persona var in the input", (t) => {
+  const x = world(t);
+  const doc = JSON.parse(readFileSync(x.input, "utf8"));
+  doc.vars["bus.tester"] = true;
+  writeJson(x.input, doc);
+  refused(install(x), /bus-tester-on/);
+  doc.vars["bus.tester"] = false;
+  doc.roles.bean.vars["persona.name"] = "Bean";
+  writeJson(x.input, doc);
+  refused(install(x), /persona-var-input/);
+  assert.equal(calls(x), "");
+});
+
+test("the install refuses root, a business id mismatch, another --home and a config dir with group bits", (t) => {
+  const x = world(t);
+  refused(install(x, { extra: { CASE2_TEST_UID: "0" } }), /run-as-root/);
+  refused(install(x, { args: ["--business", "other", "--business-file", x.input, "--commit", COMMIT, "--personas", x.staging] }), /business-id-mismatch/);
+  refused(install(x, { args: ["--business", "acme", "--business-file", x.input, "--commit", COMMIT, "--personas", x.staging, "--home", x.root] }), /home-mismatch/);
+  chmodSync(x.configDir, 0o750);
+  refused(install(x), /config-dir-mode/);
+  assert.equal(calls(x), "");
+  assert.equal(existsSync(x.business), false);
+});
+
+test("the library install needs --personas", (t) => {
+  const x = world(t);
+  const r = install(x, { args: ["--business", "acme", "--business-file", x.input, "--commit", COMMIT] });
+  assert.equal(r.code, 4, r.out);
+  assert.match(r.out, /needs --personas/);
+});
+
+test("a validate refusal removes the business file this run wrote", (t) => {
+  const x = world(t);
+  unlinkSync(x.doc.roles.pm.credentials.gitea.file);
+  const r = install(x);
+  refused(r, /validate: .*the business file this run wrote is removed/);
+  assert.equal(existsSync(x.business), false);
+});
+
+test("N4: a validate refusal on a re-run leaves the matching business file in place, byte for byte", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const before = readFileSync(x.business);
+  unlinkSync(x.doc.roles.pm.credentials.gitea.file);
+  const r = install(x);
+  refused(r, /validate: /);
+  assert.doesNotMatch(r.out, /is removed/);
+  assert.deepEqual(readFileSync(x.business), before);
+});
+
+// ---- case2-precheck.sh, the library profile (D6a) ----
+
+test("a clean library host passes the precheck with no mirror yet", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const r = precheck(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, /ok {6}business file .* with no group or other bit/);
+  assert.match(r.out, /ok {6}no history for acme yet/);
+  assert.match(r.out, new RegExp(`ok {6}persona bean sha256 ${sha256(PERSONA_TEXT.bean)}`));
+  assert.match(r.out, new RegExp(`ok {6}persona chet sha256 ${sha256(PERSONA_TEXT.chet)}`));
+  assert.match(r.out, /ok {6}no Discord binding/);
+  assert.equal(existsSync(mirrorPath({ business: { id: "acme", projects: { books: x.doc.projects.books } }, project: "books", dataRoot: x.dataRoot })), false);
+});
+
+test("the library precheck refuses a persona file at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(join(x.personaDir, "bean.md"), 0o644);
+  refused(precheck(x), /REFUSED persona-mode: .*bean\.md must be .* 0600 file \(mode 644\)/);
+});
+
+test("the library precheck refuses a persona whose digest isn't persona.sha256", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  writeFileSync(join(x.personaDir, "chet.md"), "Not Chet. PERSONA-TEXT-other\n");
+  refused(precheck(x), /REFUSED persona-mismatch: persona chet has sha256 [0-9a-f]{64}, and persona.sha256 is /);
+});
+
+test("the library precheck refuses a persona dir with group bits", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(x.personaDir, 0o750);
+  refused(precheck(x), /REFUSED persona-mode: .*personas\/acme must be .* 0700 directory/);
+});
+
+test("the library precheck refuses a business file at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  chmodSync(x.business, 0o644);
+  refused(precheck(x), /REFUSED business-file-mode: .*acme\.json .*\(mode 644\)/);
+});
+
+test("the library precheck refuses a changes.jsonl at 0644", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const history = join(x.configDir, "businesses", ".history", "acme");
+  mkdirSync(history, { recursive: true, mode: 0o700 });
+  writeFileSync(join(history, "changes.jsonl"), "", { mode: 0o644 });
+  chmodSync(join(history, "changes.jsonl"), 0o644);
+  refused(precheck(x), /REFUSED history-mode: .*changes\.jsonl must be .* 0600 file \(mode 644\)/);
+  chmodSync(join(history, "changes.jsonl"), 0o600);
+  assert.equal(precheck(x).code, 0);
+});
+
+test("the library precheck refuses a Discord binding", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  mkdirSync(join(x.dataRoot, "discord"), { recursive: true });
+  writeFileSync(join(x.dataRoot, "discord", "her.json"), "{}\n", { mode: 0o600 });
+  refused(precheck(x), /REFUSED discord-binding: .*her\.json exists/);
+});
+
+// ---- case2-precheck.sh --library-status (D6b) ----
+
+// The context the bus builds for books (runtime.mjs:161-164), and a sync the way the bus's timer
+// runs it, against a local bare clone through the command parameter.
+function library(x) {
+  const context = { business: { id: "acme", projects: { books: x.doc.projects.books } }, project: "books", dataRoot: x.dataRoot };
+  mkdirSync(x.dataRoot, { recursive: true, mode: 0o700 });
+  chmodSync(x.dataRoot, 0o700);
+  const run = (bare, slot) => sync(context, {
+    slot,
+    command: (kind, url, { mirror, branch }) => ({
+      argv: [...SAFE, "-c", "protocol.file.allow=always", "-c", "core.createObject=rename", "-C", mirror, "fetch", "--no-tags",
+        "--no-write-fetch-head", "--end-of-options", bare, `+refs/heads/${branch}:refs/remotes/library/${branch}`],
+      env: { ...gitEnv(), LC_ALL: "C", GIT_CEILING_DIRECTORIES: dirname(mirror) },
+    }),
+  });
+  return { context, run };
+}
+
+test("--library-status refuses library-mirror-missing before the bus has made the mirror", (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  refused(status(x), /REFUSED library-mirror-missing: library books has no mirror at .*the bus makes it when it starts/);
+});
+
+test("--library-status refuses library-never-synced on a fresh mirror", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  await ensureMirror(library(x).context);
+  const r = status(x);
+  refused(r, /REFUSED library-never-synced: library books has no fetch yet/);
+  assert.doesNotMatch(r.out, /library-last-error/);
+});
+
+test("--library-status names a recorded lastError before the null lastFetch it leaves (N3)", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const lib = library(x);
+  await lib.run("/nonexistent", join(x.slot, "library-gitea"));
+  const r = status(x);
+  refused(r, /REFUSED library-last-error: library books: library-credential-missing at \d{4}-\d\d-\d\dT/);
+  assert.doesNotMatch(r.out, /library-never-synced/);
+});
+
+test("--library-status prints each R-problem's path as an escaped JSON string, then the count, and passes", async (t) => {
+  const x = world(t);
+  assert.equal(install(x).code, 0);
+  const odd = "Odd‮Name\u0085.md";
+  const f = repo(t, { ...BASE, [odd]: `${MARKER}\n` });
+  const bare = join(f.root, "remote.git");
+  git(f.root, "clone", "-q", "--bare", "--no-local", f.repo, bare);
+  writeFileSync(join(x.slot, "library-gitea"), "placeholder-not-a-token\n", { mode: 0o600 });
+  const { state } = await library(x).run(bare, join(x.slot, "library-gitea"));
+  assert.equal(state.lastError, null);
+  const r = status(x);
+  assert.equal(r.code, 0, r.out);
+  assert.match(r.out, new RegExp(`ok {6}library books last fetched \\S+, serving ${f.commit}`));
+  assert.match(r.out, /^problem {3}R2 "Inbox Note\.md"$/m);
+  assert.match(r.out, /^problem {3}R\d+ "Odd\\u202eName\\u0085\.md"$/m);
+  assert.doesNotMatch(r.out, /[\u0085‮]/);
+  const lines = r.out.split("\n").filter((l) => l.startsWith("problem   "));
+  assert.equal(lines.length, state.problems.length);
+  assert.match(r.out, new RegExp(`^problems  ${state.problems.length}$`, "m"));
+  assert.match(r.out, /case2-precheck: library status passed/);
+});
+
+test("--library-status takes no --profile", (t) => {
+  const x = world(t);
+  const r = precheck(x, { args: ["--business", "acme", "--library-status", "--profile", "library"] });
+  assert.equal(r.code, 4, r.out);
+});
+
+test("Vikunja 614: install preserves the explicit notifier decision bytes and mode and creates none when absent", (t) => {
+  const x = world(t);
+  const file = join(x.dataRoot, "notify", "acme", "notify.json");
+  const before = readFileSync(file), beforeMode = mode(file);
+  const r = install(x);
+  assert.equal(r.code, 0, r.out);
+  assert.deepEqual(readFileSync(file), before);
+  assert.equal(mode(file), beforeMode);
+  const absent = world(t), missing = join(absent.dataRoot, "notify", "acme", "notify.json");
+  rmSync(missing);
+  const fresh = install(absent);
+  assert.equal(fresh.code, 0, fresh.out);
+  assert.equal(existsSync(missing), false);
+});

packages/cli/tests/case2-unit.test.mjs

@@ -626,6 +626,9 @@ function host(t, { roles = {}, vars = {}, keyFile = `ZAI_API_KEY=${FIXTURE_KEY}\
   script(join(bin, "id"), `if [ "$1" = -G ]; then echo "\${CASE2_TEST_GROUPS:-${GID}}"; else exec /usr/bin/id "$@"; fi`);
   script(join(bin, "node"), `if [ "$1" = --version ]; then echo "\${CASE2_TEST_NODE:-v24.3.0}"; exit 0; fi\nexec '${process.execPath}' "$@"`);
   script(join(bin, "bwrap"), `exit "\${CASE2_TEST_BWRAP:-0}"`);
+  const notify = join(home, ".mosaic-dev", "notify", "acme");
+  mkdirSync(notify, { recursive: true, mode: 0o700 });
+  writeFileSync(join(notify, "notify.json"), '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
   return { root, home, configDir, config, secrets, units, sys, bin, dataRoot: join(home, ".mosaic-dev") };
 }
 
@@ -872,3 +875,68 @@ test("inside a session's sandbox a bind below 1024 fails with EACCES, and a bind
   assert.equal(bindIn(LOW_PORT), "EACCES");
   assert.equal(bindIn(high), "bound");
 });
+
+test("Vikunja 614 factory: scoped @anthropic-ai Claude path renders and passes installed read-back", (t) => {
+  const h = hub(t);
+  const claude = script(join(h.root, "opt", "claude-pin", "node_modules", "@anthropic-ai", "claude-code", "bin", "claude.exe"), "exit 0");
+  // The suite runs unprivileged. Model root ownership for this regular executable
+  // and its ancestors only; file type/executable checks and both unit readers are real.
+  const ancestors = [];
+  for (let p = claude; p !== "/"; p = dirname(p)) ancestors.push(p);
+  script(join(h.bin, "stat"), `if [ "$1" = -c ] && [ "$3" = -- ]; then
+  case "$4" in ${ancestors.map((p) => JSON.stringify(p)).join("|")})
+    case "$2" in %u) echo 0; exit ;; %a) echo 755; exit ;; esac ;;
+  esac
+fi
+exec /usr/bin/stat "$@"`);
+  const first = unit(h, { profile: "factory", extra: ["--claude", claude] });
+  assert.equal(first.code, 0, first.out + first.err);
+  assert.ok(lines(read(busFile(h)), "Environment").includes(`MOSAIC_CLAUDE_BIN=${claude}`));
+  const again = unit(h, { profile: "factory", copy: COPY_B, extra: ["--claude", claude] });
+  assert.equal(again.code, 0, again.out + again.err);
+  assert.ok(lines(read(busFile(h)), "Environment").includes(`MOSAIC_CLAUDE_BIN=${claude}`));
+  assert.deepEqual(lines(read(busFile(h)), "WorkingDirectory"), [copyDir(h, COPY_B)]);
+});
+
+test("Vikunja 614 factory: plain paths still refuse every named unsafe character", (t) => {
+  const h = hub(t);
+  for (const char of [" ", "%", "$", "\"", "'", "\\", "&", "|"]) {
+    refuses(unit(h, { profile: "factory", extra: ["--claude", `/opt/claude${char}bin`] }), /--claude contains a character the unit cannot carry/);
+  }
+});
+
+test("Vikunja 614 precheck: explicit null and named notifier decisions pass", (t) => {
+  for (const binding of [null, "host-notify"]) {
+    const x = host(t);
+    const dir = join(x.dataRoot, "notify", "acme");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(dir, "notify.json"), JSON.stringify({ notifyVersion: 1, binding }), { mode: 0o600 });
+    const r = precheck(x);
+    assert.equal(r.code, 0, r.out);
+    assert.ok(r.out.includes(`ok      notifier config ${dir}/notify.json validates (directory 0700, file 0600)`), r.out);
+  }
+});
+
+test("Vikunja 614 precheck: notifier config refuses missing, public, malformed and extra-key decisions", (t) => {
+  for (const fault of ["missing", "mode", "directory", "extra", "json", "binding", "version", "symlink"]) {
+    const x = host(t);
+    const dir = join(x.dataRoot, "notify", "acme"), file = join(dir, "notify.json");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(file, '{"notifyVersion":1,"binding":null}\n', { mode: 0o600 });
+    if (fault === "missing") rmSync(file);
+    if (fault === "mode") chmodSync(file, 0o644);
+    if (fault === "directory") chmodSync(dir, 0o755);
+    if (fault === "extra") writeFileSync(file, '{"notifyVersion":1,"binding":null,"extra":true}\n');
+    if (fault === "json") writeFileSync(file, '{bad json\n');
+    if (fault === "binding") writeFileSync(file, '{"notifyVersion":1,"binding":"bad binding"}\n');
+    if (fault === "version") writeFileSync(file, '{"notifyVersion":2,"binding":null}\n');
+    if (fault === "symlink") {
+      const target = join(dir, "target.json");
+      writeFileSync(target, readFileSync(file), { mode: 0o600 });
+      rmSync(file); symlinkSync(target, file);
+    }
+    const r = precheck(x);
+    assert.equal(r.code, 1, `${fault}: ${r.out}`);
+    assert.match(r.out, /REFUSED notifier config:/, `${fault}: ${r.out}`);
+  }
+});

packages/cli/tests/github-grants.test.mjs

@@ -1,42 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { main } from '../src/cli.mjs';
-import { io } from './helpers.mjs';
-const setup = () => {
-  const calls = [];
-  const transport = () => async (verb, args) => { calls.push({ verb, args }); return { grants: [], serviceLeft: [], admin: null }; };
-  return { calls, deps: { system: { dataRoot: '/nonexistent' }, transport, testerTransport: transport } };
-};
-
-test('GitHub admin set uses separate identity flags and bounded stdin', async () => {
-  const f = setup(), x = io(); const fakeKey = '-----BEGIN PRIVATE KEY-----\nfake-only-not-a-real-key\n-----END PRIVATE KEY-----\n';
-  x.stdin.end(fakeKey);
-  await main(['grants', 'admin', 'set', 'github', '--business', 'demo', '--url', 'https://api.github.com',
-    '--app-id', '10', '--installation-id', '20', '--account-id', '30', '--rotate-by', '2099-01-01'], x, f.deps);
-  assert.equal(f.calls.length, 1);
-  assert.deepEqual(f.calls[0], { verb: 'grants.admin.set', args: { service: 'github', url: 'https://api.github.com',
-    appId: 10, installationId: 20, accountId: 30, rotateBy: '2099-01-01', token: fakeKey } });
-  assert.ok(!x.out.text.includes(fakeKey) && !x.err.text.includes(fakeKey));
-});
-
-test('GitHub rotate replaces the human-supplied key rather than Gitea token minting', async () => {
-  const f = setup(), x = io(); x.stdin.end('fake-only-key-value');
-  await main(['grants', 'admin', 'rotate', 'github', '--business', 'demo', '--rotate-by', '2099-01-01'], x, f.deps);
-  assert.equal(f.calls[0].verb, 'grants.admin.rotate');
-  assert.equal(f.calls[0].args.service, 'github');
-  assert.equal(f.calls[0].args.rotateBy, '2099-01-01');
-});
-
-test('GitHub management dispatch and malformed flag shapes', async () => {
-  const f = setup();
-  await main(['grants', 'status', 'github', '--business', 'demo', '--json'], io(), f.deps);
-  await main(['grants', 'revoke', 'coder', 'github', '--business', 'demo', '--reason', 'test'], io(), f.deps);
-  await main(['grants', 'sweep', 'github', '--business', 'demo'], io(), f.deps);
-  assert.deepEqual(f.calls.map((c) => c.verb), ['grants.status', 'grants.revoke', 'grants.sweep']);
-  for (const args of [
-    ['admin', 'set', 'github', '--account', '20'], ['admin', 'rotate', 'github', '--finish'],
-    ['status', 'github', '--app-id', '10'], ['admin', 'remove', 'github', '--tester'],
-    ['admin', 'set', 'github', '--url', 'https://api.github.com', '--app-id', 'NaN', '--installation-id', '20', '--account-id', '30', '--rotate-by', '2099-01-01'],
-  ]) await assert.rejects(main(['grants', ...args, '--business', 'demo'], io(), f.deps), (e) => e.exitCode === 4);
-  assert.equal(f.calls.length, 3);
-});

packages/cli/tests/stack-copy.test.mjs

@@ -142,7 +142,7 @@ test('real pinned install loads bus and Console; same-copy mosaic talk passes pr
  host.stdout.on('data',c=>hostOut+=c);host.stderr.on('data',c=>hostErr+=c);
  try{await until(()=>hostOut.includes('bus host up')||host.exitCode!==null);assert.match(hostOut,/bus host up/,hostErr);}
  finally{if(host.exitCode===null&&host.signalCode===null){const done=once(host,'close');host.kill('SIGTERM');await done;}}
- const web=spawn(process.execPath,[join(root,'packages/webui/src/cli.mjs'),'serve','--port','0','--business','acme'],{env,stdio:['ignore','pipe','pipe']});let webOut='',webErr='';
+ const web=spawn(process.execPath,[join(root,'packages/webui/src/cli.mjs'),'serve','--port','0','--business','acme','--board','http://127.0.0.1:9'],{env,stdio:['ignore','pipe','pipe']});let webOut='',webErr='';
  web.stdout.on('data',c=>webOut+=c);web.stderr.on('data',c=>webErr+=c);
  try{await until(()=>/Mosaic Console: http:/.test(webOut)||web.exitCode!==null);const port=webOut.match(/127\.0\.0\.1:(\d+)/)?.[1];assert.ok(port,webErr);assert.equal((await fetch(`http://127.0.0.1:${port}/healthz`)).status,200);}
  finally{if(web.exitCode===null&&web.signalCode===null){const done=once(web,'close');web.kill();await done;}}
@@ -347,3 +347,25 @@ test('row 232: check --units external reads the system units, the default reads
   rmSync(argv);
  }
 });
+
+test('Vikunja 614: bundle and checkout copy leave an unreadable caller directory before find',t=>{
+ const s=setup(t),cwd=join(s.root,'unreadable');mkdirSync(cwd);
+ const bundle=join(s.root,'release.bundle');git(s.repo,'bundle','create','-q',bundle,'refactor');
+ // Enter while searchable, then reproduce a cwd inherited across a uid drop:
+ // the caller can neither read nor search it. Absolute bundle lookup must work.
+ const enter='cd "$1" && chmod 000 . && [ ! -r . ] && [ ! -x . ] && shift && exec "$@"';
+ for(const [name,args] of [['bundle',['copy','--bundle',bundle,s.id]],['checkout',['copy',s.id]]]){
+  const copies=join(s.root,`copies-${name}`);
+  try{
+   const r=spawnSync('/bin/sh',['-c',enter,'stack-copy-cwd',cwd,join(s.repo,'scripts','stack-copy.sh'),...args,'--copies',copies],{env:s.env,encoding:'utf8',timeout:30000});
+   assert.equal(statSync(cwd).mode&0o555,0,'the inherited cwd is neither readable nor searchable');
+   assert.equal(r.status,0,r.stdout+r.stderr);
+   assert.doesNotMatch(r.stderr,/Failed to (restore initial working|change) directory|Permission denied/);
+   assert.ok(existsSync(join(copies,s.id,'scripts','mosaic')));
+   assert.equal(statSync(join(copies,s.id)).mode&0o777,0o555);
+  }finally{
+   // Restore even after a failed assertion/mutant, before setup's recursive cleanup.
+   chmodSync(cwd,0o700);
+  }
+ }
+});

packages/cli/tests/stack-release.test.mjs

@@ -851,64 +851,6 @@ test('T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-targe
  });
 });
 
-// Row 198 (design item 8, B2; sage-2834 ruling a; sage-2837): --board is dropped for every op, because
-// webui-service.sh install refuses the flag. The reason follows the target's cli.mjs: a target that
-// parses --board is pre-198 (7331 retired); a target that names it only in its refusal runs the board
-// in the Console. The plan names each drop. setCli rewrites a shared copy's cli.mjs and restores it after.
-const BOARD='--board http://127.0.0.1:9';
-const REFUSES_BOARD=`// fixture Console, never run\n// serve accepts '--tester-port'\nif (flag === '--board') throw new Error('--board retired: the board runs in the Console (row 198)');\n`;
-const PARSES_BOARD=`// fixture Console, never run\n// serve accepts '--tester-port'\nelse if (flag === '--board') board = value;\n`;
-const setCli=(t,id,text)=>{const f=join(COPIES,id,'packages/webui/src/cli.mjs'),orig=readFileSync(f,'utf8');chmodSync(f,0o644);writeFileSync(f,text);t.after(()=>{chmodSync(f,0o644);writeFileSync(f,orig);chmodSync(f,0o444)})};
-const withBoard=(e)=>{const q=pointer(e);q.console=[...q.console,...BOARD.split(' ')];writeFileSync(e.pointer,JSON.stringify(q)+'\n')};
-
-test('row 198 item 8 (M12): a re-pin plan drops a --board the target Console does not parse, and its Console line has none',async(t)=>{
- const e=await mk(t);await seed(e);setCli(t,C1,REFUSES_BOARD);withBoard(e);
- const before=fp(e),n=calls(e).length,logs=logLines(e).length;
- const r=await run(e,'activate',C1,'acme','--plan');
- assert.equal(r.code,0,r.out+r.err);assert.equal(r.err,'');
- assert.ok(r.out.split('\n').includes(`drop ${BOARD}; the target Console does not parse it, so the board runs in the Console`),r.out);
- assert.doesNotMatch(r.out.split('\n').find((l)=>l.startsWith('Console: ')),/--board/);
- assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
-});
-
-test('row 198 item 8 (M13, activate): an activate to a pre-198 copy that parses --board drops the unit\'s --board, and the install and unit have none',async(t)=>{
- // Sage sage-2837: a target that parses --board is pre-198, and webui-service.sh install still refuses the flag.
- // The unit carries the flag before, as a pre-198 Console does. The plan is checked first, then a real run.
- const e=await mk(t);await seed(e);setCli(t,C1,PARSES_BOARD);
- edit(join(e.units,CON),'--business acme',`--business acme ${BOARD}`);withBoard(e);
- const before=fp(e),n=calls(e).length,logs=logLines(e).length;
- let r=await run(e,'activate',C1,'acme','--plan');
- assert.equal(r.code,0,r.out+r.err);assert.equal(r.err,'');
- const lines=r.out.split('\n');
- assert.ok(lines.includes(`drop ${BOARD}; the 7331 board is retired, so this Console runs without the board`),r.out);
- assert.doesNotMatch(lines.find((l)=>l.startsWith('Console: ')),/--board/);
- assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
- r=await run(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
- assert.ok(r.out.split('\n').includes(`drop ${BOARD}; the 7331 board is retired, so this Console runs without the board`),r.out);
- assert.equal(pointer(e).copy,C1);assert.equal(pointer(e).console.includes('--board'),false);
- assert.doesNotMatch(consoleText(e),/--board/);
-});
-
-test('row 198 item 8 (M13, rollback): a rollback drops the unit\'s --board even for a copy that parses it, and the install and unit have none',async(t)=>{
- // Sage sage-2834 ruling (a), sage-2837: webui-service.sh install refuses --board, so a rollback drops it and
- // names the drop with the retired-board reason. The activation runs without --board; the unit then carries it,
- // and the rollback target B parses it, which must not keep the flag. The plan is checked first, then a real run.
- const e=await mk(t);setCli(t,B,PARSES_BOARD);
- await seed(e);
- let r=await run(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
- edit(join(e.units,CON),'--business acme',`--business acme ${BOARD}`);withBoard(e);
- const before=fp(e);
- r=await run(e,'rollback','acme','--plan');assert.equal(r.code,0,r.out+r.err);
- const lines=r.out.split('\n');
- assert.ok(lines.includes(`drop ${BOARD}; the 7331 board is retired, so this Console runs without the board`),r.out);
- assert.doesNotMatch(lines.find((l)=>l.startsWith('Console: ')),/--board/);
- assert.deepEqual(fp(e),before);
- r=await run(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
- assert.equal(pointer(e).copy,B);assert.equal(pointer(e).console.includes('--board'),false);
- assert.doesNotMatch(consoleText(e),/--board/);
- assert.match(stepText(e),/drop --board http:\/\/127\.0\.0\.1:9; the 7331 board is retired/);
-});
-
 // Row 181 (#1679, P19 390): COUNTED and STORE_JS as the script under test has them. The fixture
 // tables carry only seq and at, which is all the count reads.
 const srText=readFileSync(SR,'utf8');

packages/control-board/README.md

@@ -100,22 +100,14 @@ service transitions or authorize replacing a running board.
 
 ```
 node src/cli.mjs scan  [--config PATH] [--repo PATH] [--fleet PATH|none] [--liveness tmux|assume-alive] [--print]
+node src/cli.mjs serve [same flags] [--port N] [--host 127.0.0.1]
 ```
 
-`scan` runs once and writes the status files.
-
-`serve` is retired (row 198). It exits 2 with a pointer to the Console. The
-board now runs in-process inside the Console (`packages/webui`), behind the
-Console's own sign-in. Start it with:
-
-```
-node packages/webui/src/cli.mjs serve
-```
-
-Then open `http://127.0.0.1:7330/` in a browser. The board's routes are
-`/api/board` and the two writes `/api/seen` and `/api/reply`, which need
-`--send` on the public name. The page fetches `/api/board` every 10 seconds;
-each fetch re-runs the scan, so the page is never staler than that timer.
+`scan` runs once and writes the status files. `serve` starts a small local
+web server: open `http://127.0.0.1:7331/` in a browser. The page fetches
+`/api/board` every 10 seconds; each fetch re-runs the scan, so the page is
+never staler than that timer. There is no login, so the server refuses to
+bind to anything but a loopback address.
 
 - `--config PATH` — path to the system config file. Defaults to
   `~/.config/mosaic-dev/config.json`. This file must exist and name an
@@ -132,8 +124,11 @@ each fetch re-runs the scan, so the page is never staler than that timer.
   first column is `*` for a row waiting on you, `s` for a seen row, or blank
   otherwise. The final summary line reads
   `board: <dir> (N sessions, N waiting on you, N seen)`.
-Routes (row 198: served by the Console, `packages/webui`, not by a board port;
-the bodies and refusals below are unchanged):
+- `--port N` — (`serve`) port to listen on. Default `7331`; `0` picks a free port.
+- `--host ADDR` — (`serve`) loopback address to bind. Default `127.0.0.1`.
+  Any non-loopback address is refused.
+
+Routes served:
 
 - `GET /` — the page.
 - `GET /api/board` — rescan, returns `index.json`.
@@ -175,7 +170,7 @@ so the seat's reaction shows without waiting for the next tick.
 
 ## Exit codes
 
-- `0` — scan completed and status files were written.
+- `0` — scan completed and status files were written, or the server stopped cleanly.
 - `2` — refused: bad config, missing/invalid `dataRoot`, or bad arguments.
   The message on stderr says why.
 

packages/control-board/src/board.mjs

@@ -1,78 +0,0 @@
-// The control board's routes as plain async functions (row 198). The Console
-// (packages/webui) calls these in-process behind its own auth. Nothing here
-// opens a socket or binds a port: the 7331 writer is retired.
-//
-// Every method returns a promise and uses the async child-process paths (B1), so
-// a slow tmux call never blocks the Console's event loop.
-//
-// Write counter (decision 10, Webby N1). A scan must not serve a pre-write view.
-// index() joins an in-flight scan only when that scan started at the current
-// counter value. markSeen() and reply() bump the counter and never join a scan.
-
-import { scanAsync, markSeen as writeMark, loadRegistrations, runAsync } from "./scan.mjs";
-import { replyToRowAsync, conversationResponse, DEFAULT_AGENT_SEND } from "./serve.mjs";
-import { createReader, rootsFromSpecs } from "../../conversation/src/reader.mjs";
-
-// onEvent(name) reports "write", "bump", "send" and "scan" in order. Production
-// passes nothing; the order test (board.test.mjs) reads it to pin the sequence.
-export function createBoard({ specs, boardDir, seatsDir = null, discordDataRoot = null, isAlive, isPidAlive, now = () => new Date(), agentSend = DEFAULT_AGENT_SEND, exec = runAsync, conversationReader = null, host, onEvent = () => {} }) {
-  let writes = 0;
-  let inflight = null;
-  const scanFresh = () => {
-    onEvent("scan");
-    return scanAsync(specs, { isAlive, isPidAlive, exec, boardDir, now, seatsDir, discordDataRoot });
-  };
-  const reader = conversationReader ?? createReader({ roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations) });
-
-  // Joins a scan only when it started after the last write and is still running
-  // (see header). A settled scan, fulfilled or rejected, is cleared so the next
-  // index() starts a fresh one; the clear is on both branches, so a rejection is
-  // not left unhandled.
-  function index() {
-    if (inflight && inflight.generation === writes) return inflight.promise;
-    const generation = writes;
-    const promise = scanFresh();
-    const current = { generation, promise };
-    inflight = current;
-    const clear = () => { if (inflight === current) inflight = null; };
-    promise.then(clear, clear);
-    return promise;
-  }
-
-  // Pinned order (Webby, Mos mos-1052): write, then bump the counter, then scan.
-  // The scan sees the mark, and no scan started before the bump can be joined.
-  async function markSeenRoute(body) {
-    writeMark(boardDir, { project: body.project, agent: body.agent, lastActivity: body.lastActivity, seen: body.seen ?? true });
-    onEvent("write");
-    writes++;
-    onEvent("bump");
-    return scanFresh();
-  }
-
-  // Pinned order: send, then bump the counter, then scan. The planning scan
-  // before the send is a read and is not part of the pinned sequence. A refusal
-  // runs no send, so it writes nothing: no bump and no post-send scan. Only a
-  // send that reached the exec runs the rest. The post-send scan rewrites the
-  // derived board files, so a reply's effects reach them the same way a mark does.
-  async function reply(body) {
-    const planned = await scanFresh();
-    let sent = false;
-    const sendExec = (...args) => {
-      sent = true;
-      return exec(...args);
-    };
-    const out = await replyToRowAsync({ index: planned, key: body.agent, text: body.text, agentSend, exec: sendExec, now, host });
-    if (!sent) return out;
-    onEvent("send");
-    writes++;
-    onEvent("bump");
-    await scanFresh();
-    return out;
-  }
-
-  function conversation(url) {
-    return conversationResponse(reader, url);
-  }
-
-  return { index, markSeen: markSeenRoute, reply, conversation };
-}

packages/control-board/src/cli.mjs

@@ -1,18 +1,17 @@
 #!/usr/bin/env node
 // Usage:
 //   node packages/control-board/src/cli.mjs scan  [--config PATH] [--repo PATH] [--fleet PATH|none] [--liveness tmux|assume-alive] [--print]
-// `serve` is retired (row 198): the board runs in-process inside the Console.
+//   node packages/control-board/src/cli.mjs serve [same flags] [--port N] [--host 127.0.0.1]
 // Exit 0 on success, 2 on a config refusal or bad usage.
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { loadConfig, defaultConfigPath, discoverRepoAgents, discoverFleetAgents, scan, tmuxInspect, ConfigError } from "./scan.mjs";
+import { startServer } from "./serve.mjs";
 
-const USAGE = "usage: mosaic-board scan [--config PATH] [--repo PATH] [--fleet PATH|none] [--liveness tmux|assume-alive] [--print]";
-const RETIRED = "the control board no longer serves a port (retired on 7331, row 198). Open the board in the Console (webui, port 7332) instead.";
+const USAGE = "usage: mosaic-board scan|serve [--config PATH] [--repo PATH] [--fleet PATH|none] [--liveness tmux|assume-alive] [--print] [--port N] [--host 127.0.0.1]";
 
 function parseArgs(argv) {
-  if (argv[0] === "serve") throw new ConfigError(RETIRED);
-  const opts = { command: argv[0], config: defaultConfigPath(), repo: process.cwd(), fleet: join(homedir(), ".mosaic", "fleet", "agents"), liveness: "tmux", print: false };
+  const opts = { command: argv[0], config: defaultConfigPath(), repo: process.cwd(), fleet: join(homedir(), ".mosaic", "fleet", "agents"), liveness: "tmux", print: false, port: 7331, host: "127.0.0.1" };
   for (let i = 1; i < argv.length; i++) {
     const a = argv[i];
     const next = () => {
@@ -24,9 +23,13 @@ function parseArgs(argv) {
     else if (a === "--fleet") opts.fleet = next();
     else if (a === "--liveness") opts.liveness = next();
     else if (a === "--print") opts.print = true;
+    else if (a === "--port") {
+      opts.port = Number(next());
+      if (!Number.isInteger(opts.port) || opts.port < 0 || opts.port > 65535) throw new ConfigError("--port must be an integer 0..65535");
+    } else if (a === "--host") opts.host = next();
     else throw new ConfigError(`unknown argument: ${a}`);
   }
-  if (opts.command !== "scan") throw new ConfigError(USAGE);
+  if (opts.command !== "scan" && opts.command !== "serve") throw new ConfigError(USAGE);
   if (!["tmux", "assume-alive"].includes(opts.liveness)) throw new ConfigError(`unknown liveness mode: ${opts.liveness}`);
   return opts;
 }
@@ -38,6 +41,15 @@ async function main() {
   const isAlive = opts.liveness === "tmux" ? tmuxInspect : () => true;
   const boardDir = join(dataRoot, "board");
   const seatsDir = join(dataRoot, "seats");
+  if (opts.command === "serve") {
+    const server = await startServer({ host: opts.host, port: opts.port, specs, boardDir, isAlive, seatsDir, discordDataRoot: dataRoot });
+    const addr = server.address();
+    process.stdout.write(`control board: http://${opts.host}:${addr.port}/  (${specs.length} agents; board files in ${boardDir}; Ctrl-C to stop)\n`);
+    const stop = () => server.close(() => process.exit(0));
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+    return;
+  }
   const index = scan(specs, { boardDir, isAlive, seatsDir, discordDataRoot: dataRoot });
   for (const line of index.discoveryErrors) process.stderr.write(`${line}\n`);
   for (const line of index.registrationErrors) process.stderr.write(`registration skipped: ${line}\n`);

packages/control-board/src/page.html

@@ -0,0 +1,605 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Control board</title>
+<style>
+  :root{
+    --canvas:#f4f6f8;--surface:#fff;--raised:#e9edf1;--text:#16202a;--muted:#5a6774;
+    --line:#e2e7ec;--action:#1f5f8b;--onAction:#fff;--accent:#c96a2b;
+    --success:#2e7d4f;--warning:#b26a00;--danger:#b3261e;
+    --font:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+    --mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace;
+    --radius:8px;--radius-lg:14px;
+  }
+  @media (prefers-color-scheme: dark){
+    :root{
+      --canvas:#11161c;--surface:#182029;--raised:#1f2833;--text:#e7edf3;--muted:#94a3b0;
+      --line:#2a343f;--action:#6ba6d6;--onAction:#0b1116;--accent:#e08a4c;
+      --success:#57b586;--warning:#e0a63c;--danger:#e58077;
+    }
+  }
+  *,*::before,*::after{box-sizing:border-box}
+  html{font-family:var(--font);background:var(--canvas);color:var(--text);line-height:1.45}
+  body{margin:0 auto;max-width:1100px;padding:16px}
+  h1,h2,h3{margin:0 0 .4em;line-height:1.2;font-weight:600}
+  h1{font-size:1.5rem}h2{font-size:1.1rem;margin-top:1.4em}h3{font-size:.95rem}
+  :focus-visible{outline:3px solid var(--action);outline-offset:2px;border-radius:4px}
+  .page-head{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:8px 16px}
+  .head-controls{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+  .status-line{margin:0;color:var(--muted);font-size:.9rem}
+  .btn{font:inherit;font-weight:600;font-size:.85rem;min-height:34px;padding:6px 12px;border-radius:var(--radius);
+    border:1px solid var(--line);background:var(--surface);color:var(--text);cursor:pointer}
+  .btn:hover{background:var(--raised)}
+  .error-banner{margin:12px 0;padding:10px 14px;border-radius:var(--radius);border:1px solid var(--danger);
+    background:color-mix(in srgb,var(--danger) 10%,var(--surface));color:var(--danger);font-size:.9rem}
+  .empty{color:var(--muted);font-style:italic}
+  #seenDetails summary{cursor:pointer;list-style:none;display:flex;align-items:center;gap:8px}
+  #seenDetails summary::-webkit-details-marker{display:none}
+  #seenDetails summary::before{content:"\25B8";color:var(--muted);font-size:.9em}
+  #seenDetails[open] summary::before{content:"\25BE"}
+  #seenDetails summary h2{display:inline;margin:0}
+  .table-wrap{overflow-x:auto;border:1px solid var(--line);border-radius:var(--radius-lg);background:var(--surface)}
+  table{width:100%;border-collapse:collapse;font-size:.88rem}
+  th,td{text-align:left;padding:8px 10px;border-bottom:1px solid var(--line);vertical-align:top}
+  th{font-size:.72rem;text-transform:uppercase;letter-spacing:.03em;color:var(--muted);font-weight:600;white-space:nowrap}
+  tbody tr:last-child td{border-bottom:none}
+  tr.is-offline{opacity:.55}
+  .badge{display:inline-flex;align-items:center;gap:5px;font-size:.76rem;font-weight:600;padding:2px 9px;
+    border-radius:99px;border:1px solid transparent;white-space:nowrap}
+  .badge::before{content:"";width:6px;height:6px;border-radius:50%;background:currentColor}
+  .badge-ok{color:var(--success);background:color-mix(in srgb,var(--success) 12%,var(--surface))}
+  .badge-warn{color:var(--warning);background:color-mix(in srgb,var(--warning) 12%,var(--surface))}
+  .badge-danger{color:var(--danger);background:color-mix(in srgb,var(--danger) 12%,var(--surface))}
+  .badge-muted{color:var(--muted);background:var(--raised)}
+  .badge-accent{color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,var(--surface))}
+  .row-toggle{font:inherit;font-weight:600;background:none;border:0;padding:2px 0;color:var(--action);
+    cursor:pointer;text-align:left}
+  .row-toggle:hover{text-decoration:underline}
+  .seen-toggle{font:inherit;font-size:.76rem;background:none;border:1px solid var(--border);border-radius:6px;
+    padding:1px 8px;color:var(--action);cursor:pointer;margin-left:6px;vertical-align:middle}
+  .seen-toggle:hover{border-color:var(--action)}
+  .seen-tag{font-size:.72rem;color:var(--muted);margin-left:6px;vertical-align:middle}
+  .msg-error{color:var(--danger)}
+  .msg-text,.msg-error{display:block;max-width:36ch;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .relaunch-notice{display:block;max-width:36ch;overflow-wrap:anywhere;white-space:normal}
+  .model{display:block;color:var(--muted);font-size:.75em;white-space:nowrap}
+  .task-text{display:block;max-width:28ch;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .unknown{color:var(--muted);font-style:italic}
+  .reply-form{display:flex;gap:.4em;align-items:center;max-width:60ch}
+  .reply-form input{flex:1;min-width:12ch;font:inherit;padding:.2em .4em}
+  .reply-receipt{display:block;margin-top:.3em;font-size:.85em}
+  .reply-ok{color:var(--muted)}
+  .source{color:var(--muted);font-size:.75em;margin-left:.35em;white-space:nowrap}
+  .set-by{color:var(--muted);font-size:.75em;margin-left:.35em;white-space:nowrap}
+  .detail-row td{background:var(--raised)}
+  .detail-list{display:grid;grid-template-columns:auto 1fr;gap:4px 14px;margin:0;font-size:.85rem;font-family:var(--mono)}
+  .detail-list dt{color:var(--muted);font-family:var(--font)}
+  .detail-list dd{margin:0;overflow-wrap:anywhere}
+  .project-group{margin-bottom:20px}
+  .project-group-head{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:8px}
+  .group-toggles{display:flex;flex-wrap:wrap;gap:14px}
+  .project-group-head label{font-size:.85rem;color:var(--muted);display:flex;align-items:center;gap:6px}
+  .offline-note{margin:6px 0 0;font-size:.82rem;color:var(--muted)}
+  .page-footer{margin-top:24px;padding-top:12px;border-top:1px solid var(--line);color:var(--muted);font-size:.85rem}
+</style>
+</head>
+<body>
+<header class="page-head">
+  <h1>Control board</h1>
+  <div class="head-controls">
+    <p id="headerStatus" class="status-line" aria-live="polite">Updated never · next refresh in 10s</p>
+    <button id="refreshBtn" class="btn" type="button">Refresh</button>
+    <button id="pauseBtn" class="btn" type="button" aria-pressed="false">Pause</button>
+  </div>
+</header>
+<div id="errorBanner" class="error-banner" role="alert" hidden></div>
+<main id="main">
+  <section aria-labelledby="waiting-h">
+    <h2 id="waiting-h">Waiting on you</h2>
+    <div id="waitingBody"></div>
+  </section>
+  <section aria-labelledby="seen-h">
+    <details id="seenDetails">
+      <summary><h2 id="seen-h">Seen</h2></summary>
+      <div id="seenBody"></div>
+    </details>
+  </section>
+  <section aria-labelledby="projects-h">
+    <h2 id="projects-h">By project</h2>
+    <div id="projectsBody"></div>
+  </section>
+</main>
+<footer id="footer" class="page-footer"></footer>
+<script>
+(function () {
+  "use strict";
+  var STATES = ["working", "waiting", "error", "offline", "idle", "unknown"];
+  var BADGE_CLASS = { waiting: "badge-warn", error: "badge-danger", working: "badge-ok", offline: "badge-muted", idle: "badge-muted", unknown: "badge-accent" };
+  var REFRESH_MS = 10000;
+
+  var headerStatus = document.getElementById("headerStatus");
+  var refreshBtn = document.getElementById("refreshBtn");
+  var pauseBtn = document.getElementById("pauseBtn");
+  var errorBanner = document.getElementById("errorBanner");
+  var waitingBody = document.getElementById("waitingBody");
+  var seenBody = document.getElementById("seenBody");
+  var seenHeading = document.getElementById("seen-h");
+  var projectsBody = document.getElementById("projectsBody");
+  var footer = document.getElementById("footer");
+  var main = document.getElementById("main");
+
+  var lastData = null;
+  var paused = false;
+  var fetching = false;
+  var timerId = null;
+  var secondsLeft = REFRESH_MS / 1000;
+  var hideOfflineState = {};
+  var hideSeenState = {};
+  // Open detail panels survive a refresh. Keyed by section, project and agent
+  // because the same agent can appear in both the waiting list and its group.
+  var openDetails = {};
+  var rowIdx = 0;
+
+  function esc(v) {
+    if (v === null || v === undefined) return "";
+    return String(v).replace(/[&<>"']/g, function (c) {
+      return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
+    });
+  }
+
+  function humanAge(s) {
+    if (s === null || s === undefined) return "—";
+    if (s < 60) return s + "s";
+    var m = Math.floor(s / 60);
+    if (m < 60) return m + "m";
+    var h = Math.floor(m / 60);
+    if (h < 24) return h + "h";
+    return Math.floor(h / 24) + "d";
+  }
+
+  function timeAgo(iso) {
+    if (!iso) return "never";
+    var ms = Date.now() - Date.parse(iso);
+    if (Number.isNaN(ms)) return "never";
+    var s = Math.floor(ms / 1000);
+    if (s < 5) return "just now";
+    if (s < 60) return s + "s ago";
+    var m = Math.floor(s / 60);
+    if (m < 60) return m + "m ago";
+    var h = Math.floor(m / 60);
+    if (h < 24) return h + "h ago";
+    return Math.floor(h / 24) + "d ago";
+  }
+
+  function cap(s) { return s.charAt(0).toUpperCase() + s.slice(1); }
+
+  function badge(state) {
+    var cls = BADGE_CLASS[state] || "badge-muted";
+    return '<span class="badge ' + cls + '">' + esc(state) + "</span>";
+  }
+
+  // A "Seen" button on rows that need you; a "seen" tag plus "Unsee" on rows
+  // you have already marked. The mark clears itself when the agent writes again.
+  function seenControl(rec) {
+    var needsYou = rec.state === "waiting" || rec.state === "error";
+    if (!needsYou || !rec.lastActivity) return "";
+    var attrs = ' data-project="' + esc(rec.project) + '" data-agent="' + esc(rec.agent) + '" data-last="' + esc(rec.lastActivity) + '"';
+    if (rec.seen) {
+      return '<span class="seen-tag">seen</span><button type="button" class="seen-toggle" data-seen="false"' + attrs + ' title="Put this row back under Waiting on you">Unsee</button>';
+    }
+    return '<button type="button" class="seen-toggle" data-seen="true"' + attrs + ' title="I have read this; hide it from Waiting on you until the agent writes again">Seen</button>';
+  }
+
+  var SOURCE_LABEL = { "registration": "registered", "first-user-message": "first message", "tmux-pane": "tmux pane", "session-cwd": "session cwd", "workspace-git-root": "git root" };
+  function sourceLabel(source) { return SOURCE_LABEL[source] || source; }
+  function sourceTag(source) { return source ? '<span class="source" title="source: ' + esc(source) + '">' + esc(sourceLabel(source)) + "</span>" : ""; }
+  function fromSource(source) { return source ? " (from " + esc(sourceLabel(source)) + ")" : ""; }
+  // Who set a registered task (#1511): shown only when the task on the row is
+  // the registered one (the scan gives null otherwise). It is what the
+  // caller claimed when it ran `mosaic seat task`, not a verified identity,
+  // and it never changes what the row lets you do.
+  function setByTag(rec) { return rec.taskSetBy ? '<span class="set-by" title="set by (as claimed by the caller, not verified): ' + esc(rec.taskSetBy) + '">set by ' + esc(rec.taskSetBy) + "</span>" : ""; }
+  function setByText(rec) { return rec.taskSetBy ? esc(rec.taskSetBy) + " (as claimed by the caller, not verified)" : "—"; }
+  // The model a seat is running, e.g. "gpt-6-astra" with the provider in the
+  // hover title. modelText() already escapes, so the title takes it as is.
+  // Empty when the log has not named one yet.
+  function modelTag(rec) { return rec.model ? '<span class="model" title="' + modelText(rec) + '">' + esc(rec.model) + "</span>" : ""; }
+  function modelText(rec) { return rec.model ? (rec.provider ? esc(rec.provider) + "/" : "") + esc(rec.model) : "unknown"; }
+  // Reply-from-board (#1505): a box and Send only where the board has an
+  // address, i.e. a live registration naming a tmux session. Receipts and
+  // unsent drafts are kept per row id so a refresh does not lose them.
+  var replyReceipts = {};
+  var replyDrafts = {};
+  function canReply(rec) {
+    if (rec.connector) return false;
+    var reg = rec.registered;
+    return !!(reg && reg.alive !== false && reg.tmux && reg.tmux.session);
+  }
+  function replyReceipt(id) {
+    var r = replyReceipts[id];
+    if (!r) return "";
+    if (r.delivered) return '<span class="reply-receipt reply-ok">delivered ' + esc(r.sentAt) + " to tmux " + esc(r.session) + "</span>";
+    return '<span class="reply-receipt msg-error" style="white-space:normal;max-width:none">failed' + (r.exitCode === null || r.exitCode === undefined ? "" : " (exit " + esc(r.exitCode) + ")") + ": " + esc(r.stderr || r.error || "no output") + "</span>";
+  }
+  function replyControl(rec) {
+    var id = [rec.project, rec.agent].join("/");
+    if (rec.connector) return '<span class="unknown">Board replies disabled for Discord connectors</span>';
+    if (!canReply(rec)) return '<span class="unknown">reply needs a registered seat</span>' + replyReceipt(id);
+    return '<form class="reply-form" data-id="' + esc(id) + '">' +
+      '<input type="text" class="reply-text" maxlength="2000" autocomplete="off" aria-label="Reply to ' + esc(rec.agent) + '" placeholder="Reply to ' + esc(rec.agent) + '" value="' + esc(replyDrafts[id] || "") + '">' +
+      '<button type="submit">Send</button></form>' + replyReceipt(id);
+  }
+  function registeredText(reg) {
+    if (!reg) return "no (not started through mosaic launch)";
+    var parts = ["started " + esc(reg.startedAt || "—")];
+    if (reg.updatedAt) parts.push("task updated " + esc(reg.updatedAt));
+    if (reg.harness) parts.push("harness " + esc(reg.harness));
+    if (reg.pid) parts.push("pid " + esc(reg.pid));
+    if (reg.tmux && reg.tmux.session) parts.push("tmux " + esc(reg.tmux.session) + (reg.tmux.socket ? " (socket " + esc(reg.tmux.socket) + ")" : ""));
+    if (reg.layout) parts.push(esc(reg.layout) + " layout");
+    if (reg.alive === false) parts.push("stale: pid " + esc(reg.pid) + " is gone, so the derived values are shown");
+    return parts.join("; ");
+  }
+
+  function relaunchNotice(rec) { return rec.relaunchedAt ? 'relaunched at ' + esc(rec.relaunchedAt) + ', no messages since' : ''; }
+  function buildRowPair(rec, showProject) {
+    var idx = rowIdx++;
+    var key = (showProject ? "waiting:" : "group:") + [rec.project, rec.agent].join("/");
+    var open = !!openDetails[key];
+    var cls = "session-row" + (rec.state === "offline" ? " is-offline" : "");
+    var notice = relaunchNotice(rec);
+    var msg = notice ? '<span class="relaunch-notice">' + notice + '</span>' : rec.state === "error" && rec.lastError
+      ? '<span class="msg-error" title="' + esc(rec.lastError) + '">' + esc(rec.lastError) + "</span>"
+      : '<span class="msg-text" title="' + esc(rec.lastAssistantText || "") + '">' + esc(rec.lastAssistantText || "—") + "</span>";
+    var projectCell = showProject ? "<td>" + esc(rec.project) + "</td>" : "";
+    // Gate A fields: from the seat's registration (mosaic launch), else derived
+    // from the log and tmux, else "unknown". Never guessed. The source tag on
+    // the row says which one is shown.
+    var task = rec.task
+      ? '<span class="task-text" title="' + esc(rec.task) + '">' + esc(rec.task) + "</span>" + sourceTag(rec.taskSource) + setByTag(rec)
+      : '<span class="unknown">unknown</span>';
+    var activeProject = rec.activeProject
+      ? '<span title="' + esc(rec.workspace || "") + '">' + esc(rec.activeProject) + "</span>" + sourceTag(rec.activeProjectSource)
+      : '<span class="unknown" title="' + esc(rec.workspace || "") + '">unknown</span>';
+    var main =
+      '<tr class="' + cls + '">' +
+      projectCell +
+      '<td><button type="button" class="row-toggle" data-idx="' + idx + '" data-key="' + esc(key) + '" aria-expanded="' + (open ? "true" : "false") + '" aria-controls="detail-' + idx + '">' + esc(rec.agent) + "</button>" + modelTag(rec) + "</td>" +
+      "<td>" + badge(rec.state) + (rec.connector ? '<span class="unknown"> · ' + (rec.connector.braked === true ? 'braked (STOP)' : rec.connector.braked === false ? 'not braked' : 'brake unknown') + ' · owner ' + esc(rec.connector.ownerState) + '</span>' : '') + seenControl(rec) + "</td>" +
+      "<td>" + (notice ? '<span class="relaunch-notice">' + notice + '</span>' : esc(humanAge(rec.ageSeconds))) + "</td>" +
+      "<td>" + task + "</td>" +
+      "<td>" + activeProject + "</td>" +
+      "<td>" + msg + "</td>" +
+      "</tr>";
+    var span = showProject ? 7 : 6;
+    var tmux = rec.tmux && rec.tmux.session
+      ? esc(rec.tmux.session) + (rec.tmux.socket ? " (socket " + esc(rec.tmux.socket) + ")" : "")
+      : "—";
+    var detail =
+      '<tr class="detail-row" id="detail-' + idx + '"' + (open ? "" : " hidden") + '><td colspan="' + span + '">' +
+      '<dl class="detail-list">' +
+      "<dt>Session ID</dt><dd>" + esc(rec.sessionId || "—") + "</dd>" +
+      "<dt>Session file</dt><dd>" + esc(rec.sessionFile || "—") + "</dd>" +
+      "<dt>Task</dt><dd>" + (rec.task ? esc(rec.task) : "unknown") + fromSource(rec.taskSource) + "</dd>" +
+      "<dt>Task set by</dt><dd>" + setByText(rec) + "</dd>" +
+      "<dt>Active project</dt><dd>" + (rec.activeProject ? esc(rec.activeProject) : "unknown") + fromSource(rec.activeProjectSource) + "</dd>" +
+      "<dt>Workspace</dt><dd>" + (rec.workspace ? esc(rec.workspace) : "unknown") + fromSource(rec.workspaceSource) + "</dd>" +
+      "<dt>Model</dt><dd>" + modelText(rec) + "</dd>" +
+      "<dt>Registered</dt><dd>" + registeredText(rec.registered) + "</dd>" +
+      "<dt>Reply</dt><dd>" + replyControl(rec) + "</dd>" +
+      "<dt>Session cwd</dt><dd>" + esc(rec.cwd || "—") + "</dd>" +
+      "<dt>Tmux session</dt><dd>" + tmux + "</dd>" +
+      (notice ? "<dt>Current activity</dt><dd>" + notice + "</dd>" : "") +
+      "<dt>" + (notice ? "Historical last activity" : "Last activity") + "</dt><dd>" + esc(rec.lastActivity || "—") + "</dd>" +
+      "<dt>Scanned at</dt><dd>" + esc(rec.scannedAt || "—") + "</dd>" +
+      "<dt>Skipped lines</dt><dd>" + esc(rec.skippedLines) + "</dd>" +
+      "<dt>" + (notice ? "Historical last message" : "Last message") + "</dt><dd>" + esc(rec.lastAssistantText || "—") + "</dd>" +
+      "<dt>" + (notice ? "Historical last error" : "Last error") + "</dt><dd>" + esc(rec.lastError || "—") + "</dd>" +
+      "</dl></td></tr>";
+    return main + detail;
+  }
+
+  // Rows you marked Seen, in one place, so they can be found and put back.
+  // Collapsed by default; the open/closed choice survives a refresh.
+  function renderSeen(data) {
+    var list = (data.sessions || []).filter(function (r) { return r.seen; });
+    list.sort(function (a, b) {
+      var aa = a.ageSeconds === null || a.ageSeconds === undefined ? Infinity : a.ageSeconds;
+      var bb = b.ageSeconds === null || b.ageSeconds === undefined ? Infinity : b.ageSeconds;
+      return aa - bb;
+    });
+    seenHeading.textContent = "Seen (" + list.length + ")";
+    if (list.length === 0) {
+      seenBody.innerHTML = '<p class="empty">Nothing is marked seen. Rows you mark come back here, and return to "Waiting on you" on their own when the agent writes again.</p>';
+      return;
+    }
+    var rows = list.map(function (r) { return buildRowPair(r, true); }).join("");
+    seenBody.innerHTML =
+      '<div class="table-wrap"><table><thead><tr>' +
+      "<th scope=\"col\">Project</th><th scope=\"col\">Agent</th><th scope=\"col\">State</th><th scope=\"col\">Age</th><th scope=\"col\">Task</th><th scope=\"col\">Active project</th><th scope=\"col\">Last message</th>" +
+      "</tr></thead><tbody>" + rows + "</tbody></table></div>";
+  }
+
+  function renderWaiting(data) {
+    var list = (data.sessions || []).filter(function (r) { return r.waitingOnYou; });
+    list.sort(function (a, b) {
+      var ae = a.state === "error" ? 0 : 1, be = b.state === "error" ? 0 : 1;
+      if (ae !== be) return ae - be;
+      var aa = a.ageSeconds === null || a.ageSeconds === undefined ? Infinity : a.ageSeconds;
+      var bb = b.ageSeconds === null || b.ageSeconds === undefined ? Infinity : b.ageSeconds;
+      return aa - bb;
+    });
+    if (list.length === 0) {
+      waitingBody.innerHTML = '<p class="empty">Nothing is waiting on you.</p>';
+      return;
+    }
+    var rows = list.map(function (r) { return buildRowPair(r, true); }).join("");
+    waitingBody.innerHTML =
+      '<div class="table-wrap"><table><thead><tr>' +
+      "<th scope=\"col\">Project</th><th scope=\"col\">Agent</th><th scope=\"col\">State</th><th scope=\"col\">Age</th><th scope=\"col\">Task</th><th scope=\"col\">Active project</th><th scope=\"col\">Last message</th>" +
+      "</tr></thead><tbody>" + rows + "</tbody></table></div>";
+  }
+
+  function projectOrder(a, b) {
+    if (a === "fleet" && b === "fleet") return 0;
+    if (a === "fleet") return 1;
+    if (b === "fleet") return -1;
+    return a.localeCompare(b);
+  }
+
+  function renderProjects(data) {
+    var sessions = data.sessions || [];
+    var byProject = {};
+    sessions.forEach(function (r) {
+      (byProject[r.project] = byProject[r.project] || []).push(r);
+    });
+    var projects = Object.keys(byProject).sort(projectOrder);
+    if (projects.length === 0) {
+      projectsBody.innerHTML = '<p class="empty">No agents are configured.</p>';
+      return;
+    }
+    projectsBody.innerHTML = projects.map(function (project) {
+      var group = byProject[project].slice().sort(function (a, b) { return a.agent.localeCompare(b.agent); });
+      if (!(project in hideOfflineState)) hideOfflineState[project] = true;
+      if (!(project in hideSeenState)) hideSeenState[project] = true;
+      var hideOffline = hideOfflineState[project];
+      var hideSeen = hideSeenState[project];
+      var offlineHidden = 0, seenHidden = 0;
+      var visible = group.filter(function (r) {
+        if (hideOffline && r.state === "offline") { offlineHidden += 1; return false; }
+        if (hideSeen && r.seen) { seenHidden += 1; return false; }
+        return true;
+      });
+      var rows = visible.map(function (r) { return buildRowPair(r, false); }).join("");
+      var noteParts = [];
+      if (offlineHidden > 0) noteParts.push(offlineHidden + " offline hidden");
+      if (seenHidden > 0) noteParts.push(seenHidden + " seen hidden");
+      var note = noteParts.length > 0 ? '<p class="offline-note">' + noteParts.join(" \u00b7 ") + "</p>" : "";
+      var headCount = visible.length < group.length ? visible.length + " of " + group.length : String(group.length);
+      return (
+        '<div class="project-group">' +
+        '<div class="project-group-head"><h3>' + esc(project) + ' <span>(' + headCount + ")</span></h3>" +
+        '<div class="group-toggles">' +
+        '<label><input type="checkbox" class="hide-offline-toggle" data-project="' + esc(project) + '" ' + (hideOffline ? "checked" : "") + "> Hide offline</label>" +
+        '<label><input type="checkbox" class="hide-seen-toggle" data-project="' + esc(project) + '" ' + (hideSeen ? "checked" : "") + "> Hide seen</label>" +
+        "</div></div>" +
+        '<div class="table-wrap"><table><thead><tr>' +
+        "<th scope=\"col\">Agent</th><th scope=\"col\">State</th><th scope=\"col\">Age</th><th scope=\"col\">Task</th><th scope=\"col\">Active project</th><th scope=\"col\">Last message</th>" +
+        "</tr></thead><tbody>" + (rows || '<tr><td colspan="6" class="empty">No agents.</td></tr>') + "</tbody></table></div>" +
+        note + "</div>"
+      );
+    }).join("");
+  }
+
+
+  function renderFooter(data) {
+    var counts = data.counts || {};
+    var parts = STATES.map(function (s) { return cap(s) + " " + (counts[s] || 0); }).join(" · ");
+    parts += " · Seen " + ((data.seen || []).length);
+    footer.innerHTML = "<p>" + esc(parts) + " — generated " + esc(timeAgo(data.generatedAt)) + " (" + esc(data.generatedAt || "") + ")</p>";
+  }
+
+  // A refresh rebuilds the tables. If Jason is typing a reply, put the
+  // caret back where it was so the periodic refresh does not steal it.
+  function withReplyFocus(render) {
+    var active = document.activeElement;
+    var focus = active && active.classList && active.classList.contains("reply-text")
+      ? { id: active.form.dataset.id, pos: active.selectionStart }
+      : null;
+    render();
+    if (!focus) return;
+    var forms = main.querySelectorAll('.reply-form[data-id="' + focus.id.replace(/"/g, '\\"') + '"]');
+    var input = forms.length ? forms[0].querySelector(".reply-text") : null;
+    if (!input) return;
+    input.focus();
+    try { input.setSelectionRange(focus.pos, focus.pos); } catch (e) {}
+  }
+
+  function renderAll() {
+    withReplyFocus(function () {
+      rowIdx = 0;
+      renderWaiting(lastData);
+      renderSeen(lastData);
+      renderProjects(lastData);
+      renderFooter(lastData);
+    });
+  }
+
+  function renderHeaderStatus() {
+    var updated = lastData ? timeAgo(lastData.generatedAt) : "never";
+    var refresh = paused ? "auto-refresh paused" : "next refresh in " + secondsLeft + "s";
+    headerStatus.textContent = "Updated " + updated + " · " + refresh;
+  }
+
+  function showError(msg) {
+    errorBanner.hidden = false;
+    errorBanner.textContent = "Could not refresh: " + msg + ". Showing the last known data.";
+  }
+
+  function hideError() {
+    errorBanner.hidden = true;
+    errorBanner.textContent = "";
+  }
+
+  function scheduleNextFetch() {
+    clearTimeout(timerId);
+    if (paused) return;
+    secondsLeft = REFRESH_MS / 1000;
+    timerId = setTimeout(runFetch, REFRESH_MS);
+  }
+
+  function runFetch() {
+    if (fetching) return;
+    fetching = true;
+    fetch("/api/board", { cache: "no-store" })
+      .then(function (res) {
+        return res.json().catch(function () {
+          throw new Error("the server sent a response that was not valid JSON");
+        }).then(function (body) {
+          if (!res.ok) throw new Error((body && body.error) || "HTTP " + res.status);
+          return body;
+        });
+      })
+      .then(function (body) {
+        lastData = body;
+        hideError();
+        renderAll();
+      })
+      .catch(function (err) {
+        console.error("control board refresh failed", err);
+        showError(err && err.message ? err.message : "unknown error");
+      })
+      .then(function () {
+        fetching = false;
+        renderHeaderStatus();
+        scheduleNextFetch();
+      });
+  }
+
+  function setPaused(p) {
+    paused = p;
+    pauseBtn.textContent = paused ? "Resume" : "Pause";
+    pauseBtn.setAttribute("aria-pressed", String(paused));
+    if (paused) clearTimeout(timerId);
+    else scheduleNextFetch();
+    renderHeaderStatus();
+  }
+
+  function postSeen(btn) {
+    if (fetching) return;
+    fetching = true;
+    btn.disabled = true;
+    fetch("/api/seen", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ project: btn.dataset.project, agent: btn.dataset.agent, lastActivity: btn.dataset.last, seen: btn.dataset.seen === "true" })
+    })
+      .then(function (res) {
+        return res.json().catch(function () {
+          throw new Error("the server sent a response that was not valid JSON");
+        }).then(function (body) {
+          if (!res.ok) throw new Error((body && body.error) || "HTTP " + res.status);
+          return body;
+        });
+      })
+      .then(function (body) {
+        lastData = body;
+        hideError();
+        renderAll();
+      })
+      .catch(function (err) {
+        console.error("marking seen failed", err);
+        showError(err && err.message ? err.message : "unknown error");
+        btn.disabled = false;
+      })
+      .then(function () {
+        fetching = false;
+        renderHeaderStatus();
+        scheduleNextFetch();
+      });
+  }
+
+  function postReply(form) {
+    var id = form.dataset.id;
+    var input = form.querySelector(".reply-text");
+    var text = input.value;
+    if (!text.trim()) return;
+    var sendBtn = form.querySelector("button");
+    sendBtn.disabled = true;
+    fetch("/api/reply", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ agent: id, text: text })
+    })
+      .then(function (res) {
+        return res.json().catch(function () {
+          throw new Error("the server sent a response that was not valid JSON");
+        }).then(function (body) {
+          if (!res.ok) throw new Error((body && body.error) || "HTTP " + res.status);
+          return body;
+        });
+      })
+      .then(function (body) {
+        replyReceipts[id] = body;
+        if (body.delivered) delete replyDrafts[id];
+        renderAll();
+        // The seat's log shows the effect; fetch now instead of waiting a tick.
+        if (body.delivered && !paused) runFetch();
+      })
+      .catch(function (err) {
+        console.error("reply failed", err);
+        replyReceipts[id] = { delivered: false, exitCode: null, error: err && err.message ? err.message : "unknown error" };
+        renderAll();
+      });
+  }
+
+  main.addEventListener("submit", function (e) {
+    var form = e.target.closest(".reply-form");
+    if (!form) return;
+    e.preventDefault();
+    postReply(form);
+  });
+
+  main.addEventListener("input", function (e) {
+    var input = e.target.closest(".reply-text");
+    if (!input) return;
+    replyDrafts[input.form.dataset.id] = input.value;
+  });
+
+  main.addEventListener("click", function (e) {
+    var seenBtn = e.target.closest(".seen-toggle");
+    if (seenBtn) return postSeen(seenBtn);
+    var btn = e.target.closest(".row-toggle");
+    if (!btn) return;
+    var detail = document.getElementById("detail-" + btn.dataset.idx);
+    var expanded = btn.getAttribute("aria-expanded") === "true";
+    btn.setAttribute("aria-expanded", String(!expanded));
+    detail.hidden = expanded;
+    if (expanded) delete openDetails[btn.dataset.key];
+    else openDetails[btn.dataset.key] = true;
+  });
+
+  main.addEventListener("change", function (e) {
+    var cb = e.target.closest(".hide-offline-toggle, .hide-seen-toggle");
+    if (!cb) return;
+    var stateMap = cb.classList.contains("hide-seen-toggle") ? hideSeenState : hideOfflineState;
+    stateMap[cb.dataset.project] = cb.checked;
+    renderProjects(lastData);
+  });
+
+  refreshBtn.addEventListener("click", runFetch);
+  pauseBtn.addEventListener("click", function () { setPaused(!paused); });
+
+  setInterval(function () {
+    if (!paused && secondsLeft > 0) secondsLeft -= 1;
+    renderHeaderStatus();
+  }, 1000);
+
+  renderHeaderStatus();
+  runFetch();
+})();
+</script>
+</body>
+</html>

packages/control-board/src/scan.mjs

@@ -16,7 +16,7 @@
 import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, writeFileSync, renameSync } from "node:fs";
 import { join, basename, isAbsolute, resolve } from "node:path";
 import { homedir } from "node:os";
-import { spawnSync, execFile } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { readRegistration, samePath, SeatError, LAYOUTS } from "../../seat/src/seat.mjs";
 
 import { discoverDiscordAgents, inspectDiscord, newestDiscordSession } from './discord.mjs';
@@ -193,46 +193,17 @@ export function parsePanes(listPanesOutput) {
 //             "unknown", never assumed alive).
 //   workspace the current path of the first pane running pi, else null.
 // `exec` is injectable for tests.
-export function tmuxInspect(tmux, { exec = spawnSync } = {}) {
-  return inspectFromResult(exec("tmux", tmuxArgs(tmux), { encoding: "utf8", timeout: TMUX_TIMEOUT_MS }));
-}
-
-const TMUX_TIMEOUT_MS = 5000;
-
-function tmuxArgs({ socket, session }) {
+export function tmuxInspect({ socket, session }, { exec = spawnSync } = {}) {
   const args = [];
   if (socket) args.push("-L", socket);
   args.push("list-panes", "-s", "-t", `=${session}`, "-F", "#{pane_current_command}\t#{pane_current_path}");
-  return args;
-}
-
-// Shared by the sync and async paths, so they cannot drift.
-function inspectFromResult(r) {
+  const r = exec("tmux", args, { encoding: "utf8", timeout: 5000 });
   if (r.error) return { alive: null, workspace: null };
   if (r.status !== 0) return { alive: false, workspace: null };
   const pane = parsePanes(r.stdout ?? "").find((p) => PI_COMMANDS.includes(p.command));
   return { alive: Boolean(pane), workspace: pane?.path ?? null };
 }
 
-// Async child run for the Console's in-process board (B1). Same result shape as
-// spawnSync: { status, signal, stdout, stderr, error }. A timeout or a failure to
-// start is an error, never a status. The Console's event loop must not block here.
-export function runAsync(file, args, { encoding = "utf8", timeout, env } = {}) {
-  return new Promise((resolvePromise) => {
-    execFile(file, args, { encoding, timeout, env, maxBuffer: 1 << 20 }, (err, stdout, stderr) => {
-      if (!err) return resolvePromise({ status: 0, signal: null, stdout, stderr, error: undefined });
-      if (err.killed) return resolvePromise({ status: null, signal: err.signal ?? null, stdout, stderr, error: Object.assign(new Error(`timed out after ${timeout} ms`), { code: "ETIMEDOUT" }) });
-      if (typeof err.code === "number") return resolvePromise({ status: err.code, signal: null, stdout, stderr, error: undefined });
-      return resolvePromise({ status: null, signal: null, stdout, stderr, error: err });
-    });
-  });
-}
-
-// Async twin of tmuxInspect. `exec` is injectable for tests.
-export async function tmuxInspectAsync(tmux, { exec = runAsync } = {}) {
-  return inspectFromResult(await exec("tmux", tmuxArgs(tmux), { encoding: "utf8", timeout: TMUX_TIMEOUT_MS }));
-}
-
 // Liveness only, for callers that do not need the pane path.
 export function tmuxIsAlive(tmux, opts) {
   return tmuxInspect(tmux, opts).alive;
@@ -491,16 +462,3 @@ export function scan(specs, { boardDir, isAlive, now, seatsDir = null, isPidAliv
   writeAtomic(join(boardDir, "index.json"), index);
   return index;
 }
-
-// Async scan for the Console's in-process board (B1). With no isAlive, every tmux
-// check runs through the async exec first, in parallel, and the sync scan body
-// then reads those answers. A caller's sync isAlive (the CLI, tests) is used as is.
-// One scan body serves both paths, so the records cannot drift.
-export async function scanAsync(specs, { isAlive, exec = runAsync, ...rest } = {}) {
-  if (isAlive) return scan(specs, { ...rest, isAlive });
-  const checks = new Map();
-  const keyOf = (tmux) => JSON.stringify([tmux.socket ?? null, tmux.session]);
-  const pending = [...new Map(specs.filter((s) => !s.connector).map((s) => [keyOf(s.tmux), s.tmux])).values()];
-  await Promise.all(pending.map(async (tmux) => checks.set(keyOf(tmux), await tmuxInspectAsync(tmux, { exec }))));
-  return scan(specs, { ...rest, isAlive: (tmux) => checks.get(keyOf(tmux)) ?? { alive: null, workspace: null } });
-}

packages/control-board/src/serve.mjs

@@ -1,30 +1,58 @@
-// Control board: the pure board logic the Console calls in-process (row 198).
-// No listener. The writer on 7331 is retired; the Console serves the board
-// routes behind its own auth (packages/webui/src/serve.mjs). The board opens no
-// socket and never binds a port.
+// Control board step 2: a tiny local web server. No dependencies, no auth.
+// It only ever binds to a loopback address (fail closed otherwise).
 //
-// Route logic lives in src/board.mjs. This module keeps the pure helpers the
-// Console and the tests share: reply planning and shaping, the Host/Origin check
-// (foreignRequest), and the conversation query and refusal map.
+//   GET /            the page (src/page.html)
+//   GET /api/board   re-runs the scanner and returns index.json as JSON
+//   POST /api/seen   {project, agent, lastActivity, seen?} marks a row as seen
+//                    (or clears the mark with seen:false); rescans, returns index
+//   POST /api/reply  {agent: "<project>/<agent>", text} delivers text to the
+//                    seat's tmux pane through tools/tmux/agent-send.sh (#1505);
+//                    answers {delivered, exitCode, stdout, stderr, ...}
+//   GET /healthz     {"ok":true}
+//   GET /api/conversations
+//                    read-only Pi conversation catalogue (#1507, CHAT-02)
+//   GET /api/conversation?id=<conversation>[&branch=<branch>][&cursor=<cursor>]
+//                    one CHAT-01 history page: the first page of a branch (the
+//                    default one without branch), or the next page (or a
+//                    follow) for a cursor. A cursor call repeats the page's
+//                    branch; without it the answer is 400. Refusals carry
+//                    {error, refusal: {code, reconcile}}.
+//
+// POST requires Content-Type: application/json. A plain form post from another
+// site in the browser cannot set that header without a CORS preflight, and this
+// server answers no preflight, so a stray page cannot flip marks.
 //
 // Every route first checks Host and Origin (#1507). Binding to loopback does
 // not stop DNS rebinding: a page whose name now resolves to 127.0.0.1 reaches
-// a Console on this host as its own origin, with its own name as Host, and could
-// read the board or post /api/reply into a live pane. A Host that is not a
-// loopback name on the listening port, or any Origin other than the server's
-// own, gets 403 before anything else runs. The Console applies the same check.
+// this server as its own origin, with its own name as Host, and could read
+// /api/board or post /api/reply into a live pane. A Host that is not a loopback
+// name on this server's port, or any Origin other than this server's own, gets
+// 403 before anything else runs. Same check as packages/webui/src/serve.mjs.
 // No CORS headers are ever sent.
 //
+// Every /api/board request rescans, so the page is never staler than its
+// refresh timer. The scan rewrites the derived board files as a side effect.
+//
 // The conversation routes read only: packages/conversation lists the repository
 // specs' Pi session roots (never fleet or connector ones), opens files
 // O_NOFOLLOW and writes nothing. Registrations are hints there too. The
-// conversation id is opaque and no path comes from the request.
+// conversation id is opaque and no path comes from the request. Cursors live
+// in this server's memory, bound to the one actor this unauthenticated
+// loopback route has, local-operator.
 
+import { createServer as createHttpServer } from "node:http";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { isIP } from "node:net";
 import { hostname } from "node:os";
 import { spawnSync } from "node:child_process";
-import { resolve } from "node:path";
-import { seenKey, runAsync } from "./scan.mjs";
+import { scan, markSeen, seenKey, ConfigError, loadRegistrations } from "./scan.mjs";
+import { createReader, rootsFromSpecs } from "../../conversation/src/reader.mjs";
+import { Refusal } from "../../conversation/src/safe-fs.mjs";
+import { loadSeatSets } from "../../business/src/library-seats.mjs";
+import { configDir } from "../../business/src/business.mjs";
+
+const MAX_BODY = 4096;
 
 // Reply-from-board (#1505). The board owns no transport: a reply is handed to
 // the repository's own inter-agent channel, tools/tmux/agent-send.sh, which
@@ -46,48 +74,27 @@ const REPLY_TIMEOUT_MS = 15000;
 // Refusals (4xx) happen before the tool runs and carry { error }. Once the
 // tool has run the answer is 200 with delivered true/false, the exit code and
 // both output streams verbatim, whatever the code was.
-export function replyToRow(opts) {
-  return replyWith(opts, (exec, args, env, agentSend) => exec(agentSend, args, { encoding: "utf8", timeout: REPLY_TIMEOUT_MS, env }), { exec: spawnSync });
-}
-
-// Async twin of replyToRow for the in-process board (B1). `exec` is async.
-export async function replyToRowAsync(opts) {
-  return replyWith(opts, async (exec, args, env, agentSend) => exec(agentSend, args, { encoding: "utf8", timeout: REPLY_TIMEOUT_MS, env }), { exec: runAsync, async: true });
-}
-
-function replyWith({ index, key, text, agentSend = DEFAULT_AGENT_SEND, exec, now = () => new Date(), host = hostname().split(".")[0] }, send, { exec: defaultExec, async = false }) {
-  const plan = planReply({ index, key, text, host });
-  if (plan.refusal) return async ? Promise.resolve(plan.refusal) : plan.refusal;
-  // The registration says which socket the seat is on. A launcher-exported
-  // MOSAIC_TMUX_SOCKET in this server's own environment must not override it.
-  const env = { ...process.env };
-  delete env.MOSAIC_TMUX_SOCKET;
-  const finish = (r) => replyBody({ r, key, agentSend, session: plan.session, socket: plan.socket, now });
-  const out = send(exec ?? defaultExec, plan.args, env, agentSend);
-  return async ? Promise.resolve(out).then(finish) : finish(out);
-}
-
-function planReply({ index, key, text, host }) {
-  const refuse = (status, error) => ({ refusal: { status, body: { error } } });
-  if (typeof key !== "string" || !key) return refuse(400, "agent must be the row id <project>/<agent>");
-  if (typeof text !== "string" || !text.trim()) return refuse(400, "text must be a non-empty string");
-  if (text.length > REPLY_LIMIT) return refuse(400, `text is longer than ${REPLY_LIMIT} characters`);
+export function replyToRow({ index, key, text, agentSend = DEFAULT_AGENT_SEND, exec = spawnSync, now = () => new Date(), host = hostname().split(".")[0] }) {
+  if (typeof key !== "string" || !key) return { status: 400, body: { error: "agent must be the row id <project>/<agent>" } };
+  if (typeof text !== "string" || !text.trim()) return { status: 400, body: { error: "text must be a non-empty string" } };
+  if (text.length > REPLY_LIMIT) return { status: 400, body: { error: `text is longer than ${REPLY_LIMIT} characters` } };
   const rec = index.sessions.find((r) => seenKey(r) === key);
-  if (!rec) return refuse(404, `unknown row: ${key}`);
-  if (rec.connector || / \(discord: [a-z0-9][a-z0-9._-]{0,63}\)$/.test(rec.agent)) return refuse(409, "board replies are disabled for Discord connectors");
+  if (!rec) return { status: 404, body: { error: `unknown row: ${key}` } };
+  if (rec.connector || / \(discord: [a-z0-9][a-z0-9._-]{0,63}\)$/.test(rec.agent)) return { status: 409, body: { error: "board replies are disabled for Discord connectors" } };
   const reg = rec.registered;
-  if (!reg) return refuse(409, "reply needs a registered seat (start it through scripts/mosaic launch)");
-  if (reg.alive === false) return refuse(409, `registration is stale: pid ${reg.pid} is gone`);
-  if (!reg.tmux || !reg.tmux.session) return refuse(409, "registration has no tmux session to address");
+  if (!reg) return { status: 409, body: { error: "reply needs a registered seat (start it through scripts/mosaic launch)" } };
+  if (reg.alive === false) return { status: 409, body: { error: `registration is stale: pid ${reg.pid} is gone` } };
+  if (!reg.tmux || !reg.tmux.session) return { status: 409, body: { error: "registration has no tmux session to address" } };
   const session = reg.tmux.session;
   const socket = reg.tmux.socket || null;
   const args = ["-s", session, "-S", `${host}:${REPLY_SENDER}`];
   if (socket) args.push("-L", socket);
   args.push("-m", `${text}\n${REPLY_TRAILER}`);
-  return { args, session, socket };
-}
-
-function replyBody({ r, key, agentSend, session, socket, now }) {
+  // The registration says which socket the seat is on. A launcher-exported
+  // MOSAIC_TMUX_SOCKET in this server's own environment must not override it.
+  const env = { ...process.env };
+  delete env.MOSAIC_TMUX_SOCKET;
+  const r = exec(agentSend, args, { encoding: "utf8", timeout: REPLY_TIMEOUT_MS, env });
   if (r.error) return { status: 500, body: { error: `could not run ${agentSend}: ${r.error.message}` } };
   const exitCode = r.status;
   return {
@@ -106,6 +113,39 @@ function replyBody({ r, key, agentSend, session, socket, now }) {
   };
 }
 
+function sendJson(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+  res.end(JSON.stringify(body) + "\n");
+}
+
+function readJsonBody(req) {
+  return new Promise((resolvePromise, reject) => {
+    const type = String(req.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+    if (type !== "application/json") return reject(new Error("Content-Type must be application/json"));
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) {
+        req.destroy();
+        reject(new Error(`body larger than ${MAX_BODY} bytes`));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("body must be a JSON object");
+        resolvePromise(parsed);
+      } catch (err) {
+        reject(new Error(`invalid JSON body: ${err.message}`));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+
 const LOOPBACK = new Set(["127.0.0.1", "::1", "localhost"]);
 
 export function isLoopbackHost(host) {
@@ -133,6 +173,8 @@ export function foreignRequest(req) {
 export const REFUSAL_STATUS = {
   "unknown-conversation": 404,
   "unknown-branch": 404,
+  "conversation-not-listed": 404,
+  "conversation-business-unreadable": 503,
   unavailable: 404,
   "cursor-unknown": 409,
   "cursor-expired": 409,
@@ -150,6 +192,11 @@ export const REFUSAL_STATUS = {
 };
 const QUERY_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 
+function sendConversationJson(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff" });
+  res.end(JSON.stringify(body) + "\n");
+}
+
 // GET /api/conversation: id is required; branch and cursor are optional; any
 // other, repeated or malformed parameter is a 400.
 function conversationQuery(url) {
@@ -168,7 +215,8 @@ function conversationQuery(url) {
 export function conversationResponse(reader, url) {
   if (url.pathname === "/api/conversations") {
     if ([...url.searchParams.keys()].length) return { status: 400, body: { error: "no parameters are accepted" } };
-    return { status: 200, body: reader.catalogue() };
+    const listing = reader.catalogue();
+    return listing.ok ? { status: 200, body: listing } : refusalResponse(listing);
   }
   const query = conversationQuery(url);
   if (query.error) return { status: 400, body: { error: query.error } };
@@ -176,5 +224,131 @@ export function conversationResponse(reader, url) {
     ? reader.next({ cursor: query.cursor, conversation: query.id, branch: query.branch })
     : reader.open({ conversation: query.id, branch: query.branch ?? null });
   if (out.ok) return { status: 200, body: out };
+  return refusalResponse(out);
+}
+
+function refusalResponse(out) {
   return { status: REFUSAL_STATUS[out.refusal.code] ?? 422, body: { error: out.refusal.message, refusal: { code: out.refusal.code, reconcile: out.refusal.reconcile } } };
 }
+
+// Case 2 M7 (design 5.1): a root whose seat is creative in a library business is
+// hidden from the catalogue and from open and next. creativeCheck(dir) returns the
+// factory the reader calls once per public call: each call reads the business sets
+// once and applies that one answer to every root, so an edited business file takes
+// effect on the next call without a restart. A business file that can't be read
+// refuses the whole call with conversation-business-unreadable.
+export function creativeCheck(dir = configDir()) {
+  return () => {
+    let sets;
+    try {
+      sets = loadSeatSets({ dir });
+    } catch (err) {
+      throw new Refusal("conversation-business-unreadable", `a business file cannot be read: ${err.message}`);
+    }
+    return (root) => sets.creativeSeats.has(root.seat);
+  };
+}
+
+export function loadPage(path = join(import.meta.dirname, "page.html")) {
+  return readFileSync(path, "utf8");
+}
+
+// specs: agent specs to scan on each request. boardDir: where scan writes. configDirectory: the config
+// directory whose businesses/ the default conversation reader reads for M7 (the instance's, by default).
+export function createServer({ specs, boardDir, isAlive, now, seatsDir = null, discordDataRoot = null, page = loadPage(), isPidAlive, agentSend = DEFAULT_AGENT_SEND, exec = spawnSync, conversationReader = null, configDirectory = configDir() }) {
+  const rescan = () => scan(specs, { boardDir, isAlive, now, seatsDir, isPidAlive, discordDataRoot });
+  const reader = conversationReader ?? createReader({
+    roots: () => rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations),
+    creativeCheck: creativeCheck(configDirectory),
+  });
+  return createHttpServer((req, res) => {
+    const refused = foreignRequest(req);
+    if (refused) {
+      req.resume();
+      return sendJson(res, 403, { error: refused });
+    }
+    const url = new URL(req.url, "http://localhost");
+    if (req.method === "POST" && url.pathname === "/api/reply") {
+      return readJsonBody(req)
+        .then((body) => {
+          let index;
+          try {
+            index = rescan();
+          } catch (err) {
+            return sendJson(res, 500, { error: err.message });
+          }
+          const out = replyToRow({ index, key: body.agent, text: body.text, agentSend, exec, now });
+          sendJson(res, out.status, out.body);
+        })
+        .catch((err) => sendJson(res, 400, { error: err.message }));
+    }
+    if (req.method === "POST" && url.pathname === "/api/seen") {
+      return readJsonBody(req)
+        .then((body) => {
+          try {
+            markSeen(boardDir, { project: body.project, agent: body.agent, lastActivity: body.lastActivity, seen: body.seen ?? true });
+          } catch (err) {
+            return sendJson(res, 400, { error: err.message });
+          }
+          try {
+            sendJson(res, 200, rescan());
+          } catch (err) {
+            sendJson(res, 500, { error: err.message });
+          }
+        })
+        .catch((err) => sendJson(res, 400, { error: err.message }));
+    }
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      res.writeHead(405, { "content-type": "text/plain" });
+      return res.end("method not allowed\n");
+    }
+    if (url.pathname === "/" || url.pathname === "/index.html") {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+      return res.end(page);
+    }
+    if (url.pathname === "/api/board") {
+      let index;
+      try {
+        index = rescan();
+      } catch (err) {
+        res.writeHead(500, { "content-type": "application/json", "cache-control": "no-store" });
+        return res.end(JSON.stringify({ error: err.message }) + "\n");
+      }
+      res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+      return res.end(JSON.stringify(index) + "\n");
+    }
+    if (url.pathname === "/api/conversations" || url.pathname === "/api/conversation") {
+      let out;
+      try {
+        out = conversationResponse(reader, url);
+      } catch (err) {
+        process.stderr.write(`conversation read failed: ${err.message}\n`);
+        out = { status: 500, body: { error: "conversation read failed" } };
+      }
+      return sendConversationJson(res, out.status, out.body);
+    }
+    if (url.pathname === "/favicon.ico") {
+      res.writeHead(204);
+      return res.end();
+    }
+    if (url.pathname === "/healthz") {
+      res.writeHead(200, { "content-type": "application/json" });
+      return res.end('{"ok":true}\n');
+    }
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end("not found\n");
+  });
+}
+
+// Resolves to the listening server. Refuses any non-loopback host.
+export async function startServer({ host = "127.0.0.1", port = 7331, ...rest }) {
+  if (!isLoopbackHost(host)) throw new ConfigError(`refusing to bind to non-loopback host: ${host} (no auth in the MVP)`);
+  const server = createServer(rest);
+  return new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.off("error", reject);
+      resolvePromise(server);
+    });
+  });
+}

packages/control-board/tests/board.test.mjs

@@ -1,129 +0,0 @@
-import { test, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, appendFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-import { createBoard } from "../src/board.mjs";
-
-const pkgRoot = resolve(import.meta.dirname, "..");
-const cli = join(pkgRoot, "src", "cli.mjs");
-
-// Track every tmpdir we create so a stray failure never leaves fixtures behind.
-const roots = [];
-function makeRoot() {
-  const root = mkdtempSync(join(tmpdir(), "control-board-board-test-"));
-  roots.push(root);
-  return root;
-}
-after(() => {
-  for (const root of roots) rmSync(root, { recursive: true, force: true });
-});
-
-// One agent whose last message is an assistant reply (waiting on the user), so
-// a mark on it is visible in the index. No registration; liveness stubbed so no tmux runs.
-function fixture() {
-  const root = makeRoot();
-  const sessionsDir = join(root, "sessions");
-  mkdirSync(sessionsDir, { recursive: true });
-  writeFileSync(
-    join(sessionsDir, "session.jsonl"),
-    [
-      JSON.stringify({ type: "session", id: "s1", timestamp: "2026-10-20T18:59:00Z", cwd: root }),
-      JSON.stringify({ type: "message", timestamp: "2026-10-20T19:00:00Z", message: { role: "assistant", stopReason: "stop", content: [{ type: "text", text: "Input needed: which branch should I use?" }] } }),
-    ].join("\n") + "\n",
-  );
-  const boardDir = join(root, "board");
-  const specs = [{ agent: "agent1", project: "proj", sessionsDir, tmux: {} }];
-  const isAlive = () => ({ alive: true, workspace: null });
-  return { root, boardDir, specs, isAlive };
-}
-
-// Pinned order (Webby, Mos mos-1052): markSeen writes, bumps the counter, then scans.
-test("markSeen runs write, bump, scan in that order", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const events = [];
-  const board = createBoard({ specs, boardDir, isAlive, onEvent: (name) => events.push(name) });
-  await board.markSeen({ project: "proj", agent: "agent1", lastActivity: "2026-10-20T19:00:00Z" });
-  assert.deepEqual(events, ["write", "bump", "scan"]);
-});
-
-// Mutant target: a scan run before the write, or a join of a pre-write scan,
-// would let the answer omit the mark it was asked to show.
-test("markSeen answer includes the mark it just wrote", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const board = createBoard({ specs, boardDir, isAlive });
-  const before = await board.index();
-  assert.deepEqual(before.seen, []);
-  const rec = before.sessions[0];
-  const index = await board.markSeen({ project: "proj", agent: "agent1", lastActivity: rec.lastActivity });
-  assert.deepEqual(index.seen, ["proj/agent1"]);
-});
-
-// A reply to a row that is not registered is refused before any send, so the
-// send and bump events must not appear.
-test("reply refuses an unregistered row and never sends", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const events = [];
-  const board = createBoard({ specs, boardDir, isAlive, onEvent: (name) => events.push(name), exec: async () => assert.fail("no send on refusal") });
-  const out = await board.reply({ agent: "proj/agent1", text: "hello" });
-  assert.equal(out.status, 409);
-  assert.equal(events.includes("send"), false);
-  assert.equal(events.includes("bump"), false);
-});
-
-// The retired writer refuses to start. Exit 2 with a pointer to the Console.
-test("cli serve refuses and points to the Console", () => {
-  const r = spawnSync(process.execPath, [cli, "serve"], { encoding: "utf8" });
-  assert.equal(r.status, 2);
-  assert.match(r.stderr, /retired on 7331/);
-  assert.match(r.stderr, /webui/);
-});
-
-// M15 (Webby N1): index() must not join a scan that started before the last write.
-// A scan already answered before the mark would hide the mark; the join is what
-// this kills, so the event log must show a fresh scan after the write.
-test("index after a write starts a fresh scan and sees the mark (M15)", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const events = [];
-  const board = createBoard({ specs, boardDir, isAlive, onEvent: (name) => events.push(name) });
-  await board.index();
-  const before = events.length;
-  await board.markSeen({ project: "proj", agent: "agent1", lastActivity: "2026-10-20T19:00:00Z" });
-  const after = await board.index();
-  assert.deepEqual(events.slice(before), ["write", "bump", "scan", "scan"]);
-  assert.deepEqual(after.seen, ["proj/agent1"]);
-});
-
-// B4 (Webby r3): a settled scan is not in flight. With no write between two index()
-// calls, the second must start a fresh scan and show activity appended in between.
-// The mutant: drop the clear on settle in index(); the second call then joins the
-// settled promise, logs one scan, and shows the first view.
-test("index after a settled scan starts a fresh scan and shows new activity (B4)", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const events = [];
-  const board = createBoard({ specs, boardDir, isAlive, onEvent: (name) => events.push(name) });
-  await board.index();
-  appendFileSync(join(specs[0].sessionsDir, "session.jsonl"), JSON.stringify({ type: "message", timestamp: "2026-10-20T19:05:00Z", message: { role: "user", content: [{ type: "text", text: "new activity" }] } }) + "\n");
-  const second = await board.index();
-  assert.deepEqual(events, ["scan", "scan"]);
-  assert.equal(second.sessions[0].lastActivity, "2026-10-20T19:05:00Z");
-});
-
-// B4 (Webby r3): a scan that rejects is cleared too. The next index() runs fresh
-// and answers, rather than replaying the rejection on every poll.
-test("index after a rejected scan starts a fresh scan (B4)", async () => {
-  const { boardDir, specs, isAlive } = fixture();
-  const events = [];
-  let fail = true;
-  const flaky = (tmux) => {
-    if (fail) throw new Error("boom");
-    return isAlive(tmux);
-  };
-  const board = createBoard({ specs, boardDir, isAlive: flaky, onEvent: (name) => events.push(name) });
-  await assert.rejects(board.index(), /boom/);
-  fail = false;
-  const answer = await board.index();
-  assert.deepEqual(events, ["scan", "scan"]);
-  assert.equal(answer.sessions[0].agent, "agent1");
-});

packages/control-board/tests/creative-hidden.test.mjs

@@ -0,0 +1,130 @@
+// Case 2 M7 (design 5.1, row 220): a creative seat's conversations are hidden from
+// the catalogue, from open and from next. The thread store is a second wall: a
+// root built over it is hidden, and no spec under .pi/state reaches it. A business
+// file the board can't read refuses the listing and open, never a partial list.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { conversationResponse, creativeCheck, startServer, REFUSAL_STATUS } from "../src/serve.mjs";
+import { conversationId, createReader, rootsFromSpecs } from "../../conversation/src/reader.mjs";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+// A config directory holding one library business whose seat "bean" is creative,
+// and a thread store for bean's session under <data>/threads/<business>/<thread>.
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), "row220-board-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  const doc = businessDoc(root, "acme");
+  doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles.bean = { definition: "companion" };
+  writeJson(join(dir, "businesses", "acme.json"), doc);
+  const threadDir = join(root, "data", "threads", "acme", "t1", "session");
+  mkdirSync(threadDir, { recursive: true });
+  writeFileSync(join(threadDir, "s.jsonl"), "{}\n");
+  const threadRoot = { seat: "bean", project: "acme", projectRoot: join(root, "data"), dir: threadDir, harness: "pi", unsupportedReason: null, engineStartedAt: null };
+  return { root, dir, threadDir, threadRoot };
+}
+
+function breakBusinessFile(dir) {
+  const file = join(dir, "businesses", "broken.json");
+  writeFileSync(file, "{");
+  chmodSync(file, 0o600);
+}
+
+const detail = (id) => new URL(`/api/conversation?id=${encodeURIComponent(id)}`, "http://localhost");
+const listing = new URL("/api/conversations", "http://localhost");
+
+test("M7: the check hides the creative seat, shows the others, and refuses when a business file is unreadable", (t) => {
+  const f = fixture(t);
+  const hidden = creativeCheck(f.dir)();
+  assert.equal(hidden({ seat: "bean" }), true);
+  assert.equal(hidden({ seat: "pm" }), false);
+  breakBusinessFile(f.dir);
+  assert.throws(() => creativeCheck(f.dir)(), (err) => err.code === "conversation-business-unreadable");
+});
+
+test("M7: a thread store is not a root from a spec, and a root built over it is hidden from the list and from open", (t) => {
+  const f = fixture(t);
+  // The spec layout check in rootsFromSpecs drops a thread-store directory.
+  assert.deepEqual(rootsFromSpecs([{ agent: "bean", project: "acme", sessionsDir: f.threadDir }]), []);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const cat = reader.catalogue();
+  assert.deepEqual([cat.conversations, cat.refusedRoots], [[], []], "the root is hidden, not refused");
+  const out = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  assert.equal(out.status, REFUSAL_STATUS["conversation-not-listed"]);
+  assert.equal(out.status, 404);
+  assert.equal(out.body.refusal.code, "conversation-not-listed");
+});
+
+test("M7: with an unreadable business file, a known and an unknown id both refuse with 503", (t) => {
+  const f = fixture(t);
+  breakBusinessFile(f.dir);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const known = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  const unknown = conversationResponse(reader, detail(conversationId(f.threadRoot, "missing.jsonl")));
+  for (const out of [known, unknown]) {
+    assert.equal(out.status, 503);
+    assert.equal(out.body.refusal.code, "conversation-business-unreadable");
+  }
+});
+
+test("M7: an unreadable business file refuses the listing and open with 503, never a partial list", (t) => {
+  const f = fixture(t);
+  breakBusinessFile(f.dir);
+  const reader = createReader({ roots: [f.threadRoot], creativeCheck: creativeCheck(f.dir) });
+  const cat = conversationResponse(reader, listing);
+  assert.equal(cat.status, 503);
+  assert.equal(cat.body.refusal.code, "conversation-business-unreadable");
+  assert.equal(cat.body.conversations, undefined);
+  const opened = conversationResponse(reader, detail(conversationId(f.threadRoot, "s.jsonl")));
+  assert.equal(opened.status, REFUSAL_STATUS["conversation-business-unreadable"]);
+  assert.equal(opened.status, 503);
+});
+
+// C2: every test above builds its own reader. This one starts the board with no
+// injected reader, so the check reaches the reader only through createServer's
+// wiring (serve.mjs: `creativeCheck: creativeCheck(configDirectory)`). Deleting that
+// line shows bean's session in the listing and fails the first assertion below.
+// It also shows the business file in the fixture's config directory is the one
+// read: bean is hidden and pm is not, and no other file says so.
+test("M7: the board's default reader hides a creative seat's session from the listing and the detail route", async (t) => {
+  const f = fixture(t);
+  const proj = join(f.root, "proj");
+  const specs = [];
+  for (const [n, seat] of ["bean", "pm"].entries()) {
+    const sessionsDir = join(proj, ".pi", "state", seat, "sessions");
+    mkdirSync(sessionsDir, { recursive: true });
+    const header = { type: "session", version: 3, id: `c0ffee00-0000-4000-8000-00000000000${n + 1}`, timestamp: "2026-10-22T12:00:00.000Z", cwd: proj };
+    const message = { type: "message", id: "e0", parentId: null, timestamp: "2026-10-22T12:00:01.000Z", message: { role: "user", content: [{ type: "text", text: `${seat.toUpperCase()}-TEXT` }] } };
+    writeFileSync(join(sessionsDir, "s.jsonl"), [header, message].map((l) => JSON.stringify(l)).join("\n") + "\n");
+    specs.push({ agent: seat, project: "proj", sessionsDir, tmux: {} });
+  }
+  const roots = rootsFromSpecs(specs);
+  const idOf = (seat) => conversationId(roots.find((r) => r.seat === seat), "s.jsonl");
+  const server = await startServer({ host: "127.0.0.1", port: 0, specs, boardDir: join(f.root, "board"), seatsDir: join(f.root, "seats"), configDirectory: f.dir, isAlive: () => true, page: "<html></html>" });
+  t.after(() => { server.closeAllConnections(); server.close(); });
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const get = async (path) => {
+    const res = await fetch(base + path);
+    return { status: res.status, text: await res.text() };
+  };
+  const cat = await get("/api/conversations");
+  assert.equal(cat.status, 200, cat.text);
+  assert.deepEqual(JSON.parse(cat.text).conversations.map((c) => c.seat), ["pm"]);
+  assert.ok(!cat.text.includes("BEAN-TEXT"));
+  const hidden = await get(`/api/conversation?id=${encodeURIComponent(idOf("bean"))}`);
+  assert.equal(hidden.status, 404, hidden.text);
+  assert.equal(JSON.parse(hidden.text).refusal.code, "conversation-not-listed");
+  assert.ok(!hidden.text.includes("BEAN-TEXT"));
+  const shown = await get(`/api/conversation?id=${encodeURIComponent(idOf("pm"))}`);
+  assert.equal(shown.status, 200, shown.text);
+  // The file is read on every call: a broken business file now refuses the same route.
+  breakBusinessFile(f.dir);
+  const refused = await get("/api/conversations");
+  assert.equal(refused.status, 503, refused.text);
+  assert.equal(JSON.parse(refused.text).refusal.code, "conversation-business-unreadable");
+});

packages/control-board/tests/discord.test.mjs

@@ -6,8 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
 import { discoverDiscordAgents, inspectDiscord } from '../src/discord.mjs';
 import { scan, scanAgent } from '../src/scan.mjs';
-import { replyToRow } from '../src/serve.mjs';
-import { createBoard } from '../src/board.mjs';
+import { replyToRow, startServer } from '../src/serve.mjs';
 import { identityOf } from '../../discord/src/journal.mjs';
 import { envelope } from '../../discord/src/context.mjs';
 import { makeRegistration, writeRegistration } from '../../seat/src/seat.mjs';
@@ -116,20 +115,21 @@ test('connector reply refusal precedes forged live tmux registration; ordinary a
   r.agent = 'ordinary'; assert.equal(replyToRow({ index: { sessions: [r] }, key: 'fleet/ordinary', text: 'hello', exec }).status, 200); assert.equal(calls, 1);
 });
 
-test('board rescans connector discovery and refuses reply without transport', async () => {
-  const f = fixture();
+test('server rescans connector discovery and refuses HTTP reply without transport', async () => {
+  const f = fixture(); let server;
   try {
     const sessionsDir = join(f.root, 'sessions', 'discord-demo'), seatsDir = join(f.root, 'seats');
     writeRegistration(seatsDir, makeRegistration({ resolved: { seat: 'forged', project: 'fleet', sessionsDir, seatDir: sessionsDir, launchScript: join(f.root, 'unused.sh'), layout: 'repo', defaultWorkspace: f.root }, task: 'forged', tmux: { session: 'forged', socket: null }, pid: process.pid }));
-    const board = createBoard({ specs: [], seatsDir, boardDir: join(f.root, 'board'), discordDataRoot: f.root, exec: () => { throw Error('transport forbidden'); } });
-    const payload = await board.index();
-    assert.equal(payload.sessions[0].state, 'idle'); assert.equal(payload.sessions[0].connector.alive, true);
-    assert.equal(payload.sessions[0].registered, null); assert.notEqual(payload.sessions[0].task, 'forged');
-    const { status } = await board.reply({ agent: 'fleet/researcher (discord: demo)', text: 'hello' });
-    assert.equal(status, 409);
+    server = await startServer({ port: 0, specs: [], seatsDir, configDirectory: f.root, boardDir: join(f.root, 'board'), discordDataRoot: f.root, exec: () => { throw Error('transport forbidden'); } });
+    const base = `http://127.0.0.1:${server.address().port}`;
+    let response = await fetch(base + '/api/board'); const board = await response.json();
+    assert.equal(board.sessions[0].state, 'idle'); assert.equal(board.sessions[0].connector.alive, true);
+    assert.equal(board.sessions[0].registered, null); assert.notEqual(board.sessions[0].task, 'forged');
+    response = await fetch(base + '/api/reply', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ agent: 'fleet/researcher (discord: demo)', text: 'hello' }) });
+    assert.equal(response.status, 409);
     rmSync(join(f.root, 'discord', 'demo.json'));
-    assert.equal((await board.index()).sessions.length, 0);
-  } finally { f.cleanup(); }
+    assert.equal((await (await fetch(base + '/api/board')).json()).sessions.length, 0);
+  } finally { if (server) await new Promise(r => server.close(r)); f.cleanup(); }
 });
 
 test('connector session links and linked directories are not read', () => {

packages/control-board/tests/retired.test.mjs

@@ -1,44 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
-
-// Row 198: the 7331 writer is retired and the board runs in the Console. These
-// are source and doc checks; each names the design mutant it kills (M1, M2, M9).
-const repo = resolve(import.meta.dirname, "..", "..", "..");
-const read = (path) => readFileSync(join(repo, path), "utf8");
-const srcDir = join(repo, "packages", "control-board", "src");
-const srcFiles = readdirSync(srcDir).filter((f) => f.endsWith(".mjs"));
-
-// M1: cli.mjs starts no server, not even on the retired port.
-test("retired: cli.mjs starts no server (M1)", () => {
-  assert.doesNotMatch(read("packages/control-board/src/cli.mjs"), /startServer|createServer|\.listen\(/);
-});
-
-// M2: nothing in the board's source opens a socket or exports a server.
-test("retired: no board source imports http or exports a server (M2)", () => {
-  for (const file of srcFiles) {
-    const text = read(join("packages", "control-board", "src", file));
-    assert.doesNotMatch(text, /from ["']node:http["']|createServer\(|\.listen\(/, file);
-    assert.doesNotMatch(text, /export (async )?function (startServer|createServer)\b/, file);
-  }
-});
-
-// M9: a live doc or script must not tell anyone to run the retired serve or open 7331.
-// A line that says it is retired is allowed. Append-only logs and plans are not scanned.
-test("retired: live docs and scripts do not tell anyone to run control-board serve (M9)", () => {
-  const liveDocs = ["README.md", "AGENTS.md"];
-  for (const pkg of readdirSync(join(repo, "packages"))) {
-    if (existsSync(join(repo, "packages", pkg, "README.md"))) liveDocs.push(join("packages", pkg, "README.md"));
-  }
-  for (const file of readdirSync(join(repo, "scripts"))) {
-    if (file.endsWith(".sh")) liveDocs.push(join("scripts", file));
-  }
-  const retiredUse = /control-board\/src\/cli\.mjs serve|control-board serve\b|127\.0\.0\.1:7331/;
-  const retiredNote = /retired|no longer|exits 2/i;
-  for (const file of liveDocs) {
-    read(file).split("\n").forEach((line, i) => {
-      if (retiredUse.test(line) && !retiredNote.test(line)) assert.fail(`${file}:${i + 1} tells people to run the retired board: ${line.trim()}`);
-    });
-  }
-});

packages/conversation/src/reader.mjs

@@ -22,6 +22,8 @@ import { samePath } from "../../seat/src/seat.mjs";
 export const ACTOR = "local-operator";
 export const HISTORY = "pi";
 export const UNSUPPORTED_HARNESS = "unsupported-harness";
+// Case 2 design 5.1 M7: a creative root's conversations are not listed and do not open.
+export const NOT_LISTED = "conversation-not-listed";
 const NO_STREAM = "no-stream";
 const HEAD_BYTES = 1024 * 1024;
 const TAIL_BYTES = 2 * 1024 * 1024;
@@ -201,8 +203,20 @@ function readSnapshot(root, name, pinnedLength = null) {
   }
 }
 
-export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 * 1000, maxCursors = 1000, cacheSize = 2 } = {}) {
+// creativeCheck() is the caller's per-call answer: it returns a predicate that is
+// true when a root's seat is a creative instance on a business with a library
+// project (design 5.1 M7). The reader calls it once per public call (catalogue,
+// open, next), so one call reads the business sets once for every root. It may
+// throw (an unreadable business file), which refuses the whole call. The reader
+// only hides; it reads no business file itself. A truthy answer hides, so a
+// doubtful one fails closed. The answer must depend on root.seat and root.project
+// alone, because a cursor is checked against a root object from an earlier listing.
+export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 * 1000, maxCursors = 1000, cacheSize = 2, creativeCheck = () => () => false } = {}) {
   const listRoots = typeof roots === "function" ? roots : () => roots ?? [];
+  const hiddenCheck = () => {
+    const answer = creativeCheck();
+    return (root) => Boolean(answer(root));
+  };
   const cursors = new Map();
   const parsedCache = new Map();
   const partsCache = new Map();
@@ -241,26 +255,34 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
     return null;
   }
 
+  // A refusal from the hidden check (an unreadable business file) refuses the
+  // whole listing; it never lists some roots and drops the rest silently.
   function catalogue() {
-    const conversations = [], refusedRoots = [];
-    for (const root of listRoots()) {
-      if (root.unsupportedReason) {
-        conversations.push({ ...baseRow(root, unsupportedId(root)), engineStartedAt: root.engineStartedAt, availability: "unsupported" });
-        continue;
+    try {
+      const hidden = hiddenCheck();
+      const conversations = [], refusedRoots = [];
+      for (const root of listRoots()) {
+        if (hidden(root)) continue;
+        if (root.unsupportedReason) {
+          conversations.push({ ...baseRow(root, unsupportedId(root)), engineStartedAt: root.engineStartedAt, availability: "unsupported" });
+          continue;
+        }
+        let listing;
+        try {
+          listing = listSessionFiles(root);
+        } catch (err) {
+          if (!(err instanceof Refusal)) throw err;
+          refusedRoots.push({ seat: root.seat, project: root.project, refusal: err.code });
+          continue;
+        }
+        for (const name of listing.files) conversations.push(summarize(root, name));
+        for (const r of listing.refused) conversations.push({ ...baseRow(root, conversationId(root, r.name)), availability: "denied", refusal: r.code });
       }
-      let listing;
-      try {
-        listing = listSessionFiles(root);
-      } catch (err) {
-        if (!(err instanceof Refusal)) throw err;
-        refusedRoots.push({ seat: root.seat, project: root.project, refusal: err.code });
-        continue;
-      }
-      for (const name of listing.files) conversations.push(summarize(root, name));
-      for (const r of listing.refused) conversations.push({ ...baseRow(root, conversationId(root, r.name)), availability: "denied", refusal: r.code });
+      conversations.sort((a, b) => (b.lastActivityAt ?? "").localeCompare(a.lastActivityAt ?? "") || a.conversation.localeCompare(b.conversation));
+      return { ok: true, conversations, refusedRoots, generatedAt: new Date(now()).toISOString() };
+    } catch (err) {
+      return refuse(err);
     }
-    conversations.sort((a, b) => (b.lastActivityAt ?? "").localeCompare(a.lastActivityAt ?? "") || a.conversation.localeCompare(b.conversation));
-    return { ok: true, conversations, refusedRoots, generatedAt: new Date(now()).toISOString() };
   }
 
   // Parsed snapshot plus one branch's entries, cached by content. A null
@@ -347,8 +369,10 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
   function open({ conversation, branch = null, actor = ACTOR, purpose = "history" } = {}) {
     try {
       checkCaller(actor, purpose);
+      const hidden = hiddenCheck();
       const found = resolveConversation(conversation);
       if (!found) throw new Refusal("unknown-conversation", "no such conversation in the approved roots", { reconcile: true });
+      if (hidden(found.root)) throw new Refusal(NOT_LISTED, "this conversation is not listed");
       if (found.root.unsupportedReason) throw new Refusal(found.root.unsupportedReason, "this harness has no history reader yet");
       const snap = snapshot(found.root, found.name);
       const built = build(snap, found.root, branch ?? null, conversation);
@@ -362,6 +386,7 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
 
   function next({ cursor, conversation, branch, actor = ACTOR, purpose = "history" } = {}) {
     try {
+      const hidden = hiddenCheck();
       const held = typeof cursor === "string" ? cursors.get(cursor) : undefined;
       if (!held) throw new Refusal("cursor-unknown", "the cursor is unknown", { reconcile: true });
       const { record, state } = held;
@@ -372,6 +397,8 @@ export function createReader({ roots, now = () => Date.now(), ttlMs = 10 * 60 *
       if (actor !== record.actor || purpose !== record.purpose || conversation !== record.conversation || branch !== record.branch) {
         throw new Refusal("cursor-foreign", "the cursor belongs to another view", { reconcile: true });
       }
+      // A cursor issued before the root became creative stops here (M7).
+      if (hidden(state.root)) throw new Refusal(NOT_LISTED, "this conversation is not listed");
       // The source must still be the snapshot's file with the same prefix.
       const pinned = snapshot(state.root, state.name, state.length);
       if (pinned.shorter) throw new Refusal("source-replaced", "the session file is shorter than the snapshot", { reconcile: true });

packages/conversation/tests/reader.test.mjs

@@ -692,6 +692,79 @@ test("F15: a Claude seat is an unsupported-harness placeholder whose directory i
   }
 });
 
+// M7 (Case 2 design 5.1): a creative seat's conversations are left out of the catalogue
+// and refuse to open by id. The fixture text stands in for creative prose and must not
+// appear in any output.
+test("M7: a creative seat's session is not listed and won't open by id; an assistant seat still lists", () => {
+  const creative = project("bean");
+  const assistant = project("sage");
+  writeSession(creative.dir, "s.jsonl", header(creative.proj), [user("c1", null, "CREATIVE-MARKER", 1)]);
+  writeSession(assistant.dir, "s.jsonl", header(assistant.proj), [user("a1", null, "assistant text", 1)]);
+  const roots = rootsFromSpecs([creative.spec, assistant.spec]);
+  const reader = createReader({ roots, creativeCheck: () => (root) => root.seat === "bean" });
+  const cat = noWrites(tmp, () => reader.catalogue());
+  assert.deepEqual(cat.conversations.map((c) => c.seat), ["sage"]);
+  const hiddenOpen = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "bean"), "s.jsonl") }));
+  assert.deepEqual([hiddenOpen.ok, hiddenOpen.refusal.code, hiddenOpen.refusal.reconcile], [false, "conversation-not-listed", false]);
+  const shown = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl") }));
+  assert.deepEqual([shown.ok, texts(shown.page)], [true, ["assistant text"]]);
+  assert.equal(JSON.stringify([cat, hiddenOpen]).includes("CREATIVE-MARKER"), false);
+});
+
+test("M7: one catalogue calls the creative check once, however many roots it lists", () => {
+  const creative = project("bean");
+  const assistant = project("sage");
+  writeSession(creative.dir, "s.jsonl", header(creative.proj), [user("c1", null, "one", 1)]);
+  writeSession(assistant.dir, "s.jsonl", header(assistant.proj), [user("a1", null, "two", 1)]);
+  const roots = rootsFromSpecs([creative.spec, assistant.spec]);
+  let calls = 0;
+  const reader = createReader({ roots, creativeCheck: () => { calls += 1; return (root) => root.seat === "bean"; } });
+  const cat = noWrites(tmp, () => reader.catalogue());
+  assert.deepEqual(cat.conversations.map((c) => c.seat), ["sage"]);
+  assert.equal(calls, 1);
+  const shown = noWrites(tmp, () => reader.open({ conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl") }));
+  assert.equal(shown.ok, true);
+  assert.equal(calls, 2, "open is one more public call, so one more check");
+  noWrites(tmp, () => reader.next({ cursor: shown.follow.id, conversation: conversationId(roots.find((r) => r.seat === "sage"), "s.jsonl"), branch: shown.page.branch }));
+  assert.equal(calls, 3, "next is one more public call, so one more check");
+  assert.deepEqual(cat.refusedRoots, [], "a hidden root is not a refused root");
+});
+
+test("M7: a creative session already open refuses its next page once the root is hidden", () => {
+  const fx = project("bean");
+  writeSession(fx.dir, "s.jsonl", header(fx.proj), [user("c1", null, "CREATIVE-MARKER", 1), assistant("c2", "c1", "reply", 2)]);
+  let hide = false;
+  const roots = rootsFromSpecs([fx.spec]);
+  const reader = createReader({ roots, creativeCheck: () => () => hide });
+  const id = conversationId(roots[0], "s.jsonl");
+  const first = noWrites(fx.base, () => reader.open({ conversation: id }));
+  assert.equal(first.ok, true);
+  hide = true;
+  const r = noWrites(fx.base, () => reader.next({ cursor: first.follow.id, conversation: id, branch: first.page.branch }));
+  assert.deepEqual([r.ok, r.refusal.code], [false, "conversation-not-listed"]);
+});
+
+test("M7: a creative root's refused files and its unsupported placeholder are hidden as well", () => {
+  const fx = project("bean");
+  writeSession(fx.dir, "s.jsonl", header(fx.proj), [user("c1", null, "CREATIVE-MARKER", 1)]);
+  symlinkSync(join(fx.dir, "s.jsonl"), join(fx.dir, "link.jsonl"));
+  const chetDir = join(fx.proj, ".pi", "state", "chet", "sessions");
+  const regs = [{ version: 1, seat: "chet", project: "proj", layout: "repo", harness: "claude-code", sessionsDir: chetDir, startedAt: time(-1) }];
+  const roots = rootsFromSpecs([fx.spec], regs);
+  const plain = noWrites(fx.base, () => createReader({ roots }).catalogue());
+  const placeholder = plain.conversations.find((c) => c.availability === "unsupported");
+  assert.ok(placeholder, "without M7 the unsupported placeholder is listed");
+  const reader = createReader({ roots, creativeCheck: () => (root) => root.seat === "bean" || root.seat === "chet" });
+  const cat = noWrites(fx.base, () => reader.catalogue());
+  assert.deepEqual(cat.conversations, []);
+  const bean = roots.find((r) => r.seat === "bean");
+  for (const conversation of [placeholder.conversation, conversationId(bean, "link.jsonl"), conversationId(bean, "s.jsonl")]) {
+    const r = noWrites(fx.base, () => reader.open({ conversation }));
+    assert.deepEqual([r.ok, r.refusal.code], [false, "conversation-not-listed"]);
+  }
+  assert.equal(JSON.stringify(cat).includes("CREATIVE-MARKER"), false);
+});
+
 test("unknown conversations, empty files and non-Pi files refuse", () => {
   const fx = project();
   writeFileSync(join(fx.dir, "empty.jsonl"), "");

packages/discord/src/cli.mjs

@@ -47,11 +47,12 @@
 // not retry); 4 usage.
 
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync, statSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { DiscordError } from "./errors.mjs";
 import { assertProcessing, processingStatus, ProcessingError } from "../../processing-control/src/state.mjs";
 import { registerRuntime, updateRuntime, unregisterRuntime, processIdentity } from "../../processing-control/src/runtimes.mjs";
+import { loadSeatSets } from "../../business/src/library-seats.mjs";
 import { defaultConfigPath, loadDataRoot, bindingPath, bindingDataDir, loadBinding, readToken, resolveContextFiles, resolveToolRoots, reloadDiff } from "./binding.mjs";
 import { createRest } from "./rest.mjs";
 import { createGateway, CONNECTOR_INTENTS } from "./gateway.mjs";
@@ -104,12 +105,33 @@ function warn(msg) {
   process.stderr.write(`discord: ${msg}\n`);
 }
 
+// Case 2 M8 (design 5.1, row 220): a seat that works in a library business runs
+// only on the mosaic-bus engine, with no tools key. The business files come from
+// the config directory --config names. An unreadable file refuses; it never reads
+// as "no library seats".
+function checkLibraryEngine(configDirectory, binding) {
+  let sets;
+  try {
+    sets = loadSeatSets({ dir: configDirectory });
+  } catch (err) {
+    throw new DiscordError(`discord-business-unreadable: ${err.message}`, 2);
+  }
+  if (!sets.librarySeats.has(binding.seat)) return;
+  if (binding.engine.provider !== "mosaic-bus") {
+    throw new DiscordError(`discord-engine-not-allowed: binding ${binding.name} runs seat ${binding.seat}, which works in a library business; its engine must be mosaic-bus, not ${binding.engine.provider}`, 2);
+  }
+  if (binding.tools !== null) {
+    throw new DiscordError(`discord-engine-not-allowed: binding ${binding.name} runs seat ${binding.seat}, which works in a library business; a mosaic-bus binding there may not declare the tools key`, 2);
+  }
+}
+
 // Everything that can be checked without the network, shared by check and run.
 function prepare(opts) {
   const dataRoot = loadDataRoot(opts.config);
   const bindingFile = bindingPath(dataRoot, opts.binding);
   const binding = loadBinding(bindingFile);
   if (binding.name !== opts.binding) throw new DiscordError(`binding name ${JSON.stringify(binding.name)} does not match file name ${opts.binding}`);
+  checkLibraryEngine(dirname(opts.config), binding);
   const contextFiles = resolveContextFiles(binding, opts.repo);
   const toolRoots = resolveToolRoots(binding, { dataRoot });
   const pi = join(opts.repo, "node_modules", ".bin", "pi");

packages/discord/tests/helpers.mjs

@@ -77,6 +77,9 @@ export function makeDeployment(root, overrides = {}, { tokenMode = 0o600, tokenC
   writeFileSync(bindingFile, JSON.stringify(raw, null, 2), { mode: 0o600 });
   const config = join(root, "config.json");
   writeFileSync(config, JSON.stringify({ dataRoot }));
+  // Row 220 M8: check and run read <root>/businesses beside --config. Nothing
+  // there means no library seat, so a deployment starts with none; the tests
+  // that need one write a business file into it.
   return { dataRoot, config, bindingFile, tokenFile, raw, journalDir: join(dataRoot, "discord", raw.name) };
 }
 

packages/discord/tests/library-seat.test.mjs

@@ -0,0 +1,118 @@
+// Case 2 M8 (design 5.1, row 220): a binding for a seat in a library business
+// runs only on the mosaic-bus engine with no tools key. The business files sit
+// in the directory beside --config. An unreadable file refuses with
+// discord-business-unreadable. Both verbs refuse: check runs with --offline, and
+// run refuses in prepare(), before the journal is made and before any network.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { makeRoot, makeRepo, makeDeployment } from "./helpers.mjs";
+import { initializeControl } from "../../processing-control/src/state.mjs";
+import { businessDoc, writeJson } from "../../business/tests/helpers.mjs";
+import { mappingEntry } from "../../library/tests/helpers.mjs";
+
+const CLI = fileURLToPath(new URL("../src/cli.mjs", import.meta.url));
+const MOSAIC_BUS = { provider: "mosaic-bus", model: "glm-5.3", thinking: "high" };
+
+// overrides may be a function of the root, for fixtures that need a path under it.
+function setup(overrides = {}) {
+  const root = makeRoot();
+  const repo = makeRepo(root);
+  const extra = typeof overrides === "function" ? overrides(root) : overrides;
+  const d = makeDeployment(root, extra, { tokenContent: "MTAw.abcdefghijklmnopqrstuvwxyz0123456789" });
+  return { root, repo, d };
+}
+
+// Writes businesses/acme.json under the deployment's config directory. A library
+// business puts its roles (the seat "sage" here) in the library sets.
+function business(s, { library, role = "sage", definition = "companion" }) {
+  const doc = businessDoc(s.root, "acme");
+  if (library) doc.projects = { books: mappingEntry(), ...doc.projects };
+  doc.roles[role] = { definition };
+  writeJson(join(s.root, "businesses", "acme.json"), doc);
+}
+
+// run stops at the processing gate first, so the deployment's control state is initialised.
+function run(s) {
+  initializeControl(s.d.dataRoot);
+  return spawnSync(process.execPath, [CLI, "run", s.d.raw.name, "--config", s.d.config, "--repo", s.repo], { encoding: "utf8", timeout: 10000 });
+}
+
+function check(s) {
+  return spawnSync(process.execPath, [CLI, "check", s.d.raw.name, "--config", s.d.config, "--repo", s.repo, "--offline"], { encoding: "utf8", timeout: 10000 });
+}
+
+test("M8: a library seat's binding on a non-mosaic-bus engine is refused before any network", () => {
+  const s = setup();
+  business(s, { library: true });
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*its engine must be mosaic-bus, not zai/);
+});
+
+test("M8: a library seat's mosaic-bus binding that declares tools is refused, and the message names tools", () => {
+  const s = setup((root) => ({ engine: MOSAIC_BUS, tools: { roots: [{ name: "docs", path: join(root, "docs") }] } }));
+  business(s, { library: true });
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*tools key/);
+});
+
+test("M8: a library seat's mosaic-bus binding with no tools passes the engine rule", () => {
+  const s = setup({ engine: MOSAIC_BUS });
+  business(s, { library: true });
+  const r = check(s);
+  assert.doesNotMatch(r.stderr, /discord-engine-not-allowed|discord-business-unreadable/);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /offline check passed/);
+});
+
+test("M8: an unreadable business file refuses check with discord-business-unreadable", () => {
+  const s = setup();
+  mkdirSync(join(s.root, "businesses"));
+  writeFileSync(join(s.root, "businesses", "broken.json"), "{");
+  chmodSync(join(s.root, "businesses", "broken.json"), 0o600);
+  const r = check(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-business-unreadable/);
+});
+
+test("M8: a binding on a seat that is in no library business checks clean, whatever its engine", () => {
+  const s = setup();
+  business(s, { library: false });
+  const r = check(s);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /offline check passed/);
+});
+
+test("M8: run refuses a library seat's raw engine with exit 2, before the journal is made and before any network", () => {
+  const s = setup();
+  business(s, { library: true });
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*its engine must be mosaic-bus, not zai/);
+  assert.equal(existsSync(s.d.journalDir), false, "nothing was started");
+});
+
+test("M8: run refuses a library seat's mosaic-bus binding that declares tools", () => {
+  const s = setup((root) => ({ engine: MOSAIC_BUS, tools: { roots: [{ name: "docs", path: join(root, "docs") }] } }));
+  business(s, { library: true });
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-engine-not-allowed: .*tools key/);
+  assert.equal(existsSync(s.d.journalDir), false);
+});
+
+test("M8: an unreadable business file refuses run with discord-business-unreadable, before the journal is made", () => {
+  const s = setup();
+  mkdirSync(join(s.root, "businesses"));
+  writeFileSync(join(s.root, "businesses", "broken.json"), "{");
+  chmodSync(join(s.root, "businesses", "broken.json"), 0o600);
+  const r = run(s);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /discord-business-unreadable/);
+  assert.equal(existsSync(s.d.journalDir), false);
+});

packages/library/README.md

@@ -31,33 +31,72 @@ deep-frozen copy. `where` names the entry in messages. `fail(code, message)` def
 - `user` is the bot account name from design step 3, required for sync. It is optional in the
   mapping and checked with row 199's account name pattern, `[A-Za-z0-9_.-]`, 1 to 100 characters.
 - `vaultPrefix` is optional, one folder name.
+- `editor` is optional, `{ "name", "email" }` plus an optional `"user"`: the ident her Console saves commit under
+  (C2-01d). Each value is text that is non-empty after trim, with no control character
+  (`U+0000`-`U+001F`, `U+007F`-`U+009F`), `<` or `>`, and no whitespace or git-stripped character at
+  either end. `user` is her Gitea login for the `library-human` slot (sage-2925), checked as the
+  entry's `user` is. `editor` and its `user` come back only when given; a save without them refuses
+  in C2-02.
 - `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
   `manuscript` lists folder names and shares none with `types`.
 - A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
   plain-universe `sources`, `constraints` (each one `{ "exclude": ... }` or
   `{ "pin": { "entity", "field", "value" } }`) and `notes`, and may have `books: []`. A draft
   universe has only `kind: "draft"`, `name` and one or more `playground` prefixes, and comes back as
-  `{ kind: "draft", name, books: [], playground }`. `kind` is absent, `"hybrid"` or `"draft"`.
+  `{ kind: "draft", name, books: [], playground, supporting }`. `kind` is absent, `"hybrid"` or `"draft"`.
 - A playground prefix ends in `/` and has one of three levels (C2-01c). Book level lies inside one of
   its own entry's book folders. Universe level, in a plain universe or a hybrid, lies outside every
   book folder. A draft's prefixes all lie outside every book folder. No prefix holds another or is
   listed twice, across every entry.
+- Every universe kind may also have `supporting`, a list of prefixes where agents may write (C2-01d,
+  M12). It comes back on every universe, `[]` when absent. A supporting prefix follows the playground's
+  rules: it ends in `/`, has the same three levels, holds no other supporting prefix and is listed
+  once, across every entry.
+- Between the two lists: a supporting prefix may equal a playground prefix of its own entry, and a
+  playground prefix may hold one of its own entry's supporting prefixes. A supporting prefix may not
+  hold a playground prefix, which scope would then never reach, and may not equal, hold or lie inside
+  another entry's playground prefix.
 
 Refusals:
 
 | Code | When |
 |---|---|
 | `library-playground-other-universe` | a playground prefix lies inside, or holds, a book folder of another entry |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground prefix that holds another or is listed twice, a prefix equal to a book folder or holding its own entry's book, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
+| `library-supporting-other-universe` | a supporting prefix lies inside, or holds, a book folder of another entry |
+| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, an unknown `kind`, a book folder in two universes, a book folder that holds another, a playground or supporting prefix that holds another of its list or is listed twice, a prefix equal to a book folder or holding its own entry's book, a supporting prefix that holds a playground prefix or overlaps another entry's, a bad `editor`, a draft with `books` or with no prefix, a hybrid source that is unknown, a hybrid or a draft |
 
 ## Scope
 
 `classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. It checks prefixes first. A path under any entry's playground prefix is `playground`, with that
-entry as `universe` and the book folder holding the prefix as `book`, or `null` at universe level and
+mapped. It checks prefixes first, supporting before playground. A path under any entry's supporting
+prefix is `supporting`, and otherwise one under a playground prefix is `playground`. Either way that
+entry is `universe` and the book folder holding the prefix is `book`, or `null` at universe level and
 in a draft. Any other path under a book folder is `canon`. Everything else is `unmapped`. The type is
-the first folder after the playground prefix, or after the book: a `types` name, `manuscript`, or
-`null`.
+the first folder after the prefix, or after the book: a `types` name, `manuscript`, or `null`.
+
+## Agent write paths
+
+`supportingPath(mapping, universe, path, tree)` returns `path` when an agent may write it in that
+universe, else it refuses `library-write-story-path` (C2-01d, M12). `tree` is the array `listTree`
+returns for the commit the write lands on; anything else is a TypeError. It reads no git. The checks
+run in this order, so a path with two faults always names the same one:
+
+1. a string of at most 1,024 UTF-8 bytes;
+2. no control character (the `editor` class), and the message leaves the path out;
+3. no backslash;
+4. not absolute;
+5. no empty, `.` or `..` segment, which also refuses `//` and a trailing `/`;
+6. `classify` gives `supporting` in that same universe, which refuses unmapped, `.canvas`, `.base`
+   and attachment paths, canon, a playground-only folder and another universe's prefix;
+7. no folder on the way, and not the path itself, is a symlink (`120000`) or gitlink (`160000`) in
+   `tree`;
+8. no folder on the way, and not the path itself, matches a tree path or tree folder after
+   `normalize('NFC').toLowerCase()` unless it is that exact name. APFS folds case and Unicode form,
+   so her checkout would put the file somewhere else. A tree that already holds case twins refuses a
+   write to either (R7).
+
+A delete's further rule, that the path exists at the tip as a `100644` blob, belongs to the C2-02
+broker.
 
 ## Reader
 

packages/library/src/index-build.mjs

@@ -0,0 +1,75 @@
+// The lookup index of design 3 (C2-05a): types, names, links and backlinks for one commit of her repo.
+// It is built from the reader's output, so it holds only mapped, readable files: R1, R2 and R7 leave a
+// file out, and an unresolved link is not in it. It is cached in memory by commit id. The key also
+// carries the repo path and a digest of the mapping, because one commit reads differently under another
+// mapping. The index is not universe-aware; query.mjs decides what a universe may see.
+import { createHash } from 'node:crypto';
+import { readLibrary } from './reader.mjs';
+import { raise } from './problems.mjs';
+
+const CACHE_LIMIT = 8;
+const cache = new Map();
+
+const push = (map, key, value) => {
+  if (!map.has(key)) map.set(key, []);
+  map.get(key).push(value);
+};
+// A file's name for lookups: its front matter `name` when it is text, else its file name.
+const displayName = file => {
+  const name = file.frontmatter?.name;
+  return typeof name === 'string' && name.trim() ? name.trim() : file.name;
+};
+// A link as the index keeps it: the file at the other end, its line, and the field when front matter holds it.
+const linkAt = (path, link) => ({ path, line: link.line, ...(link.field === undefined ? {} : { field: link.field }) });
+
+// Builds the index from readLibrary's output. Pure: no git, no clock.
+export function buildIndex(library, mapping) {
+  const files = new Map(), types = new Map(), names = new Map(), linksOut = new Map(), linksIn = new Map();
+  for (const file of library.files) {
+    const name = displayName(file);
+    files.set(file.path, {
+      path: file.path, scope: file.scope, universe: file.universe, book: file.book, type: file.type,
+      folder: file.folder, stem: file.name, name, frontmatter: file.frontmatter, lines: file.lines,
+    });
+    if (file.type !== null) push(types, file.type, file.path);
+    push(names, name.toLowerCase(), file.path);
+    linksOut.set(file.path, file.links.map(link => linkAt(link.path, link)));
+    for (const link of file.links) push(linksIn, link.path, linkAt(file.path, link));
+  }
+  return Object.freeze({
+    commit: library.commit, mapping, files, paths: [...files.keys()], types, names, linksOut, linksIn,
+    problems: library.problems,
+  });
+}
+
+const digest = mapping => createHash('sha256').update(JSON.stringify(mapping)).digest('hex');
+
+// The index for one commit under one mapping, read once and kept in memory. A repeat call returns the same
+// object. Past CACHE_LIMIT entries the oldest goes. A failed read is not kept.
+export async function indexFor({ repo, commit, mapping }) {
+  if (!mapping || mapping.kind !== 'library') raise('library-mapping-invalid', 'expected a checked library mapping');
+  const key = JSON.stringify([repo, commit, digest(mapping)]);
+  if (cache.has(key)) {
+    const hit = cache.get(key);
+    cache.delete(key);
+    cache.set(key, hit);
+    return hit;
+  }
+  const pending = readLibrary({ repo, commit, mapping }).then(library => buildIndex(library, mapping));
+  cache.set(key, pending);
+  while (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
+  try {
+    return await pending;
+  } catch (error) {
+    if (cache.get(key) === pending) cache.delete(key);
+    throw error;
+  }
+}
+
+export function clearIndexCache() {
+  cache.clear();
+}
+
+export function indexCacheSize() {
+  return cache.size;
+}

packages/library/src/index.mjs

@@ -2,9 +2,12 @@
 export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
 export { checkMapping, TYPES } from './mapping.mjs';
 export { classify } from './scope.mjs';
+export { supportingPath } from './supporting.mjs';
 export { extractLinks, parseWikilink, resolver, formOf, isAttachment } from './links.mjs';
 export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
 export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';
 export { survey, formatSurvey, surveyMain } from './survey.mjs';
 export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';
 export { syncCommand, sync, ASKPASS, SLOT, SYNC_INTERVAL_MS } from './sync.mjs';
+export { buildIndex, indexFor, clearIndexCache, indexCacheSize } from './index-build.mjs';
+export { sees, find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from './query.mjs';

packages/library/src/mapping.mjs

@@ -1,8 +1,9 @@
 // The library project entry of a business file (design 1.1): her folders mapped onto universes,
 // books, type folders, manuscript folders and playground prefixes at three levels (ruling after r11,
-// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. A pure validator. Business file
-// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
-// problem. Agents can't write this entry (M9, C2-04).
+// C2-01c): inside one of the entry's books, outside every book, or in a draft universe. Supporting
+// prefixes (C2-01d) follow the same rules and are where agents may write (M12). A pure validator.
+// Business file loading wires it in C2-04, which passes its own `fail` so the refusal reads as a
+// business file problem. Agents can't write this entry (M9, C2-04).
 import { raise } from './problems.mjs';
 
 export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
@@ -12,6 +13,12 @@ const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const USER = /^[A-Za-z0-9_.-]{1,100}$/;
 const CONSTRAINT_KEYS = ['exclude', 'pin'];
 const KINDS = ['hybrid', 'draft'];
+// C2-01d (F41): the editor ident her Console saves commit under. Git drops `<` and `>` from an ident
+// and commits under a different name, so they refuse here (webby-0169 R1).
+const IDENT_BAD = /[\u0000-\u001f\u007f-\u009f<>]/;
+// Git's ident.c crud() strips any byte <= 0x20 and , : ; < > " \ ' from both ends of an ident, so a
+// value that starts or ends with one would save one name and commit another (sage-3601, sage-3606).
+const IDENT_CRUD_END = /^[\u0000-\u0020,:;<>"\\']|[\u0000-\u0020,:;<>"\\']$/;
 
 // A folder segment from her vault: spaces and capitals are fine, separators, control characters
 // and dot names are not.
@@ -40,7 +47,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   };
 
   object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
+  only(entry, ['kind', 'remote', 'branch', 'user', 'vaultPrefix', 'editor', 'universes', 'types', 'manuscript'], 'entry');
   if (entry.kind !== 'library') bad('kind must be "library"');
   let url;
   try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
@@ -52,6 +59,20 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   if (Object.hasOwn(entry, 'user') && (typeof entry.user !== 'string' || !USER.test(entry.user)))
     bad('user must be a plain account name');
   if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
+  if (Object.hasOwn(entry, 'editor')) {
+    object(entry.editor, 'editor');
+    only(entry.editor, ['name', 'email', 'user'], 'editor');
+    // Her Gitea login for the library-human slot, which C2-02 passes in (sage-2925). Optional here.
+    if (Object.hasOwn(entry.editor, 'user') && (typeof entry.editor.user !== 'string' || !USER.test(entry.editor.user)))
+      bad('editor.user must be a plain account name');
+    for (const key of ['name', 'email']) {
+      const value = entry.editor[key];
+      if (typeof value !== 'string' || !value.trim() || IDENT_BAD.test(value))
+        bad(`editor.${key} must be non-empty text with no control character, < or >`);
+      if (value.trim() !== value || IDENT_CRUD_END.test(value))
+        bad(`editor.${key} must not start or end with whitespace or any of , : ; " ' \\`);
+    }
+  }
 
   object(entry.types, 'types');
   for (const [name, type] of Object.entries(entry.types)) {
@@ -64,6 +85,7 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   object(entry.universes, 'universes');
   if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
   const universes = {}, bookOwner = new Map(), prefixes = [], prefixOwner = new Map();
+  const supports = [], supportOwner = new Map();
   for (const [id, universe] of Object.entries(entry.universes)) {
     const name = `universes.${id}`;
     if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
@@ -71,8 +93,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     if (Object.hasOwn(universe, 'kind') && !KINDS.includes(universe.kind)) bad(`${name}.kind must be "hybrid" or "draft"`);
     const hybrid = universe.kind === 'hybrid', draft = universe.kind === 'draft';
     if (draft && Object.hasOwn(universe, 'books')) bad(`${name} is a draft and takes no books`);
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes']
-      : draft ? ['kind', 'name', 'playground'] : ['name', 'books', 'playground'], name);
+    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'supporting', 'constraints', 'notes']
+      : draft ? ['kind', 'name', 'playground', 'supporting'] : ['name', 'books', 'playground', 'supporting'], name);
     if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
       bad(`${name}.name must be a short display name`);
     const books = draft ? [] : list(universe.books, `${name}.books`, folder, 'a folder path');
@@ -81,12 +103,14 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
       if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
       bookOwner.set(book, id);
     }
-    const playground = list(universe.playground ?? [], `${name}.playground`,
-      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
+    const prefix = value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1));
+    const playground = list(universe.playground ?? [], `${name}.playground`, prefix, 'a folder path ending in /');
     if (draft && !playground.length) bad(`${name}.playground must name at least one prefix`);
-    for (const prefix of playground) { prefixes.push(prefix); prefixOwner.set(prefix, id); }
-    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground }; continue; }
-    const out = { name: universe.name, books, playground };
+    for (const p of playground) { prefixes.push(p); prefixOwner.set(p, id); }
+    const supporting = list(universe.supporting ?? [], `${name}.supporting`, prefix, 'a folder path ending in /');
+    for (const p of supporting) { supports.push(p); supportOwner.set(p, id); }
+    if (draft) { universes[id] = { kind: 'draft', name: universe.name, books, playground, supporting }; continue; }
+    const out = { name: universe.name, books, playground, supporting };
     if (hybrid) {
       out.kind = 'hybrid';
       out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
@@ -124,18 +148,36 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
   for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
   for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
   if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
+  for (const a of supports) for (const b of supports) if (a !== b && holds(a, b)) bad(`supporting ${JSON.stringify(a)} holds supporting ${JSON.stringify(b)}`);
+  if (new Set(supports).size !== supports.length) bad('a supporting prefix is listed twice');
   // A prefix's level comes from where it sits (ruling after r11). Inside one of its own entry's books
   // is book level, outside every book is universe level, and a draft's prefixes are all outside. Scope
   // checks prefixes first (scope.mjs), so a prefix equal to or holding a book would turn that book
-  // into playground.
-  for (const [prefix, id] of prefixOwner) {
-    for (const [book, owner] of bookOwner) {
-      const at = `universes.${id}.playground ${JSON.stringify(prefix)}`;
-      if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
-      const inside = holds(book, prefix), holding = holds(prefix, book);
-      if ((inside || holding) && owner !== id)
-        fail('library-playground-other-universe', `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
-      if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+  // into playground or supporting.
+  const againstBooks = (owners, list, code) => {
+    for (const [prefix, id] of owners) {
+      for (const [book, owner] of bookOwner) {
+        const at = `universes.${id}.${list} ${JSON.stringify(prefix)}`;
+        if (prefix === `${book}/`) bad(`${at} is the whole book folder ${JSON.stringify(book)}`);
+        const inside = holds(book, prefix), holding = holds(prefix, book);
+        if ((inside || holding) && owner !== id)
+          fail(code, `${where} ${at} ${inside ? 'lies inside' : 'holds'} book folder ${JSON.stringify(book)} of universes.${owner}`);
+        if (holding) bad(`${at} holds its own book folder ${JSON.stringify(book)}`);
+      }
+    }
+  };
+  againstBooks(prefixOwner, 'playground', 'library-playground-other-universe');
+  againstBooks(supportOwner, 'supporting', 'library-supporting-other-universe');
+  // C2-01d, between the lists. A supporting prefix may equal a playground prefix of its own entry, and
+  // a playground may hold one of its own entry's supporting prefixes. A supporting prefix that holds a
+  // playground would hide it, since scope checks supporting first. Any overlap across entries would
+  // give one path two universes.
+  for (const [s, sid] of supportOwner) {
+    for (const [p, pid] of prefixOwner) {
+      const at = `universes.${sid}.supporting ${JSON.stringify(s)}`;
+      if (sid !== pid && (s === p || holds(s, p) || holds(p, s)))
+        bad(`${at} overlaps playground ${JSON.stringify(p)} of universes.${pid}`);
+      if (sid === pid && s !== p && holds(s, p)) bad(`${at} holds playground ${JSON.stringify(p)}`);
     }
   }
 
@@ -143,6 +185,8 @@ export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
     kind: 'library', remote: entry.remote, branch: entry.branch,
     ...(Object.hasOwn(entry, 'user') ? { user: entry.user } : {}),
     ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
+    ...(Object.hasOwn(entry, 'editor') ? { editor: { name: entry.editor.name, email: entry.editor.email,
+      ...(Object.hasOwn(entry.editor, 'user') ? { user: entry.editor.user } : {}) } } : {}),
     universes, types: { ...entry.types }, manuscript,
   });
 }

packages/library/src/query.mjs

@@ -0,0 +1,240 @@
+// The lookup queries of design 3 (C2-05a): find, get, search, manuscript and universeInfo. Each takes a
+// source {repo, commit, mapping} and an argument object, and returns a reply that fits QUERY_REPLY_CAP.
+// Universe isolation is here, in sees(): a file reaches a reply only when sees() allows it. Scope comes
+// from the path (D2). Unmapped files are not in the index, so they never appear. Lists page by position
+// and never cut an item. A search line too long to fit alone comes back as a marked hit with no excerpt;
+// a find item, a file's front matter or one of its lines that cannot fit alone is refused.
+import { raise } from './problems.mjs';
+import { TYPES } from './mapping.mjs';
+import { indexFor } from './index-build.mjs';
+
+// The same cap as packages/harness/src/tools.mjs REPLY_CAP. The query tests assert the two stay equal.
+export const QUERY_REPLY_CAP = 40_000;
+export const LOOKUP_LIMIT = 50;
+export const MANUSCRIPT_LINES = 400;
+const SCOPES = Object.freeze(['canon', 'playground']);
+
+const bytes = value => JSON.stringify(value).length;
+const invalid = message => raise('query-argument-invalid', message);
+const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
+
+function textArg(value, name) {
+  if (typeof value !== 'string') invalid(`${name} must be text`);
+  return value;
+}
+function scopeArg(value) {
+  if (value === undefined) return 'canon';
+  if (!SCOPES.includes(value)) invalid('scope must be "canon" or "playground"');
+  return value;
+}
+function positionArg(value, name, fallback) {
+  if (value === undefined) return fallback;
+  if (!Number.isSafeInteger(value) || value < 1) invalid(`${name} must be a line number of 1 or more`);
+  return value;
+}
+function offsetArg(value) {
+  if (value === undefined) return 0;
+  if (!Number.isSafeInteger(value) || value < 0) invalid('offset must be a whole number of 0 or more');
+  return value;
+}
+function universeArg(mapping, value) {
+  if (typeof value !== 'string' || !value) invalid('universe is required');
+  if (!Object.hasOwn(mapping.universes, value)) raise('query-universe-unknown', `this library has no universe ${JSON.stringify(value)}`);
+  return value;
+}
+
+// Whether universe U may see a file. Its own files, in either scope. A hybrid also sees the canon of
+// its declared sources, minus the folders its exclude constraints name. A hybrid never sees a source's
+// playground. Pin constraints do not hide anything; they are reported by universeInfo only.
+export function sees(mapping, universe, file) {
+  if (file.universe === universe) return true;
+  const entry = mapping.universes[universe];
+  if (entry.kind !== 'hybrid' || !entry.sources.includes(file.universe) || file.scope !== 'canon') return false;
+  return !entry.constraints.some(c => c.exclude !== undefined && inside(c.exclude, file.path));
+}
+
+// The files one universe may see in one scope, with optional book and type filters, in path order.
+async function visible(source, universe, { scope, book, type }) {
+  const index = await indexFor(source);
+  const files = index.paths
+    .map(path => index.files.get(path))
+    .filter(file => file.scope === scope && sees(index.mapping, universe, file)
+      && (book === undefined || file.book === book) && (type === undefined || file.type === type));
+  return { index, files };
+}
+
+// A reply whose size is over the cap is refused, never cut.
+function checked(reply) {
+  if (bytes(reply) > QUERY_REPLY_CAP) raise('query-item-too-large', `the reply is over the ${QUERY_REPLY_CAP}-character cap`);
+  return reply;
+}
+
+// Picks items from `offset`, at most `limit`, while the reply still fits. build(picked, next) returns
+// the reply; `next` is the position of the first item not picked, or null when none is left. An item
+// that cannot fit even alone is refused: skipping it would hide it, and cutting it would break it.
+function fitPage(items, { offset = 0, limit = LOOKUP_LIMIT, build }) {
+  const picked = [];
+  let at = offset;
+  while (at < items.length && picked.length < limit) {
+    // The size check uses items.length for `next`, the widest number a cursor can take, so a page never runs over.
+    if (bytes(build([...picked, items[at]], items.length)) > QUERY_REPLY_CAP) {
+      if (!picked.length) raise('query-item-too-large', `the item at position ${at} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+      break;
+    }
+    picked.push(items[at]);
+    at += 1;
+  }
+  return checked(build(picked, at < items.length ? at : null));
+}
+
+// find: the files whose name or file name holds `query`, case-insensitive. Up to 50 per page.
+export async function find(source, { universe: name, query, type, book, scope, offset } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const needle = textArg(query, 'query').toLowerCase();
+  if (type !== undefined && !TYPES.includes(type)) invalid(`type must be one of ${TYPES.join(', ')}`);
+  const { index, files } = await visible(source, universe, {
+    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'), type,
+  });
+  const hits = files.filter(file => file.name.toLowerCase().includes(needle) || file.stem.toLowerCase().includes(needle));
+  return fitPage(hits, {
+    offset: offsetArg(offset),
+    build: (picked, next) => ({
+      commit: index.commit,
+      results: picked.map(file => ({
+        path: file.path, type: file.type, name: file.name, appears_in: file.frontmatter?.appears_in ?? null,
+        scope: file.scope, universe: file.universe, book: file.book,
+      })),
+      next,
+    }),
+  });
+}
+
+// get: one visible file, its front matter, its lines from `from`, and its visible links both ways.
+// Returns null when the file is missing or not visible, so a caller cannot tell the two apart. Lines page
+// by `from` (reply `next`), links page together by `links_from` (reply `links_next`); `links_out` come
+// before `links_in`. Every page carries the front matter. Links take at most half the cap, so a hub note
+// with many backlinks stays readable and still leaves room for lines. A page with lines left carries at
+// least one line, so links shrink when a line needs the room; read on with `from: next` and
+// `links_from: links_next`. A `from` past the last line returns links alone. Only front matter, or a
+// line that cannot fit with no links beside it, is refused.
+export async function get(source, { universe: name, path, from, links_from: linksFrom } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const startLine = positionArg(from, 'from', 1);
+  const linkStart = offsetArg(linksFrom);
+  if (typeof path !== 'string') invalid('path must be text');
+  const index = await indexFor(source);
+  const file = index.files.get(path);
+  if (!file || !sees(index.mapping, universe, file)) return null;
+  const reachable = links => links.filter(link => {
+    const other = index.files.get(link.path);
+    return other !== undefined && sees(index.mapping, universe, other);
+  });
+  const outs = reachable(index.linksOut.get(file.path) ?? []);
+  const ins = reachable(index.linksIn.get(file.path) ?? []);
+  const links = [...outs.map(link => ({ out: true, link })), ...ins.map(link => ({ out: false, link }))];
+  const lines = file.lines.slice(startLine - 1);
+  const linkRest = Math.max(0, links.length - linkStart);
+  const page = (nLines, nLinks) => {
+    const taken = links.slice(linkStart, linkStart + nLinks);
+    return {
+      path: file.path, commit: index.commit, scope: file.scope, frontmatter: file.frontmatter,
+      lines: lines.slice(0, nLines),
+      links_out: taken.filter(item => item.out).map(item => item.link),
+      links_in: taken.filter(item => !item.out).map(item => item.link),
+      next: nLines < lines.length ? startLine + nLines : null,
+      links_next: nLinks < linkRest ? linkStart + nLinks : null,
+    };
+  };
+  // How many leading items fit in `room`, by each item's own size.
+  const count = (items, room) => {
+    let used = 0, n = 0;
+    while (n < items.length && used + bytes(items[n]) + 1 <= room) used += bytes(items[n++]) + 1;
+    return n;
+  };
+  const base = bytes(page(0, 0));
+  if (base > QUERY_REPLY_CAP) raise('query-item-too-large', `the front matter of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  if (lines.length && bytes(page(1, 0)) > QUERY_REPLY_CAP) {
+    raise('query-item-too-large', `line ${lines[0][0]} of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  }
+  const rest = links.slice(linkStart);
+  let nLinks = count(rest, (lines.length ? Math.floor(QUERY_REPLY_CAP / 2) : QUERY_REPLY_CAP) - base);
+  if (!nLinks && rest.length) nLinks = count(rest, QUERY_REPLY_CAP - base);
+  if (!nLinks && rest.length) raise('query-item-too-large', `a link of ${file.path} alone is over the ${QUERY_REPLY_CAP}-character cap`);
+  while (lines.length && nLinks > 0 && bytes(page(1, nLinks)) > QUERY_REPLY_CAP) nLinks = Math.floor(nLinks / 2);
+  let nLines = Math.max(lines.length ? 1 : 0, count(lines, QUERY_REPLY_CAP - bytes(page(0, nLinks))));
+  while (nLines > 1 && bytes(page(nLines, nLinks)) > QUERY_REPLY_CAP) nLines -= 1;
+  return checked(page(nLines, nLinks));
+}
+
+// search: lines whose text holds `text`, case-insensitive. The excerpt is the whole line. Up to 50 per page.
+export async function search(source, { universe: name, text, book, scope, offset } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const needle = textArg(text, 'text').toLowerCase();
+  if (!needle) invalid('text must not be empty');
+  const { index, files } = await visible(source, universe, {
+    scope: scopeArg(scope), book: book === undefined ? undefined : textArg(book, 'book'),
+  });
+  const hits = [];
+  for (const file of files) {
+    for (const [line, body] of file.lines) {
+      if (!body.toLowerCase().includes(needle)) continue;
+      const hit = { path: file.path, line, excerpt: body, scope: file.scope };
+      // The excerpt is the whole line. A line too long to fit alone is marked, not cut and not refused.
+      hits.push(bytes({ commit: index.commit, results: [hit], next: Number.MAX_SAFE_INTEGER }) > QUERY_REPLY_CAP
+        ? { path: file.path, line, excerpt: null, excerpt_too_long: true, scope: file.scope } : hit);
+    }
+  }
+  return fitPage(hits, {
+    offset: offsetArg(offset),
+    build: (picked, next) => ({ commit: index.commit, results: picked, next }),
+  });
+}
+
+// manuscript: one chapter file of a book, by its file name, up to 400 lines per call from `from` to `to`.
+// Without a chapter it returns the book's first chapter file in path order. Every reply carries
+// `next_chapter`, the next chapter file's name in path order or null. A name that matches two visible
+// files is refused. Files outside every book (book null) are never chapters of a book.
+export async function manuscript(source, { universe: name, book, scope, chapter, from, to } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const bookName = textArg(book, 'book');
+  const chapterName = chapter === undefined ? undefined : textArg(chapter, 'chapter');
+  const start = positionArg(from, 'from', 1);
+  const end = positionArg(to, 'to', Infinity);
+  if (end < start) invalid('to must not be before from');
+  const { index, files } = await visible(source, universe, { scope: scopeArg(scope), book: bookName, type: 'manuscript' });
+  let at = 0;
+  if (chapterName !== undefined) {
+    const matches = files.filter(file => file.stem === chapterName);
+    if (matches.length > 1) raise('query-chapter-ambiguous', `${matches.length} visible files are named ${JSON.stringify(chapterName)}`);
+    if (!matches.length) return null;
+    at = files.indexOf(matches[0]);
+  }
+  const file = files[at];
+  if (!file) return null;
+  const nextChapter = files[at + 1]?.stem ?? null;
+  return fitPage(file.lines.slice(start - 1, end), {
+    limit: MANUSCRIPT_LINES,
+    build: (picked, next) => ({
+      path: file.path, commit: index.commit, scope: file.scope, lines: picked,
+      next: next === null ? null : start + next, next_chapter: nextChapter,
+    }),
+  });
+}
+
+// universeInfo: a universe's kind, name, books, playground prefixes, type folders and manuscript folders.
+// A hybrid adds its sources, constraints and notes. A draft has no books and no canon: its kind, name
+// and prefixes are the whole answer beside the mapping's types. It reads only the checked mapping and the
+// served commit.
+export async function universeInfo(source, { universe: name } = {}) {
+  const universe = universeArg(source.mapping, name);
+  const entry = source.mapping.universes[universe];
+  const hybrid = entry.kind === 'hybrid';
+  return checked({
+    commit: source.commit, universe, name: entry.name, kind: entry.kind ?? 'universe',
+    books: entry.books, playground: entry.playground, types: source.mapping.types, manuscript: source.mapping.manuscript,
+    ...(hybrid ? {
+      sources: entry.sources, constraints: entry.constraints,
+      ...(entry.notes === undefined ? {} : { notes: entry.notes }),
+    } : {}),
+  });
+}

packages/library/src/scope.mjs

@@ -2,16 +2,22 @@
 // Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
 const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
 
-// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// Prefixes come first (ruling after r11, C2-01c): a `.md` file under any entry's playground prefix is
-// playground, with that entry as `universe` and the book folder that holds the prefix as `book`, or
-// null at universe level and in a draft. Otherwise a `.md` file in a book folder is canon. `type` is
-// the mapped type of the first folder under the prefix (playground) or under the book (canon),
+// { scope: 'supporting' | 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
+// Prefixes come first (ruling after r11, C2-01c), supporting before playground (C2-01d, design 1.2):
+// a `.md` file under any entry's supporting prefix is supporting, and otherwise one under a playground
+// prefix is playground. Either way `universe` is that entry and `book` is the book folder that holds
+// the prefix, or null at universe level and in a draft. Otherwise a `.md` file in a book folder is
+// canon. `type` is the mapped type of the first folder under the prefix or under the book (canon),
 // 'manuscript' for a manuscript folder, else null. `folder` is that folder name. checkMapping keeps
-// prefixes from overlapping, so at most one matches.
+// prefixes of one list from overlapping, and keeps a supporting prefix from holding a playground
+// prefix, so the first match is the only one that counts.
 export function classify(mapping, path) {
   if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
   const entries = Object.entries(mapping.universes);
+  for (const [universe, entry] of entries) {
+    const prefix = entry.supporting.find(p => inside(p, path));
+    if (prefix) return place(mapping, path, prefix, { scope: 'supporting', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });
+  }
   for (const [universe, entry] of entries) {
     const prefix = entry.playground.find(p => inside(p, path));
     if (prefix) return place(mapping, path, prefix, { scope: 'playground', universe, book: entry.books.find(b => inside(b, prefix)) ?? null });

packages/library/src/supporting.mjs

@@ -0,0 +1,49 @@
+// C2-01d (M12): the paths an agent may write. A path passes only under a supporting prefix of the
+// named universe, and only if nothing in the tree could turn the write into something else: a
+// symlink or gitlink on the way, or a name that differs from a tree name only in case or Unicode
+// form (APFS folds both, so her checkout would put the file somewhere else). Pure; reads no git.
+import { LibraryError } from './problems.mjs';
+import { classify } from './scope.mjs';
+
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const MAX_BYTES = 1024;
+const LINKS = new Set(['120000', '160000']);
+const fold = name => name.normalize('NFC').toLowerCase();
+
+// `tree` is the array listTree returns ({ mode, type, oid, size, path }). Returns `path` or throws
+// library-write-story-path naming the class. Checks run in a fixed order, so a path with two faults
+// always names the same one.
+export function supportingPath(mapping, universe, path, tree) {
+  if (!Array.isArray(tree)) throw new TypeError('supportingPath needs the listTree array');
+  const refuse = message => { throw new LibraryError('library-write-story-path', message); };
+  if (typeof path !== 'string') refuse('the path must be a string');
+  const at = JSON.stringify(path);
+  if (Buffer.byteLength(path, 'utf8') > MAX_BYTES) refuse(`${at} is longer than ${MAX_BYTES} bytes`);
+  if (CONTROL.test(path)) refuse('the path holds a control character');
+  if (path.includes('\\')) refuse(`${at} holds a backslash`);
+  if (path.startsWith('/')) refuse(`${at} is absolute`);
+  const parts = path.split('/');
+  if (parts.some(part => part === '' || part === '.' || part === '..')) refuse(`${at} has an empty, . or .. segment`);
+  const place = classify(mapping, path);
+  if (place.scope !== 'supporting' || place.universe !== universe)
+    refuse(`${at} is not under a supporting folder of universe ${JSON.stringify(universe)}`);
+  const own = parts.map((_, i) => parts.slice(0, i + 1).join('/'));
+  const modes = new Map(tree.map(entry => [entry.path, entry.mode]));
+  for (const p of own) if (LINKS.has(modes.get(p))) refuse(`${at} goes through the symlink or gitlink ${JSON.stringify(p)}`);
+  const names = new Map();
+  for (const entry of tree) {
+    const segs = entry.path.split('/');
+    for (let i = 1; i <= segs.length; i++) {
+      const name = segs.slice(0, i).join('/');
+      const key = fold(name);
+      if (!names.has(key)) names.set(key, new Set());
+      names.get(key).add(name);
+    }
+  }
+  for (const p of own) {
+    const seen = names.get(fold(p));
+    if (seen && [...seen].some(name => name !== p))
+      refuse(`${at} differs only in case or Unicode form from ${JSON.stringify([...seen].find(name => name !== p))}`);
+  }
+  return path;
+}

packages/library/src/survey.mjs

@@ -62,7 +62,7 @@ export async function survey({ repo, commit, mapping }) {
     forms, attachments, fields,
   };
   if (mapping) {
-    const scopes = { canon: 0, playground: 0, unmapped: 0 };
+    const scopes = { canon: 0, playground: 0, supporting: 0, unmapped: 0 };
     for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
     const library = await readLibrary({ repo, commit: head, mapping });
     const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
@@ -89,7 +89,7 @@ export function formatSurvey(s) {
   out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}; attachment ${s.attachments}`);
   for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
   if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
+    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, supporting ${s.scopes.supporting}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
     out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
     out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
   }

packages/library/tests/index-build.test.mjs

@@ -0,0 +1,92 @@
+// Index tests (C2-05a): the cache key and its bound, failed reads, mapped-only contents, and the rebuild
+// time on a 3,000-file fixture. Fixtures are made up and built under the scratch area.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { clearIndexCache, indexCacheSize, indexFor } from '../src/index-build.mjs';
+import { git, mapping, MARKER } from './helpers.mjs';
+import { note, scratchRepo } from './query-fixture.mjs';
+
+const FILES = {
+  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', MARKER),
+  'Book One/Chapters/Chapter 01.md': '# One\n[[Mara Vell]]\n',
+  'Inbox Note.md': `${MARKER}\n`,
+};
+
+// A mapping whose harbor universe has the given display name. Each name gives a new cache key.
+const named = name => mapping(e => ({ ...e, universes: { ...e.universes, harbor: { ...e.universes.harbor, name } } }));
+
+test('the same commit, repo path and mapping return the same index, and only mapped files are in it', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  const a = await indexFor({ repo, commit, mapping: mapping() });
+  const b = await indexFor({ repo, commit, mapping: mapping() });
+  assert.equal(a, b);
+  assert.equal(indexCacheSize(), 1);
+  assert.equal(a.commit, commit);
+  assert.ok(a.files.has('Book One/Characters/Mara Vell.md'));
+  assert.ok(!a.files.has('Inbox Note.md'));
+  assert.deepEqual(a.names.get('mara vell'), ['Book One/Characters/Mara Vell.md']);
+  assert.deepEqual(a.linksIn.get('Book One/Characters/Mara Vell.md').map(l => l.path), ['Book One/Chapters/Chapter 01.md']);
+});
+
+test('a different repo path, mapping or commit gets its own index', async t => {
+  clearIndexCache();
+  const { root, repo, commit } = scratchRepo(t, FILES);
+  const base = await indexFor({ repo, commit, mapping: mapping() });
+  const alias = join(root, 'alias');
+  symlinkSync(repo, alias);
+  assert.notEqual(await indexFor({ repo: alias, commit, mapping: mapping() }), base);
+  assert.notEqual(await indexFor({ repo, commit, mapping: named('Renamed Harbor') }), base);
+  mkdirSync(join(repo, 'Book One/Places'), { recursive: true });
+  writeFileSync(join(repo, 'Book One/Places/New.md'), note('place', 'New'));
+  git(repo, 'add', '-A');
+  git(repo, 'commit', '-qm', 'second');
+  const next = git(repo, 'rev-parse', 'HEAD');
+  const later = await indexFor({ repo, commit: next, mapping: mapping() });
+  assert.notEqual(later, base);
+  assert.equal(later.commit, next);
+  assert.ok(later.files.has('Book One/Places/New.md'));
+});
+
+test('the cache holds at most eight indexes and evicts the least recently used', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  const maps = Array.from({ length: 9 }, (_, i) => named(`Harbor ${i}`));
+  const first = await indexFor({ repo, commit, mapping: maps[0] });
+  for (const m of maps.slice(1)) await indexFor({ repo, commit, mapping: m });
+  assert.equal(indexCacheSize(), 8);
+  assert.notEqual(await indexFor({ repo, commit, mapping: maps[0] }), first);
+  assert.equal(indexCacheSize(), 8);
+});
+
+test('a failed read is not kept in the cache', async t => {
+  clearIndexCache();
+  const { repo } = scratchRepo(t, FILES);
+  await assert.rejects(indexFor({ repo, commit: '0'.repeat(40), mapping: mapping() }));
+  assert.equal(indexCacheSize(), 0);
+});
+
+test('a missing or unchecked mapping is refused before any read', async t => {
+  clearIndexCache();
+  const { repo, commit } = scratchRepo(t, FILES);
+  await assert.rejects(indexFor({ repo, commit, mapping: undefined }), { code: 'library-mapping-invalid' });
+  await assert.rejects(indexFor({ repo, commit, mapping: { kind: 'hybrid' } }), { code: 'library-mapping-invalid' });
+});
+
+test('a 3,000-file rebuild completes and its time is reported', { timeout: 300_000 }, async t => {
+  clearIndexCache();
+  const folders = ['Characters', 'Places', 'Research'];
+  const files = {};
+  for (let i = 0; i < 3000; i++) {
+    files[`Book One/${folders[i % 3]}/Note ${i}.md`] = note('character', `Note ${i}`, `Body ${i} [[Note ${(i + 1) % 3000}]]`);
+  }
+  const { repo, commit } = scratchRepo(t, files);
+  const started = performance.now();
+  const index = await indexFor({ repo, commit, mapping: mapping() });
+  const ms = performance.now() - started;
+  t.diagnostic(`3,000-file index rebuild: ${ms.toFixed(0)} ms`);
+  assert.equal(index.paths.length, 3000);
+});

packages/library/tests/mapping.test.mjs

@@ -1,5 +1,9 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { checkMapping, classify, LibraryError } from '../src/index.mjs';
 import { mapping, mappingEntry } from './helpers.mjs';
 
@@ -45,7 +49,7 @@ test('C2-01c: universe-level prefixes lie outside every book, in a plain univers
 
 test('C2-01c: a draft takes kind, name and playground only, and comes back frozen with books []', () => {
   const m = mapping(e => { e.universes.idea = draft(); return e; });
-  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'] });
+  assert.deepEqual(m.universes.idea, { kind: 'draft', name: 'New World', books: [], playground: ['Drafts/New World/'], supporting: [] });
   assert.ok(Object.isFrozen(m.universes.idea) && Object.isFrozen(m.universes.idea.books) && Object.isFrozen(m.universes.idea.playground));
   refuses(e => { e.universes.idea = { ...draft(), books: ['New World'] }; return e; }, 'library-mapping-invalid', /universes.idea is a draft and takes no books/);
   refuses(e => { e.universes.idea = { ...draft(), books: [] }; return e; }, 'library-mapping-invalid', /takes no books/);
@@ -56,6 +60,107 @@ test('C2-01c: a draft takes kind, name and playground only, and comes back froze
     refuses(e => { e.universes.harbor.kind = kind; return e; }, 'library-mapping-invalid', /universes.harbor.kind must be "hybrid" or "draft"/);
 });
 
+test('C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent', () => {
+  const m = mapping(e => {
+    e.universes.harbor.supporting = ['Book One/Notes/', 'Harbor Notes/'];
+    e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: [], supporting: ['Crossover Notes/'] };
+    e.universes.idea = { ...draft(), supporting: ['Drafts/New World Notes/'] };
+    return e;
+  });
+  assert.deepEqual(m.universes.harbor.supporting, ['Book One/Notes/', 'Harbor Notes/']);
+  assert.deepEqual(m.universes.cross.supporting, ['Crossover Notes/']);
+  assert.deepEqual(m.universes.idea.supporting, ['Drafts/New World Notes/']);
+  assert.deepEqual(m.universes.second.supporting, []);
+  assert.ok(Object.isFrozen(m.universes.harbor.supporting) && Object.isFrozen(m.universes.second.supporting));
+  assert.deepEqual(mapping().universes.harbor.supporting, []);
+});
+
+test('C2-01d: each supporting prefix rule refuses with its code', () => {
+  const invalid = (change, pattern) => refuses(change, 'library-mapping-invalid', pattern);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes']; return e; }, /universes.harbor.supporting holds "Book One\/Notes", which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/../Notes/']; return e; }, /which is not a folder path ending in \//);
+  invalid(e => { e.universes.harbor.supporting = 'Book One/Notes/'; return e; }, /universes.harbor.supporting must be a list/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Notes/', 'Book One/Notes/Deep/']; return e; },
+    /supporting "Book One\/Notes\/" holds supporting "Book One\/Notes\/Deep\/"/);
+  invalid(e => { e.universes.harbor.supporting = ['Ideas/']; e.universes.idea = { ...draft(), supporting: ['Ideas/'] }; return e; },
+    /a supporting prefix is listed twice/);
+  invalid(e => { e.universes.harbor.supporting = ['Book One/']; return e; }, /universes.harbor.supporting "Book One\/" is the whole book folder "Book One"/);
+  invalid(e => { e.universes.harbor.books = ['Shelf/Book One']; e.universes.harbor.playground = []; e.universes.harbor.supporting = ['Shelf/']; return e; },
+    /universes.harbor.supporting "Shelf\/" holds its own book folder "Shelf\/Book One"/);
+  // Supporting is checked first in scope, so a supporting prefix holding a playground would hide it.
+  invalid(e => { e.universes.harbor.supporting = ['Book One/Workshop/']; e.universes.harbor.playground = ['Book One/Workshop/Playground/']; return e; },
+    /universes.harbor.supporting "Book One\/Workshop\/" holds playground "Book One\/Workshop\/Playground\/"/);
+  // Across entries any overlap would give one path two universes.
+  for (const [supporting, playground] of [['Ideas/', 'Ideas/'], ['Ideas/Deep/', 'Ideas/'], ['Ideas/', 'Ideas/Deep/']])
+    invalid(e => { e.universes.harbor.supporting = [supporting]; e.universes.idea = draft([playground]); return e; },
+      new RegExp(`universes.harbor.supporting "${supporting}" overlaps playground "${playground}" of universes.idea`));
+  refuses(e => { e.universes.harbor.supporting = ['Second World/Notes/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Second World\/Notes\/" lies inside book folder "Second World" of universes.second/);
+  refuses(e => { e.universes.second.books = ['Worlds/Second']; e.universes.harbor.supporting = ['Worlds/']; return e; },
+    'library-supporting-other-universe', /universes.harbor.supporting "Worlds\/" holds book folder "Worlds\/Second" of universes.second/);
+  refuses(e => { e.universes.idea = { ...draft(), supporting: ['Book One/Idea Notes/'] }; return e; },
+    'library-supporting-other-universe', /universes.idea.supporting "Book One\/Idea Notes\/" lies inside book folder "Book One" of universes.harbor/);
+});
+
+test('C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting', () => {
+  const same = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/']; return e; });
+  assert.deepEqual([same.universes.harbor.playground, same.universes.harbor.supporting], [['Book One/Playground/'], ['Book One/Playground/']]);
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.deepEqual(nested.universes.harbor.supporting, ['Book One/Playground/Notes/']);
+});
+
+test('C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email', () => {
+  assert.equal(Object.hasOwn(mapping(), 'editor'), false);
+  const editor = { name: 'Her Name', email: '[email protected]' };
+  const m = mapping(e => ({ ...e, editor }));
+  assert.deepEqual(m.editor, editor);
+  assert.notEqual(m.editor, editor);
+  assert.ok(Object.isFrozen(m.editor));
+  const invalid = (value, pattern) => refuses(e => ({ ...e, editor: value }), 'library-mapping-invalid', pattern);
+  for (const value of [null, 'Her Name', 7, ['Her Name', '[email protected]']]) invalid(value, /editor must be an object/);
+  invalid({ ...editor, signingKey: 'x' }, /editor has unknown key "signingKey"/);
+  // sage-2925: an optional Gitea login for her save, checked as the entry's user is.
+  assert.deepEqual(mapping(e => ({ ...e, editor: { ...editor, user: 'her.login-1' } })).editor, { ...editor, user: 'her.login-1' });
+  for (const user of ['', 'her login', 'her@host', 'a'.repeat(101), 7, null])
+    invalid({ ...editor, user }, /editor.user must be a plain account name/);
+  invalid({ name: 'Her Name' }, /editor.email must be non-empty text with no control character, < or >/);
+  invalid({ email: '[email protected]' }, /editor.name must be non-empty text/);
+  for (const bad of ['', '   ', 7, null, 'a\u0000b', 'a\nb', 'a\u001fb', 'a\u007fb', 'a\u0085b', 'a\u009fb', '<her>', 'a<b', 'a>b']) {
+    invalid({ ...editor, name: bad }, /editor.name must be non-empty text with no control character, < or >/);
+    invalid({ ...editor, email: bad }, /editor.email must be non-empty text with no control character, < or >/);
+  }
+  // sage-3601, sage-3606: git's crud() strips whitespace and , : ; < > " \ ' from both ends of an
+  // ident, so a value starting or ending with one refuses. Inner < > and controls refuse above.
+  const ends = [' ', '\u00a0', '\u3000', ',', ':', ';', '"', "'", '\\'];
+  for (const c of ends) for (const padded of [`${c}Her Name`, `Her Name${c}`]) {
+    invalid({ ...editor, name: padded }, /editor.name must not start or end with whitespace or any of , : ; " ' \\/);
+    invalid({ ...editor, email: padded }, /editor.email must not start or end with whitespace or any of , : ; " ' \\/);
+  }
+  for (const c of ['<', '>', '\n', '\t']) for (const padded of [`${c}Her Name`, `Her Name${c}`, `Her${c}Name`])
+    invalid({ ...editor, name: padded }, /editor.name must be non-empty text with no control character, < or >/);
+  assert.equal(mapping(e => ({ ...e, editor: { name: 'Her  Middle Name', email: '[email protected]' } })).editor.name, 'Her  Middle Name');
+  for (const name of ['Doe, Jane Q.', 'Jane: "Q" Doe', "O'Neil", 'Back\\slash Name'])
+    assert.equal(mapping(e => ({ ...e, editor: { name, email: '[email protected]' } })).editor.name, name);
+});
+
+// sage-3606: an accepted editor commits under exactly the saved ident, as author and committer. A
+// future git that strips more from an ident fails here.
+test('C2-01d: an accepted editor round-trips through a real git commit unchanged', t => {
+  const editor = mapping(e => ({ ...e, editor: { name: 'Doe, Jane Q.', email: '[email protected].' } })).editor;
+  const root = mkdtempSync(join(tmpdir(), 'library-ident-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  // An ident in the environment would win over -c, so the commit runs without one. GIT_DIR and its
+  // family would beat -C (inside a hook, say), and git reads no global or system config (webby-0236 E5).
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
+  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE']) delete env[k];
+  Object.assign(env, { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' });
+  const git = (...args) => execFileSync('git', ['-c', `user.name=${editor.name}`, '-c', `user.email=${editor.email}`,
+    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { encoding: 'utf8', env });
+  git('init', '-q');
+  git('commit', '-q', '--allow-empty', '-m', 'ident');
+  assert.equal(git('log', '-1', '--format=%an%n%ae%n%cn%n%ce'), `${editor.name}\n${editor.email}\n${editor.name}\n${editor.email}\n`);
+});
+
 test('no playground prefix holds another, and no book folder holds another', () => {
   refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
     'library-mapping-invalid', /holds playground/);

packages/library/tests/query-fixture.mjs

@@ -0,0 +1,31 @@
+// Scratch repos for the query and index tests (C2-05a). They are built under tmpdir(), as helpers.mjs
+// repo() does; the gate sets TMPDIR under /mnt/storage/scratch/tmp, never /tmp (RULINGS "tmpdir flag").
+// Bodies are made up.
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { git } from './helpers.mjs';
+
+// A repo with one commit holding `files` (path -> text). Removed when the test ends.
+export function scratchRepo(t, files) {
+  const root = mkdtempSync(join(tmpdir(), 'r216-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const repo = join(root, 'books');
+  mkdirSync(repo);
+  git(repo, 'init', '-q', '-b', 'main');
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(repo, path)), { recursive: true });
+    writeFileSync(join(repo, path), text);
+  }
+  git(repo, 'add', '-A');
+  git(repo, 'commit', '-qm', 'fixture');
+  return { root, repo, commit: git(repo, 'rev-parse', 'HEAD') };
+}
+
+// A note: front matter with a type and a name, optional extra front matter lines, then a body.
+export const note = (type, name, body = '', extra = []) => ['---', `type: ${type}`, `name: ${name}`, ...extra, '---', body, ''].join('\n');
+
+// The one exclusion the hybrid tests use, and the paths it hides. C2-15 (row 267) replaces the reading of
+// `exclude` (a path prefix today); swapping these two constants is the whole change to the tests.
+export const EXCLUSION = { exclude: 'Book One/Research' };
+export const EXCLUDED_PATHS = ['Book One/Research/Ferry Logs.md'];

packages/library/tests/query.test.mjs

@@ -0,0 +1,369 @@
+// Query tests for design 3 (C2-05a): universe isolation, scope labels, unmapped files, hybrids, paging
+// under the reply cap, refusals and manuscript paging. Fixtures are made up and built under the scratch area.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { REPLY_CAP } from '../../harness/src/tools.mjs';
+import { find, get, search, manuscript, universeInfo, QUERY_REPLY_CAP, LOOKUP_LIMIT, MANUSCRIPT_LINES } from '../src/query.mjs';
+import { mapping, MARKER } from './helpers.mjs';
+import { scratchRepo, note, EXCLUSION, EXCLUDED_PATHS } from './query-fixture.mjs';
+
+// A hybrid over harbor and second. Its one constraint is EXCLUSION (query-fixture.mjs) and it declares no
+// books or playground.
+const WITH_BLEND = e => ({
+  ...e,
+  universes: {
+    ...e.universes,
+    blend: {
+      kind: 'hybrid', name: 'Blend', sources: ['harbor', 'second'], books: [], playground: [],
+      constraints: [EXCLUSION], notes: 'made-up hybrid',
+    },
+  },
+});
+
+// PRD 1.14 levels (C2-01c): harbor gets a universe-level playground prefix outside every book, and a draft
+// universe has only playground prefixes. Files there have book null.
+const WITH_LEVELS = e => ({
+  ...WITH_BLEND(e),
+  universes: {
+    ...WITH_BLEND(e).universes,
+    harbor: { ...e.universes.harbor, playground: ['Book One/Playground/', 'Notes/Harbor/'] },
+    idea: { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'] },
+  },
+});
+const LEVEL_FILES = {
+  'Notes/Harbor/Scraps.md': note('summary', 'Scraps', `${MARKER} loose`),
+  'Notes/Harbor/Chapters/Idea Chapter.md': `# Idea\n${MARKER} unbooked chapter\n`,
+  'Drafts/New World/Characters/Rin.md': note('character', 'Rin', `${MARKER} draft`),
+  'Drafts/New World/Summary.md': note('summary', 'Summary', `${MARKER} draft`),
+};
+
+const FILES = {
+  'Book One/Characters/Mara Vell.md': note('character', 'Mara Vell', `Grey eyes. ${MARKER}`,
+    ['appears_in: "[[Book One/Chapters/Chapter 01]]"', 'relationships:', '  - "[[Tomas]]"']),
+  'Book One/Characters/Tomas.md': note('character', 'Tomas', MARKER),
+  'Book One/Chapters/Chapter 01.md': `# One\n${MARKER} [[Mara Vell]] met [[Book One/Places/Harbor Town|the harbor]].\n`,
+  'Book One/Chapters/Chapter 02.md': 'Quiet. [[Ferry Logs]] [[Ilse]]\n',
+  'Book One/Places/Harbor Town.md': note('place', 'Harbor Town', `Salt. ${MARKER}`),
+  'Book One/Research/Ferry Logs.md': note('research', 'Ferry Logs', `Timetable. ${MARKER}`),
+  'Book One/Playground/What If.md': note('summary', 'What If', `${MARKER} [[Mara Vell]]`),
+  'Second World/Characters/Ilse.md': note('character', 'Ilse', `${MARKER} Ilse.`),
+  'Second World/Chapters/01.md': '# Elsewhere\n[[Ilse]] waits.\n',
+  'Inbox Note.md': `${MARKER}\n`,
+  'Book One/Board.canvas': '{"nodes":[]}\n',
+};
+
+const src = (ref, map = mapping()) => ({ repo: ref.repo, commit: ref.commit, mapping: map });
+const paths = reply => reply.results.map(r => r.path);
+
+test('the query reply cap equals the harness reply cap', () => {
+  assert.equal(QUERY_REPLY_CAP, REPLY_CAP);
+});
+
+test('find is bound to its universe and refuses a call without one', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const names = paths(await find(s, { universe: 'harbor', query: '' }));
+  assert.ok(names.length > 0);
+  assert.ok(names.every(p => p.startsWith('Book One/')));
+  assert.ok(!names.includes('Second World/Characters/Ilse.md'));
+  await assert.rejects(find(s, { query: '' }), { code: 'query-argument-invalid' });
+  await assert.rejects(find(s, { universe: 'nowhere', query: '' }), { code: 'query-universe-unknown' });
+});
+
+test('every result carries its scope, and playground appears only when asked for', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const canon = (await find(s, { universe: 'harbor', query: '' })).results;
+  assert.ok(canon.every(r => r.scope === 'canon'));
+  assert.ok(!canon.some(r => r.path.includes('/Playground/')));
+  const play = (await find(s, { universe: 'harbor', query: '', scope: 'playground' })).results;
+  assert.deepEqual(play.map(r => r.path), ['Book One/Playground/What If.md']);
+  assert.ok(play.every(r => r.scope === 'playground'));
+});
+
+test('unmapped files never appear in any reply', async t => {
+  const s = src(scratchRepo(t, FILES));
+  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Inbox' })).results, []);
+  assert.deepEqual((await find(s, { universe: 'harbor', query: 'Board' })).results, []);
+  const hits = (await search(s, { universe: 'harbor', text: MARKER })).results;
+  assert.ok(hits.length > 0);
+  assert.ok(hits.every(r => r.path !== 'Inbox Note.md' && r.path !== 'Book One/Board.canvas'));
+});
+
+test('a hybrid sees its sources canon, minus exclusions, and no playground', async t => {
+  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
+  const reply = await find(s, { universe: 'blend', query: '' });
+  assert.deepEqual(paths(reply).sort(), [
+    'Book One/Chapters/Chapter 01.md', 'Book One/Chapters/Chapter 02.md',
+    'Book One/Characters/Mara Vell.md', 'Book One/Characters/Tomas.md', 'Book One/Places/Harbor Town.md',
+    'Second World/Chapters/01.md', 'Second World/Characters/Ilse.md',
+  ]);
+  assert.ok(reply.results.every(r => r.scope === 'canon' && ['harbor', 'second'].includes(r.universe)));
+  assert.deepEqual((await find(s, { universe: 'blend', query: '', scope: 'playground' })).results, []);
+  assert.deepEqual((await find(s, { universe: 'blend', query: 'Ferry' })).results, []);
+});
+
+test('a hybrid gets a source file it can see, and not an excluded or foreign one', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = src(ref, mapping(WITH_BLEND));
+  const ilse = await get(hybrid, { universe: 'blend', path: 'Second World/Characters/Ilse.md' });
+  assert.equal(ilse.scope, 'canon');
+  assert.ok(ilse.links_in.some(l => l.path === 'Second World/Chapters/01.md'));
+  assert.equal(await get(hybrid, { universe: 'blend', path: 'Book One/Research/Ferry Logs.md' }), null);
+  assert.equal(await get(src(ref), { universe: 'harbor', path: 'Second World/Characters/Ilse.md' }), null);
+});
+
+test('get lists visible links both ways and drops a target another universe cannot see', async t => {
+  const ref = scratchRepo(t, FILES);
+  const harbor = src(ref);
+  const ch1 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 01.md' });
+  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Characters/Mara Vell.md' && l.line === 2));
+  assert.ok(ch1.links_out.some(l => l.path === 'Book One/Places/Harbor Town.md'));
+  const ch2 = await get(harbor, { universe: 'harbor', path: 'Book One/Chapters/Chapter 02.md' });
+  assert.ok(ch2.links_out.some(l => l.path === 'Book One/Research/Ferry Logs.md'));
+  assert.ok(!ch2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
+  const mara = await get(harbor, { universe: 'harbor', path: 'Book One/Characters/Mara Vell.md' });
+  assert.ok(mara.links_in.some(l => l.path === 'Book One/Chapters/Chapter 01.md'));
+  assert.ok(mara.links_in.some(l => l.path === 'Book One/Playground/What If.md'));
+  assert.ok(mara.links_out.some(l => l.path === 'Book One/Characters/Tomas.md' && l.field === 'relationships'));
+  assert.ok(mara.links_out.some(l => l.path === 'Book One/Chapters/Chapter 01.md' && l.field === 'appears_in'));
+  const blendCh2 = await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path: 'Book One/Chapters/Chapter 02.md' });
+  assert.ok(blendCh2.links_out.some(l => l.path === 'Second World/Characters/Ilse.md'));
+});
+
+test('a long list pages by position, never cuts an item, and returns 50 per page', async t => {
+  const files = { ...FILES };
+  for (let i = 1; i <= 120; i++) files[`Book One/Places/Note ${i}.md`] = note('place', `Note ${i}`);
+  const s = src(scratchRepo(t, files));
+  const seen = [];
+  let offset = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const reply = await find(s, { universe: 'harbor', query: 'Note', offset });
+    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
+    assert.ok(reply.results.length <= LOOKUP_LIMIT);
+    if (pages === 0) assert.equal(reply.results.length, LOOKUP_LIMIT);
+    seen.push(...paths(reply));
+    if (reply.next === null) break;
+    offset = reply.next;
+  }
+  assert.equal(seen.length, 120);
+  assert.equal(new Set(seen).size, 120);
+});
+
+test('a page stays under the reply cap when items are large', async t => {
+  const big = 'x'.repeat(2000);
+  const files = { ...FILES };
+  for (let i = 1; i <= 40; i++) files[`Book One/Places/Big ${i}.md`] = note('place', `Big ${i}`, '', [`appears_in: "${big}"`]);
+  const s = src(scratchRepo(t, files));
+  const first = await find(s, { universe: 'harbor', query: 'Big' });
+  assert.ok(JSON.stringify(first).length <= QUERY_REPLY_CAP);
+  assert.ok(first.results.length > 0 && first.results.length < 40);
+  assert.notEqual(first.next, null);
+  const seen = [];
+  let offset = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const reply = await find(s, { universe: 'harbor', query: 'Big', offset });
+    assert.ok(JSON.stringify(reply).length <= QUERY_REPLY_CAP);
+    seen.push(...paths(reply));
+    if (reply.next === null) break;
+    offset = reply.next;
+  }
+  assert.equal(new Set(seen).size, 40);
+});
+
+test('a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return', async t => {
+  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', `${huge} ${MARKER}`) }));
+  const reply = await search(s, { universe: 'harbor', text: 'yyyyyyyy' });
+  assert.deepEqual(reply.results, [{ path: 'Book One/Places/Wall.md', line: 5, excerpt: null, excerpt_too_long: true, scope: 'canon' }]);
+  const mixed = await search(s, { universe: 'harbor', text: MARKER.toLowerCase() });
+  assert.ok(mixed.results.some(r => r.excerpt_too_long === true));
+  assert.ok(mixed.results.some(r => typeof r.excerpt === 'string' && !('excerpt_too_long' in r)));
+  assert.ok(JSON.stringify(mixed).length <= QUERY_REPLY_CAP);
+});
+
+test('a find item that cannot fit alone is refused, not cut', async t => {
+  const huge = 'y'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Places/Wall.md': note('place', 'Wall', '', [`appears_in: "${huge}"`]) }));
+  await assert.rejects(find(s, { universe: 'harbor', query: 'Wall' }), { code: 'query-item-too-large' });
+});
+
+test('get pages its lines, and the next line picks up where the page stopped', async t => {
+  const body = `${Array.from({ length: 500 }, (_, i) => `Line ${i + 1} ${'z'.repeat(120)}`).join('\n')}\n`;
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long.md': body }));
+  const first = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md' });
+  assert.equal(first.lines[0][0], 1);
+  assert.ok(first.lines.length < 501);
+  assert.notEqual(first.next, null);
+  let from = 1, count = 0;
+  for (let pages = 0; pages < 10; pages++) {
+    const page = await get(s, { universe: 'harbor', path: 'Book One/Chapters/Long.md', from });
+    count += page.lines.length;
+    if (page.next === null) break;
+    from = page.next;
+  }
+  assert.equal(count, 501);
+});
+
+test('get refuses a file whose front matter alone is over the cap, and a line alone is over the cap', async t => {
+  const huge = 'q'.repeat(QUERY_REPLY_CAP + 1000);
+  const s = src(scratchRepo(t, {
+    ...FILES,
+    'Book One/Places/Heavy.md': note('place', 'Heavy', '', [`appears_in: "${huge}"`]),
+    'Book One/Chapters/Wide.md': `${huge}\n`,
+  }));
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Places/Heavy.md' }), { code: 'query-item-too-large' });
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Chapters/Wide.md' }), { code: 'query-item-too-large' });
+});
+
+test('get pages the links of a hub note, every page carries the front matter, and the pages add up', async t => {
+  const files = { ...FILES };
+  for (let i = 1; i <= 900; i++) files[`Book One/Chapters/Mention ${i}.md`] = `[[Tomas]] ${'w'.repeat(60)}\n`;
+  const s = src(scratchRepo(t, files));
+  const seen = [];
+  const PAST_END = 1000;
+  let linksFrom = 0, pages = 0, lines = 0, from = 1;
+  for (; pages < 40; pages++) {
+    const page = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from, links_from: linksFrom });
+    assert.ok(JSON.stringify(page).length <= QUERY_REPLY_CAP);
+    assert.equal(page.frontmatter.name, 'Tomas');
+    seen.push(...page.links_in.map(l => l.path));
+    if (from !== PAST_END) lines += page.lines.length;
+    // Once the lines are read, ask past the last one: the page then carries links alone.
+    from = page.next ?? PAST_END;
+    if (page.links_next === null && page.next === null) break;
+    if (page.links_next !== null) linksFrom = page.links_next;
+  }
+  assert.ok(pages > 1, 'the hub needed more than one page');
+  assert.ok(pages < 40);
+  assert.equal(seen.filter(p => p.startsWith('Book One/Chapters/Mention ')).length, 900);
+  assert.equal(new Set(seen).size, seen.length, 'no link comes back twice');
+  assert.equal(lines, 6, 'the five lines of the note and the empty one after its last newline');
+  const tail = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', from: PAST_END });
+  assert.deepEqual(tail.lines, []);
+  assert.equal(tail.next, null);
+});
+
+test('get rejects a bad links_from', async t => {
+  const s = src(scratchRepo(t, FILES));
+  await assert.rejects(get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: -1 }), { code: 'query-argument-invalid' });
+  const past = await get(s, { universe: 'harbor', path: 'Book One/Characters/Tomas.md', links_from: 99 });
+  assert.deepEqual([past.links_out, past.links_in, past.links_next], [[], [], null]);
+});
+
+test('search returns scoped line hits, case-insensitively, and refuses empty text', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const reply = await search(s, { universe: 'harbor', text: 'marker' });
+  assert.ok(reply.results.length > 0);
+  assert.ok(reply.results.every(r => r.scope === 'canon' && r.path.startsWith('Book One/') && Number.isInteger(r.line)));
+  assert.ok(reply.results.some(r => r.path === 'Book One/Chapters/Chapter 01.md' && r.line === 2));
+  await assert.rejects(search(s, { universe: 'harbor', text: '' }), { code: 'query-argument-invalid' });
+});
+
+test('a manuscript call returns one chapter, at most 400 lines, and names its next line', async t => {
+  const long = `${Array.from({ length: 900 }, (_, i) => `Scene ${i + 1}`).join('\n')}\n`;
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Long Chapter.md': long }));
+  const first = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter' });
+  assert.equal(first.lines.length, MANUSCRIPT_LINES);
+  assert.equal(first.next, MANUSCRIPT_LINES + 1);
+  const second = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Long Chapter', from: first.next });
+  assert.equal(second.lines[0][0], MANUSCRIPT_LINES + 1);
+});
+
+test('a manuscript call without a chapter returns the first chapter in path order and names the next', async t => {
+  const s = src(scratchRepo(t, FILES));
+  const first = await manuscript(s, { universe: 'harbor', book: 'Book One' });
+  assert.equal(first.path, 'Book One/Chapters/Chapter 01.md');
+  assert.equal(first.next_chapter, 'Chapter 02');
+  const last = await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 02' });
+  assert.equal(last.path, 'Book One/Chapters/Chapter 02.md');
+  assert.equal(last.next_chapter, null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Nope' }), null);
+});
+
+test('a chapter name that matches two visible files is refused', async t => {
+  const s = src(scratchRepo(t, { ...FILES, 'Book One/Chapters/Part/Chapter 01.md': 'Again.\n' }));
+  await assert.rejects(manuscript(s, { universe: 'harbor', book: 'Book One', chapter: 'Chapter 01' }), { code: 'query-chapter-ambiguous' });
+});
+
+test('a hybrid reads a source chapter through its declared sources only', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = await manuscript(src(ref, mapping(WITH_BLEND)), { universe: 'blend', book: 'Second World', chapter: '01' });
+  assert.equal(hybrid.path, 'Second World/Chapters/01.md');
+  assert.equal(hybrid.scope, 'canon');
+  assert.equal(await manuscript(src(ref), { universe: 'harbor', book: 'Second World', chapter: '01' }), null);
+});
+
+test('universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe', async t => {
+  const s = src(scratchRepo(t, FILES), mapping(WITH_BLEND));
+  const blend = await universeInfo(s, { universe: 'blend' });
+  assert.equal(blend.kind, 'hybrid');
+  assert.deepEqual(blend.sources, ['harbor', 'second']);
+  assert.deepEqual(blend.constraints, [EXCLUSION]);
+  assert.equal(blend.notes, 'made-up hybrid');
+  const harbor = await universeInfo(s, { universe: 'harbor' });
+  assert.equal(harbor.kind, 'universe');
+  assert.equal(harbor.sources, undefined);
+  await assert.rejects(universeInfo(s, { universe: 'ghost' }), { code: 'query-universe-unknown' });
+});
+
+test('an exclusion hides what it names from a hybrid and from nothing else', async t => {
+  const ref = scratchRepo(t, FILES);
+  const hybrid = src(ref, mapping(WITH_BLEND));
+  const seen = paths(await find(hybrid, { universe: 'blend', query: '' }));
+  for (const path of EXCLUDED_PATHS) assert.ok(!seen.includes(path), `${path} stays hidden`);
+  const own = paths(await find(src(ref), { universe: 'harbor', query: '' }));
+  for (const path of EXCLUDED_PATHS) assert.ok(own.includes(path), `${path} stays visible to its own universe`);
+});
+
+test('PRD 1.14: a lookup that names a book leaves book-null files out', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  const all = paths(await find(s, { universe: 'harbor', query: '', scope: 'playground' }));
+  assert.deepEqual(all.sort(), ['Book One/Playground/What If.md', 'Notes/Harbor/Chapters/Idea Chapter.md', 'Notes/Harbor/Scraps.md']);
+  const booked = await find(s, { universe: 'harbor', query: '', scope: 'playground', book: 'Book One' });
+  assert.deepEqual(paths(booked), ['Book One/Playground/What If.md']);
+  assert.ok(booked.results.every(r => r.book === 'Book One'));
+  const hits = (await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground' })).results;
+  assert.deepEqual(hits.map(r => r.path), ['Notes/Harbor/Chapters/Idea Chapter.md']);
+  assert.deepEqual((await search(s, { universe: 'harbor', text: 'unbooked', scope: 'playground', book: 'Book One' })).results, []);
+});
+
+test('PRD 1.14: library_manuscript never reads a book-null file', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  // The unbooked file sits under a manuscript folder, so it has type manuscript and book null.
+  const listed = await find(s, { universe: 'harbor', query: 'Idea', scope: 'playground' });
+  assert.deepEqual(listed.results.map(r => [r.path, r.type, r.book]), [['Notes/Harbor/Chapters/Idea Chapter.md', 'manuscript', null]]);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground', chapter: 'Idea Chapter' }), null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Book One', scope: 'playground' }), null);
+  assert.equal(await manuscript(s, { universe: 'harbor', book: 'Notes', scope: 'playground', chapter: 'Idea Chapter' }), null);
+});
+
+test('PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  assert.deepEqual((await find(s, { universe: 'idea', query: '' })).results, []);
+  assert.deepEqual((await search(s, { universe: 'idea', text: MARKER })).results, []);
+  const found = await find(s, { universe: 'idea', query: '', scope: 'playground' });
+  assert.deepEqual(paths(found).sort(), ['Drafts/New World/Characters/Rin.md', 'Drafts/New World/Summary.md']);
+  assert.ok(found.results.every(r => r.scope === 'playground' && r.universe === 'idea' && r.book === null));
+  const hits = (await search(s, { universe: 'idea', text: 'draft', scope: 'playground' })).results;
+  assert.equal(hits.length, 2);
+  const rin = await get(s, { universe: 'idea', path: 'Drafts/New World/Characters/Rin.md' });
+  assert.equal(rin.scope, 'playground');
+  assert.equal(await get(s, { universe: 'harbor', path: 'Drafts/New World/Characters/Rin.md' }), null);
+});
+
+test('PRD 1.14: library_universe on a draft returns its kind, name and prefixes', async t => {
+  const s = src(scratchRepo(t, { ...FILES, ...LEVEL_FILES }), mapping(WITH_LEVELS));
+  const draft = await universeInfo(s, { universe: 'idea' });
+  assert.equal(draft.kind, 'draft');
+  assert.equal(draft.name, 'New World');
+  assert.deepEqual(draft.playground, ['Drafts/New World/']);
+  assert.deepEqual(draft.books, []);
+  assert.equal(draft.sources, undefined);
+});
+
+test('a hybrid gets a source playground file as null, while the source gets it with scope playground', async t => {
+  const ref = scratchRepo(t, FILES);
+  const path = 'Book One/Playground/What If.md';
+  assert.equal(await get(src(ref, mapping(WITH_BLEND)), { universe: 'blend', path }), null);
+  const own = await get(src(ref), { universe: 'harbor', path });
+  assert.equal(own.scope, 'playground');
+});

packages/library/tests/scope.test.mjs

@@ -53,3 +53,44 @@ test('C2-01c: a canon file linking into a draft gives R6, and into its own unive
     assert.deepEqual(codes(path), [], path);
   }
 });
+
+// Supporting prefixes at three levels (C2-01d). Harbor's book-level prefix sits in both lists, and a
+// second book-level prefix is supporting only.
+const supporting = () => mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+
+test('C2-01d: each supporting level gives its universe, and its book or null', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Notes/Characters/Mara.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Places/Island.md'),
+    { scope: 'supporting', universe: 'harbor', book: null, type: 'place', folder: 'Places' });
+  assert.deepEqual(classify(m, 'Harbor Notes/Loose.md'), { scope: 'supporting', universe: 'harbor', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Drafts/New World Notes/Chapters/Open.md'),
+    { scope: 'supporting', universe: 'idea', book: null, type: 'manuscript', folder: 'Chapters' });
+  assert.deepEqual(classify(m, 'Drafts/New World/Ana.md'), { scope: 'playground', universe: 'idea', book: null, type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Places/Dock.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'place', folder: 'Places' });
+});
+
+test('C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground', () => {
+  const m = supporting();
+  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
+    { scope: 'supporting', universe: 'harbor', book: 'Book One', type: null, folder: null });
+  assert.deepEqual(classify(m, 'Book One/Sketches/Research/Tides.md'),
+    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'research', folder: 'Research' });
+  // A playground may hold a supporting prefix of its own entry: the inner folder is supporting.
+  const nested = mapping(e => { e.universes.harbor.supporting = ['Book One/Playground/Notes/']; return e; });
+  assert.equal(classify(nested, 'Book One/Playground/Notes/A.md').scope, 'supporting');
+  assert.equal(classify(nested, 'Book One/Playground/A.md').scope, 'playground');
+});
+
+test('C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped', () => {
+  const m = supporting();
+  for (const path of ['Book One/Notes/Board.canvas', 'Harbor Notes/Table.base', 'Drafts/New World Notes/Map.canvas',
+    'Harbor Notes/cover.png', 'Harbor Notesx/a.md'])
+    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
+});

packages/library/tests/supporting.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { inspect } from 'node:util';
+import { LibraryError, supportingPath } from '../src/index.mjs';
+import { mapping } from './helpers.mjs';
+
+// C2-01d (M12): the path checks an agent write passes. The tree is a listTree array built by hand,
+// with a symlink, a gitlink, case twins and an NFC name, so no git is needed.
+const m = mapping(e => {
+  e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Sketches/'];
+  e.universes.harbor.supporting = ['Book One/Playground/', 'Book One/Notes/', 'Harbor Notes/'];
+  e.universes.second.supporting = ['Second Notes/'];
+  e.universes.idea = { kind: 'draft', name: 'New World', playground: ['Drafts/New World/'], supporting: ['Drafts/New World Notes/'] };
+  return e;
+});
+const blob = (path, mode = '100644') => ({ mode, type: mode === '160000' ? 'commit' : 'blob', oid: '0'.repeat(40), size: 1, path });
+const tree = [
+  blob('Book One/Characters/Mara Vell.md'),
+  blob('Book One/Notes/Existing.md'),
+  blob('Book One/Notes/Linked', '120000'),
+  blob('Book One/Notes/Vendor', '160000'),
+  blob('Book One/Notes/Pointer.md', '120000'),
+  blob('Book One/Notes/Case/Twin.md'),
+  blob('Book One/Notes/Café.md'),
+  blob('Harbor Notes/Places/Island.md'),
+];
+const refuses = (universe, path, pattern) => assert.throws(() => supportingPath(m, universe, path, tree),
+  e => e instanceof LibraryError && e.code === 'library-write-story-path' && pattern.test(e.message), inspect(path));
+
+test('C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists', () => {
+  for (const [universe, path] of [['harbor', 'Book One/Notes/Characters/New.md'], ['harbor', 'Book One/Notes/Existing.md'],
+    ['harbor', 'Harbor Notes/Places/Island.md'], ['harbor', 'Harbor Notes/Loose.md'], ['idea', 'Drafts/New World Notes/Ana.md'],
+    ['harbor', 'Book One/Playground/What If.md'], ['second', 'Second Notes/A.md'], ['harbor', 'Book One/Notes/Café.md']])
+    assert.equal(supportingPath(m, universe, path, tree), path);
+  assert.equal(supportingPath(m, 'harbor', 'Book One/Notes/x.md', []), 'Book One/Notes/x.md');
+});
+
+test('C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses', () => {
+  const prefix = 'Harbor Notes/';
+  const exact = `${prefix}${'a'.repeat(1024 - prefix.length - 3)}.md`;
+  assert.equal(Buffer.byteLength(exact), 1024);
+  assert.equal(supportingPath(m, 'harbor', exact, tree), exact);
+  // é is two bytes: 1025 bytes but far fewer characters.
+  const name = 'é'.repeat((1025 - prefix.length - 3 - 1) / 2);
+  const long = `${prefix}${name}a.md`;
+  assert.equal(Buffer.byteLength(long), 1025);
+  assert.ok(long.length < 1024);
+  refuses('harbor', long, /is longer than 1024 bytes/);
+});
+
+test('C2-01d: a path outside the universe\'s supporting folders refuses', () => {
+  const outside = /is not under a supporting folder of universe/;
+  for (const path of ['Inbox Note.md', 'Book One/Notes/Board.canvas', 'Book One/Notes/Table.base', 'Book One/Notes/cover.png',
+    'Book One/Characters/Mara Vell.md', 'Book One/Sketches/Idea.md', 'Drafts/New World/Ana.md', 'Second Notes/A.md', 'Book One/Notes.md'])
+    refuses('harbor', path, outside);
+  refuses('idea', 'Book One/Notes/A.md', /universe "idea"/);
+  refuses('nowhere', 'Book One/Notes/A.md', /universe "nowhere"/);
+});
+
+test('C2-01d: malformed paths refuse by class, in order', () => {
+  refuses('harbor', '/Book One/Notes/A.md', /"\/Book One\/Notes\/A.md" is absolute/);
+  for (const path of ['Book One/Notes/../Notes/A.md', 'Book One/Notes/./A.md', 'Book One//Notes/A.md', 'Book One/Notes/A/', 'Book One/Notes/..'])
+    refuses('harbor', path, /has an empty, \. or \.\. segment/);
+  refuses('harbor', 'Book One/Notes/A\\B.md', /holds a backslash/);
+  for (const c of ['\u0000', '\u0001', '\n', '\u001f', '\u007f', '\u0085', '\u009f'])
+    assert.throws(() => supportingPath(m, 'harbor', `Book One/Notes/A${c}.md`, tree),
+      e => e.code === 'library-write-story-path' && e.message === 'library-write-story-path: the path holds a control character');
+  for (const path of [7, null, undefined, 1n, ['Book One/Notes/A.md']]) refuses('harbor', path, /the path must be a string/);
+  // A backslash in a path that is also absolute names the backslash: the order is fixed.
+  refuses('harbor', '/a\\b.md', /holds a backslash/);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md', { 'Book One/Notes/A.md': '100644' }), TypeError);
+  assert.throws(() => supportingPath(m, 'harbor', 'Book One/Notes/A.md'), TypeError);
+});
+
+test('C2-01d: a symlink or gitlink on the way, or at the path itself, refuses', () => {
+  refuses('harbor', 'Book One/Notes/Linked/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Linked"/);
+  refuses('harbor', 'Book One/Notes/Vendor/Deep/A.md', /goes through the symlink or gitlink "Book One\/Notes\/Vendor"/);
+  refuses('harbor', 'Book One/Notes/Pointer.md', /goes through the symlink or gitlink "Book One\/Notes\/Pointer.md"/);
+});
+
+test('C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder', () => {
+  refuses('harbor', 'Book One/Notes/existing.md', /differs only in case or Unicode form from "Book One\/Notes\/Existing.md"/);
+  refuses('harbor', 'Book One/Notes/case/New.md', /differs only in case or Unicode form from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Book One/Notes/CASE/Twin.md', /from "Book One\/Notes\/Case"/);
+  refuses('harbor', 'Harbor notes/A.md', /is not under a supporting folder/);
+  // NFD e + combining acute against the NFC name in the tree: one file on APFS.
+  refuses('harbor', 'Book One/Notes/Café.md', /differs only in case or Unicode form from "Book One\/Notes\/Café.md"/);
+  // A tree that already holds case twins refuses a write to either (R7).
+  const twins = [...tree, blob('Book One/Notes/existing.md')];
+  for (const path of ['Book One/Notes/Existing.md', 'Book One/Notes/existing.md'])
+    assert.throws(() => supportingPath(m, 'harbor', path, twins), e => e.code === 'library-write-story-path' && /differs only in case/.test(e.message));
+});

packages/library/tests/survey.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -70,12 +70,23 @@ test('with --mapping the survey adds scope, resolver step and problem counts', a
   assert.equal(out.code, 0, out.stderr);
   const tail = out.stdout.trimEnd().split('\n').slice(-3);
   assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, unmapped 3; indexed 6',
+    'scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6',
     'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
     'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
   for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
 });
 
+test('C2-01d: with --mapping the survey counts supporting files', async t => {
+  const r = repo(t);
+  const entry = JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
+  entry.universes.harbor.supporting = ['Book One/Places/'];
+  const file = join(r.root, 'supporting.json');
+  writeFileSync(file, JSON.stringify(entry));
+  const out = await run(['survey', r.repo, '--mapping', file]);
+  assert.equal(out.code, 0, out.stderr);
+  assert.match(out.stdout, /^scopes canon 4, playground 1, supporting 1, unmapped 3; indexed 6$/m);
+});
+
 test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
   const r = repo(t);
   for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])

packages/webui/README.md

@@ -4,22 +4,22 @@ Piece 4, #1507. The control board is the first and only WebUI screen.
 
 ## Run
 
-The board runs inside the Console (row 198), so there is one server to start:
+Start the existing board in one terminal, then the WebUI in another:
 
 ```sh
+node packages/control-board/src/cli.mjs serve
 node packages/webui/src/cli.mjs serve
 ```
 
-Open http://127.0.0.1:7330/. Optional `--port N` selects another port. There
-is no separate board server (`control-board serve` is retired and exits 2) and
-no `--board` flag (it is refused).
+Open http://127.0.0.1:7330/. Optional `--port N` and
+`--board http://127.0.0.1:7331` select another port or loopback board origin.
 `--business ID` picks the business the bus views read; without it they read
 the running bus host's business (`mosaic bus start <business>`).
 Port 0 picks a free port. Ctrl-C stops each foreground server. No daemon,
 installation, account, login or deployment is added. The preview mode below
 checks one header a sign-in proxy sets; it signs nobody in itself.
 
-The WebUI binds to IPv4 loopback
+Only HTTP loopback board origins are accepted. The WebUI binds to IPv4 loopback
 by default, rejects a repeated Host (400), nonlocal Host and cross-origin
 requests, sends no CORS
 headers, refuses redirects and accepts only JSON object POST bodies up to 4096
@@ -60,11 +60,9 @@ In preview mode:
   `Host: NAME` would otherwise skip the sign-in check.
 - Every method other than GET and HEAD answers 403 `read-only`, whatever the
   Host. `/api/seen` and `/api/reply` never reach the board, so Seen and Reply
-  fail in the page with that refusal. The exceptions are POST `/api/bus/message`
-  when the Console was started with `--send` (next section), and POST
-  `/api/seen` and `/api/reply` when the Console runs with `--send` on the
-  public name (row 198: the board runs in-process, so these writes reach it
-  directly; without `--send` they answer 403 `read-only`).
+  fail in the page with that refusal. The one exception is POST
+  `/api/bus/message` when the Console was started with `--send` (next
+  section).
 - The GET routes are unchanged: the bus views, the Queue, Business and
   Settings reads, the board panel and the assets. If the board is down, its
   panel shows the existing error and the bus views still answer.
@@ -953,9 +951,7 @@ completion Seen and find it again in Seen. Record any reason to open the board's
 own page or a repo seat terminal in DEFERRED.md. Pass is Jason's end-of-day
 say-so, not a test result. Keep #1507 open pending that ruling.
 
-Rollback requires only stopping the WebUI. The board runs inside it, so there is no separate board to keep running.
-
-A move to a pre-198 copy, by rollback or by activate, has no board until the next re-pin. The plan drops a recorded `--board` (the 7331 board is retired and the install refuses the flag), and that Console runs without a board until a copy that has the in-process board is activated.
+Rollback requires only stopping the WebUI and using the unchanged board at 7331.
 Revert the scoped WebUI commit to remove it; there is no data migration to undo.
 Seen and reply actions already taken belong to the board and are not rolled back.
 

packages/webui/src/cli.mjs

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
 // MOSAIC_TESTER_SOCKET_V1: private tester ingress, no tester TCP.
 import { createChat } from './chat.mjs';
-import { startServer, previewOptions, proofOptions } from './serve.mjs';
+import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
 import { busCaller, busBusiness, userCaller, consoleCall } from './bus.mjs';
 import { consoleBus, userOptionsFor, agentCaller, TESTER_AGENT_VERBS } from './console-bus.mjs';
 import { consoleAccess } from './access.mjs';
 import { accessContextFor } from '../../cli/src/access.mjs';
 import { accessFilePath, loadAccess } from '../../business/src/access.mjs';
-import { createBoard } from '../../control-board/src/board.mjs';
-import { discoverRepoAgents, discoverFleetAgents } from '../../control-board/src/scan.mjs';
 import { startTesterSocket } from './tester-socket.mjs';
 import { TESTER_CLI } from '../../cli/src/transport.mjs';
 import { views } from '../../bus/src/views.mjs';
@@ -17,15 +15,14 @@ import { configDir } from '../../business/src/business.mjs';
 import { consoleReads, redactor } from './reads.mjs';
 import { createSso, readSlot } from './sso.mjs';
 import { statSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
+import { isAbsolute } from 'node:path';
 import { ID_PATTERN } from '../../business/src/vocabulary.mjs';
 const args = process.argv.slice(2);
-const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
+const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
 try {
   if (args.length === 1 && ['--help', '-h'].includes(args[0])) { console.log(usage); process.exit(0); }
   if (args.shift() !== 'serve') throw new Error(usage);
-  const options = { port: 7330 }, preview = {}, proofFlags = {};
+  const options = { board: DEFAULT_BOARD, port: 7330 }, preview = {}, proofFlags = {};
   let sendOn = false, ssoOn = false, testerSocket = false;
   while (args.length) {
     const flag = args.shift();
@@ -35,14 +32,12 @@ try {
     if (flag === '--sso') { ssoOn = true; continue; }
     if (flag === '--tester-socket') { testerSocket = true; continue; }
     if (flag === '--tester-port') throw new Error('--tester-port retired; activate explicitly with --tester-socket');
-    // Row 198: the board runs inside the Console; there is no board origin to point at.
-    if (flag === '--board') throw new Error('--board retired: the board runs in the Console (row 198)');
     const value = args.shift();
     if (!value) throw new Error(`missing value for ${flag}`);
     if (flag === '--port') {
       if (!/^\d+$/.test(value) || Number(value) > 65535) throw new Error('port must be 0..65535');
       options.port = Number(value);
-    }
+    } else if (flag === '--board') options.board = value;
     // Row 77 (#1571): the canonical checkout the queue read runs from, when
     // serve runs from a pinned copy; everything else loads from the copy.
     else if (flag === '--checkout') {
@@ -92,13 +87,6 @@ try {
     if (testerSocket) throw new Error(`--tester-socket needs the bus configured (${why})`);
     busLine = `Bus: not configured (${why})`;
   }
-  // Row 198: the board runs in-process over the system config's data root and reads the same repository
-  // agents as before, plus the fleet's read-only specs (the old board's default). Without the system
-  // config there is no data root, so the board routes answer not-configured.
-  const board = system ? createBoard({
-    specs: [...discoverRepoAgents(options.checkout ?? REPO), ...discoverFleetAgents(join(homedir(), '.mosaic', 'fleet', 'agents'))],
-    boardDir: join(system.dataRoot, 'board'), seatsDir: join(system.dataRoot, 'seats'), discordDataRoot: system.dataRoot,
-  }) : null;
   const reads = consoleReads({ root: REPO, queueRoot: options.checkout ?? REPO, system, configDir: configDir(), rolesDir: rolesDir(), business: options.business ?? null });
   // The sign-in config is checked again here, then each slot file, before anything listens. A
   // provider that can't be reached starts degraded; one whose discovery is refused stops the start.
@@ -119,14 +107,14 @@ try {
   }
   let server;
   try {
-    server = await startServer({ board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, decisionWrite, userOptions, federation: system?.federation ?? null });
+    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, decisionWrite, userOptions, federation: system?.federation ?? null });
   } catch (err) { sso?.close(); throw err; }
   let testerServer = null;
   if (testerSocket) {
     const call = busCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, cli: TESTER_CLI });
     const testerBus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes') };
     try {
-      testerServer = await startTesterSocket({ dataRoot: system.dataRoot, board,
+      testerServer = await startTesterSocket({ dataRoot: system.dataRoot, board: options.board,
         tester: true, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
         processing: { read: () => call('processing.status') },
         projectFiles: args => call('project.files', args), projectFile: args => call('project.file', args),
@@ -145,7 +133,7 @@ try {
   const health = sso?.health() ?? {};
   const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send), grant Approve and Deny' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
   const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
-  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${board ? 'in the Console (no port)' : 'not configured (no system config)'}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: unix:${testerServer.address()} (binds the tester)` : ''}\nCtrl-C stops this server.`);
+  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: unix:${testerServer.address()} (binds the tester)` : ''}\nCtrl-C stops this server.`);
   for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });
 } catch (err) {
   console.error(`refused: ${err.message}`);

packages/webui/src/public/app.js

@@ -7,7 +7,7 @@
   // Delivered replies with no newer answer yet, by row: the board's sentAt. Page memory only.
   const awaiting = new Map();
   let data = null, project = null, selected = null, returnFocus = null, paused = false, busy = false, writing = false, reading = null, timer;
-  let board = 'the Console board', palette = 'harbor', mode = 'system', failed = false;
+  let board = 'the configured board', palette = 'harbor', mode = 'system', failed = false;
   // Show machine sessions (#1589): off by default, kept with the page's settings. While it is off the
   // page doesn't read /api/board at all; the held roles above come from the bus (bus.js).
   let machine = false;
@@ -20,8 +20,6 @@
   // `sign-in required`; that signs the page out too, and the line links to the Console's sign-in.
   // Any other 401 stays an error. `sso` comes from /api/config.
   let sso = false;
-  // Row 198 (mos-1512): the reply form and the Seen button draw only when /api/config says send; otherwise a line says so.
-  let canSend = false;
   const signInRequired = (res, body) => res.status === 401 && body?.error === 'sign-in required';
   const signedOut = () => Object.assign(new Error('the sign-in proxy redirected it, so it never reached the Console'), { signedOut: true });
   const labels = { registration: 'registered', 'first-user-message': 'first message', 'tmux-pane': 'tmux pane', 'session-cwd': 'session cwd', 'workspace-git-root': 'git root' };
@@ -48,7 +46,7 @@
     const s = Date.parse(sent), a = Date.parse(r.lastActivity);
     return Number.isFinite(s) && Number.isFinite(a) && a < s;
   }
-  const canReply = r => canSend && !r.connector && r.registered && r.registered.alive !== false && r.registered.tmux?.session;
+  const canReply = r => !r.connector && r.registered && r.registered.alive !== false && r.registered.tmux?.session;
   const row = id => data?.sessions.find(r => key(r) === id);
   const announce = text => { $('announce').textContent = text; };
   // Colours come from tokens.css by data-palette and data-mode. System removes data-mode, so the OS setting picks light or dark.
@@ -68,7 +66,6 @@
   $('mode').onchange = e => { mode = e.target.value; theme(); };
   function seenButton(r) {
     if (!['waiting', 'error'].includes(r.state) || !r.lastActivity) return '';
-    if (!canSend) return '<span class="small muted">Seen is off: this Console is read-only.</span>';
     return `<button type="button" class="btn" data-seen="${esc(key(r))}" aria-label="${r.seen ? 'Unsee' : 'Mark seen'} ${esc(r.agent)}">${r.seen ? 'Unsee' : 'Seen'}</button>`;
   }
   const historyButton = r => `<button type="button" class="btn conv-open" data-history="${esc(key(r))}" aria-label="History for ${esc(r.agent)}">History</button>`;
@@ -97,7 +94,7 @@
     if (r.relaunchedAt) fields.unshift(['Current activity', relaunchNotice(r)]);
     if (r.connector) fields.push(['Connector', `${r.connector.braked === true ? 'braked (STOP)' : r.connector.braked === false ? 'not braked' : 'brake unknown'}; owner ${r.connector.ownerState}`]);
     const receipt = receipts.get(selected);
-    $('inspection').innerHTML = `<dl class="kv">${fields.map(([k, v]) => `<dt>${k}</dt><dd>${esc(v)}</dd>`).join('')}${pending(r) ? `<dt>Reply</dt><dd>Waiting for a reply to your message sent ${esc(awaiting.get(selected))}. The page checks every 10 seconds${paused ? ' once you resume' : ''}.</dd><dt>${r.relaunchedAt ? 'Historical assistant text' : 'Previous assistant text'}, before your message</dt>` : `<dt>${r.relaunchedAt ? 'Historical last assistant text' : 'Last assistant text'}</dt>`}<dd><pre class="last-text">${esc(r.lastAssistantText || 'No assistant text yet.')}</pre></dd>${r.lastError ? `<dt>${r.relaunchedAt ? 'Historical last error' : 'Last error'}</dt><dd>${esc(r.lastError)}</dd>` : ''}</dl>${historyButton(r)}${seenButton(r)}${canReply(r) ? `<form class="reply-form"><label for="reply">Reply to ${esc(r.agent)}</label><textarea id="reply" maxlength="2000" rows="3" placeholder="Message this seat">${esc(drafts.get(selected) || '')}</textarea><button class="btn primary" type="submit" ${sending.has(selected) ? 'disabled' : ''}>${sending.has(selected) ? 'Sending…' : 'Send'}</button></form>` : `<p class="muted">${r.connector ? 'Board replies disabled for Discord connectors' : !canSend ? 'Replies are off: this Console is read-only.' : 'reply needs a registered seat'}</p>`}${receipt ? `<p class="receipt ${receipt.delivered ? '' : 'failed'}" role="status">${esc(receipt.delivered ? `delivered ${receipt.sentAt} to tmux ${receipt.session}` : `failed${receipt.exitCode == null ? '' : ' (exit ' + receipt.exitCode + ')'}: ${receipt.stderr || receipt.error || 'no output'}`)}</p>` : ''}`;
+    $('inspection').innerHTML = `<dl class="kv">${fields.map(([k, v]) => `<dt>${k}</dt><dd>${esc(v)}</dd>`).join('')}${pending(r) ? `<dt>Reply</dt><dd>Waiting for a reply to your message sent ${esc(awaiting.get(selected))}. The page checks every 10 seconds${paused ? ' once you resume' : ''}.</dd><dt>${r.relaunchedAt ? 'Historical assistant text' : 'Previous assistant text'}, before your message</dt>` : `<dt>${r.relaunchedAt ? 'Historical last assistant text' : 'Last assistant text'}</dt>`}<dd><pre class="last-text">${esc(r.lastAssistantText || 'No assistant text yet.')}</pre></dd>${r.lastError ? `<dt>${r.relaunchedAt ? 'Historical last error' : 'Last error'}</dt><dd>${esc(r.lastError)}</dd>` : ''}</dl>${historyButton(r)}${seenButton(r)}${canReply(r) ? `<form class="reply-form"><label for="reply">Reply to ${esc(r.agent)}</label><textarea id="reply" maxlength="2000" rows="3" placeholder="Message this seat">${esc(drafts.get(selected) || '')}</textarea><button class="btn primary" type="submit" ${sending.has(selected) ? 'disabled' : ''}>${sending.has(selected) ? 'Sending…' : 'Send'}</button></form>` : `<p class="muted">${r.connector ? 'Board replies disabled for Discord connectors' : 'reply needs a registered seat'}</p>`}${receipt ? `<p class="receipt ${receipt.delivered ? '' : 'failed'}" role="status">${esc(receipt.delivered ? `delivered ${receipt.sentAt} to tmux ${receipt.session}` : `failed${receipt.exitCode == null ? '' : ' (exit ' + receipt.exitCode + ')'}: ${receipt.stderr || receipt.error || 'no output'}`)}</p>` : ''}`;
   }
   // Conversation view (#1507, CHAT-02): the full read-only history from the board's
   // /api/conversations and /api/conversation routes. Session content is set with
@@ -197,7 +194,7 @@
     if (!conv) return;
     const r = row(conv.row), can = !!r && !!canReply(r), receipt = receipts.get(conv.row);
     $('conv-form').hidden = !can; $('conv-no-reply').hidden = can;
-    $('conv-no-reply').textContent = !r ? 'This session is no longer in the board scan.' : r.connector ? 'Board replies disabled for Discord connectors' : !canSend ? 'Replies are off: this Console is read-only.' : 'reply needs a registered seat';
+    $('conv-no-reply').textContent = !r ? 'This session is no longer in the board scan.' : r.connector ? 'Board replies disabled for Discord connectors' : 'reply needs a registered seat';
     if (r) $('conv-reply-label').textContent = `Reply to ${r.agent}`;
     $('conv-send').disabled = sending.has(conv.row); $('conv-send').textContent = sending.has(conv.row) ? 'Sending…' : 'Send';
     $('conv-receipt').hidden = !receipt;
@@ -479,5 +476,5 @@
     setTimeout(() => { const a = document.activeElement; if (!a || a === document.body || a.disabled || !a.getClientRects().length) line.focus(); });
   });
   // Sign out (sage-1347, F7): a plain same-origin form POST to /auth/logout, shown only under --sso.
-  api('/api/config').then(config => { canSend = config.send === true; board = config.board || 'the Console board'; $('board-url').textContent = `Board: ${board}`; window.MosaicFederation?.render(config.federation, $('federation')); if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
+  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; window.MosaicFederation?.render(config.federation, $('federation')); if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
 })();

packages/webui/src/serve.mjs

@@ -13,9 +13,19 @@ import { chatHTTP } from './chat-http.mjs';
 import { processingHTTP } from './processing-http.mjs';
 import { DECISION_ROUTE, decisionHTTP, decisionRefuse, createConfirmations } from './decision-http.mjs';
 
+export const DEFAULT_BOARD = 'http://127.0.0.1:7331';
 export function isLoopback(host) {
   return host === 'localhost' || host === '::1' || (isIP(host) === 4 && host.startsWith('127.'));
 }
+export function boardURL(value) {
+  const url = new URL(value);
+  if (url.protocol !== 'http:' || !isLoopback(url.hostname.replace(/^\[|\]$/g, '')) || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+    throw new Error('board must be an HTTP loopback origin without credentials, path, query or fragment');
+  }
+  // Avoid hostname resolution for localhost.
+  if (url.hostname === 'localhost') url.hostname = '127.0.0.1';
+  return url.origin;
+}
 const root = resolve(import.meta.dirname, 'public');
 const files = new Map([
   ['/', ['index.html', 'text/html; charset=utf-8']],
@@ -181,20 +191,6 @@ const one = (req, name) => (req.headersDistinct[name]?.length === 1 ? req.header
 // so it carries `sso: true` and the public origin; the preview writer still checks its header.
 const signedIn = (req, p) => p.sso === true || one(req, p.header) === p.user;
 const ownOrigin = p => p.origin ?? `https://${p.host}`;
-// Row 198: the board's writes, in-process. A body the board refuses is a 400; the reply's own answer
-// (its status and receipt) comes back as the board gave it, and a failed scan is a 500 with no detail.
-async function boardSend(req, res, { board, path }) {
-  let value;
-  try { value = JSON.parse((await body(req)).toString('utf8')); } catch (err) { return json(res, 400, { error: err.message }); }
-  try {
-    if (path === '/api/seen') return json(res, 200, await board.markSeen(value));
-    const out = await board.reply(value);
-    return json(res, out.status, out.body);
-  } catch (err) {
-    if (path === '/api/seen') return json(res, 400, { error: err.message });
-    return json(res, 500, { error: 'board read failed' });
-  }
-}
 async function busSend(req, res, { send, preview, log }) {
   if (!signedIn(req, preview)) return json(res, 401, { error: 'sign-in required' });
   let to = null;
@@ -605,8 +601,7 @@ async function projectFileRead(res, read, path, search) {
 // `log` takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
 // `agentWrite` (row 194, D7) is `(verb, args) => Promise` for the Agents section's verbs and instance.request.
-// `board` is createBoard() from packages/control-board (row 198), run in-process; null answers the board routes 503.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = null, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, decisionWrite = null, userOptions = null, federation = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, processing = null, decisionWrite = null, userOptions = null, federation = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
   if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
   if (host === 'localhost') host = '127.0.0.1';
   if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
@@ -620,10 +615,11 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
   // Row 252 (#1753, design section 4): Console decision answers need --sso and --send, never the tester.
   if (decisionWrite !== null && (tester || sso === null || send === null || typeof decisionWrite !== 'function')) throw new Error('Console decision answers need --sso and --send on the main listener');
   const confirmations = createConfirmations();
+  const upstream = boardURL(board);
   // `userOptions` (FED R6, #1800) is `session => options`, the bus-backed options over that session
   // user's own transport (console-bus.mjs). Only a signed-in listener has user sessions.
   if (userOptions !== null && (sso === null || typeof userOptions !== 'function')) throw new Error('user sessions need --sso');
-  const owner = { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, files };
+  const owner = { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files };
   const hub = federationView(federation);
   // An object with none of the three is refused too: asking for the preview never serves without it.
   if (preview !== null && !(preview = previewOptions({ publicHost: preview.host, authHeader: preview.header, allowUser: preview.user }))) {
@@ -631,10 +627,9 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
   }
   if (proof !== null && (preview === null || tester)) throw new Error('proxy proof needs preview mode');
   if (send !== null && ((preview === null && sso === null) || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
-  const boardLabel = board ? 'in the Console' : null;
   const server = createServer(async (req, res) => {
     // A granted user's request rebinds these below; every other request keeps the owner's.
-    let { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, files } = owner, granted = false;
+    let { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files } = owner, granted = false;
     res.setHeader('x-content-type-options', 'nosniff');
     res.setHeader('referrer-policy', 'no-referrer');
     // Under --sso the Sign out form's POST is redirected to the provider's end-session endpoint, and
@@ -701,7 +696,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
         if (!userRoute(path, req.method)) return json(res, 403, { error: 'owner-only', message: 'this part of the Console is the business owner\'s' });
         if (userOptions === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no user transport' });
         ({ bus, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));
-        reads = null; files = USER_FILES; granted = true;
+        reads = null; upstream = null; files = USER_FILES; granted = true;
       }
     }
     if (named && preview !== null) {
@@ -784,15 +779,31 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
     if (path === '/api/chat' || path.startsWith('/api/chat/')) {
       return chatHTTP(req, res, { path, search, chat, named, send, preview: writer, log });
     }
-    // Row 198: the board's two writes run in-process, under --send and the public name only.
-    if (path === '/api/seen' || path === '/api/reply') {
-      if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
-      if (!send || !named) return json(res, 403, { error: 'read-only', sent: false });
-      if (!board) return json(res, 503, { error: 'not-configured', message: 'the Console has no board configured' });
-      return boardSend(req, res, { board, path });
-    }
     // Nothing else but GET and HEAD gets past here in preview mode, whatever the Host.
     if ((preview !== null || sso !== null) && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only', message: 'the Console preview is read-only' });
+    // The conversation routes (#1507, CHAT-02) keep their query; the board validates it.
+    const conversation = path === '/api/conversations' || path === '/api/conversation';
+    const allowed = path === '/api/board' || conversation ? 'GET' : ['/api/seen', '/api/reply'].includes(path) ? 'POST' : null;
+    if (allowed) {
+      if (req.method !== allowed) return json(res, 405, { error: 'method not allowed' });
+      if (upstream === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no board for this session' });
+      let bytes;
+      if (allowed === 'POST') {
+        try { bytes = await body(req); } catch (err) { return json(res, 400, { error: err.message }); }
+      }
+      try {
+        const response = await fetch(upstream + path + (conversation ? search : ''), {
+          method: allowed, headers: bytes ? { 'content-type': 'application/json' } : {}, body: bytes,
+          redirect: 'error', signal: AbortSignal.timeout(timeout),
+        });
+        const text = await response.text();
+        JSON.parse(text); // Never serve upstream HTML or scripts as API data.
+        res.writeHead(response.status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+        return res.end(text);
+      } catch {
+        return json(res, 502, { error: `Board unreachable or invalid response at ${upstream}. Check the board server. No automatic action retry.`, board: upstream });
+      }
+    }
     if (path.startsWith('/api/bus/')) {
       const verb = path.slice('/api/bus/'.length);
       if (!BUS_VERBS.includes(verb)) return json(res, 404, { error: 'not found' });
@@ -812,7 +823,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
     if (path === '/api/queue' || path.startsWith('/api/queue/') || path === '/api/business' || path === '/api/settings' || path === '/api/bus-status') {
       if (req.method !== 'GET') return json(res, 405, { error: 'method not allowed' });
       const a = server.address(), address = `http://${a.family === 'IPv6' ? `[${a.address}]` : a.address}:${a.port}/`;
-      if (path === '/api/settings') return consoleRead(res, async () => ({ ...(reads ? await reads.settings() : { release: null, business: null, notifier: { refused: 'not-configured', message: 'the Console has no reads configured' } }), board: boardLabel, address }));
+      if (path === '/api/settings') return consoleRead(res, async () => ({ ...(reads ? await reads.settings() : { release: null, business: null, notifier: { refused: 'not-configured', message: 'the Console has no reads configured' } }), board: upstream, address }));
       if (!reads) return json(res, 503, { error: 'not-configured', message: 'the Console has no reads configured' });
       if (path === '/api/business') return consoleRead(res, () => reads.business());
       if (path === '/api/bus-status') return consoleRead(res, () => reads.busStatus());
@@ -822,18 +833,10 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = nul
       return consoleRead(res, () => reads.row(Number(id)));
     }
     if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
-    // Row 198: the board's reads, in-process. The sign-in gate above has already run for each one.
-    if (path === '/api/board' || path === '/api/conversations' || path === '/api/conversation') {
-      if (!board) return json(res, 503, { error: 'not-configured', message: 'the Console has no board configured' });
-      if (path === '/api/board') return consoleRead(res, () => board.index());
-      let out;
-      try { out = board.conversation(new URL(req.url, 'http://localhost')); } catch { return json(res, 500, { error: 'conversation read failed' }); }
-      return json(res, out.status, out.body);
-    }
     // `send`: the page shows the composer only where a send can pass (the public name, --send on).
     // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
     // `user` and `federation` (FED R6) only when there is one, so the owner's config is unchanged.
-    if (path === '/api/config') return json(res, 200, { board: granted ? null : boardLabel, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, decide: !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, decide: !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
     if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
     if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
     const file = files.get(path);

packages/webui/tests/agents-browser.test.mjs

@@ -17,7 +17,7 @@ const view={business:'acme',revision:REV,launch:true,noHire:['reviewer'],retired
 
 test('row 194 T16 Settings Agents: unavailable read-only, launch follows its request, confirms, reason and refusal',{timeout:90000},async()=>{
  const bus={messages:async()=>({messages:[],unread:0}),usage:async()=>{throw Error('no usage');},instances:async()=>view};
- const web=await startServer({port:0,board:null,bus,reads:{settings:()=>({business:'acme',release:'fixture',notifier:{}})}}),b=await browser();
+ const web=await startServer({port:0,board:'http://127.0.0.1:9',bus,reads:{settings:()=>({business:'acme',release:'fixture',notifier:{}})}}),b=await browser();
  try{
   // POSTs answer from `replies`, request reads from `polls`; both record what was asked.
   await b.call('Page.addScriptToEvaluateOnNewDocument',{source:`window.posts=[];window.replies=[];window.polls=[];window.reads=[];window.enabled=new URL(location.href).searchParams.has('send');const original=window.fetch;window.fetch=async(url,options={})=>{if(url==='/api/config')return new Response(JSON.stringify({send:window.enabled}));if(options.method==='POST'&&/^\\/api\\/(agent|veto|instances)/.test(url)){posts.push([url,JSON.parse(options.body)]);const [status,body]=replies.shift();return new Response(JSON.stringify(body),{status});}if(String(url).startsWith('/api/agent/request')){reads.push(url);const [status,body]=polls.shift()??[200,{request:'${ID}',action:'launch',instance:'coder',state:'open',done:null,cancelled:null}];return new Response(JSON.stringify(body),{status});}return original(url,options);};`});
@@ -131,7 +131,7 @@ test('row 194 T16 Settings Agents: unavailable read-only, launch follows its req
 test('row 256 T7 T8 the human page offers Delete on a creative instance, the tester page never does',{timeout:90000},async()=>{
  const human={...view,instances:{...view.instances,bean:{...view.instances.bean,endProtected:false}}};
  const bus={messages:async()=>({messages:[],unread:0}),usage:async()=>{throw Error('no usage');},instances:async()=>human};
- const web=await startServer({port:0,board:null,bus,reads:{settings:()=>({business:'acme',release:'fixture',notifier:{}})}}),b=await browser();
+ const web=await startServer({port:0,board:'http://127.0.0.1:9',bus,reads:{settings:()=>({business:'acme',release:'fixture',notifier:{}})}}),b=await browser();
  try{
   await b.call('Page.addScriptToEvaluateOnNewDocument',{source:`const q=new URL(location.href).searchParams;const original=window.fetch;window.fetch=async(url,options={})=>{if(url==='/api/config')return new Response(JSON.stringify(q.has('tester')?{tester:true}:{send:true}));return original(url,options);};`});
   const port=web.address().port;

packages/webui/tests/board-held.test.mjs

@@ -22,7 +22,6 @@ import { views } from '../../bus/src/views.mjs';
 import { startServer } from '../src/serve.mjs';
 import { browser } from './browser.mjs';
 import { fixture, close } from './fixture.mjs';
-import { routeWrites } from './board-route.mjs';
 
 const businesses = {
   demo: {
@@ -73,8 +72,7 @@ async function setup(machine, fast = false) {
   const reader = b0.bindReader({ business: 'demo' });
   const bus = views({ call: async (verb, args = {}) => structuredClone(b0.request(reader, { verb, args })) });
   const f = await fixture(), b = await browser({ machine });
-  const web = await startServer({ port: 0, board: f.board, bus }), base = `http://127.0.0.1:${web.address().port}/`;
-  const stopRoute = await routeWrites(b, base, f.board);
+  const web = await startServer({ port: 0, board: f.boardURL, bus }), base = `http://127.0.0.1:${web.address().port}/`;
   await b.call('Page.addScriptToEvaluateOnNewDocument', { source: stub(fast) });
   await b.viewport(1280);
   const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
@@ -83,7 +81,7 @@ async function setup(machine, fast = false) {
   const reqs = () => b.evaluate('window.__reqs');
   const polls = () => b.evaluate('window.__polls');
   const settle = () => new Promise(r => setTimeout(r, 600));
-  const done = async () => { await stopRoute(); await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
+  const done = async () => { await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
   return { b, base, wait, text, shown, reqs, polls, settle, done };
 }
 

packages/webui/tests/board-inprocess.test.mjs

@@ -1,144 +0,0 @@
-// Row 198: the board runs in-process in the Console. These are the Console-side killers:
-// M3 (no proxy fetch to a board URL), M5 (no seen write without --send), M6 and M7 (the
-// preview gate runs before any board route), M10 (positive control: the write branches
-// reach the board under --send) and M14 (a pending board read never blocks /healthz).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { request } from 'node:http';
-import { startServer } from '../src/serve.mjs';
-import { createBoard } from '../../control-board/src/board.mjs';
-import { seenPath } from '../../control-board/src/scan.mjs';
-import { close, fixture } from './fixture.mjs';
-
-const NAME = 'mosaic-preview.example.com', HEADER = 'remote-user', ID = 'jason';
-const preview = { host: NAME, header: HEADER, user: ID };
-const ok = { [HEADER]: ID, origin: `https://${NAME}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' };
-const without = name => Object.fromEntries(Object.entries(ok).filter(([k]) => k !== name));
-const BODY = '{"agent":"proj/agent1","text":"hi"}';
-const BOARD_ROUTES = [['GET', '/api/board'], ['GET', '/api/conversations'], ['POST', '/api/seen'], ['POST', '/api/reply']];
-
-// node:http, not fetch: fetch can't set Host.
-function call(port, { method = 'POST', path, headers = ok, host = NAME, body = BODY } = {}) {
-  return new Promise((resolve, reject) => {
-    const length = method === 'GET' ? {} : { 'content-length': Buffer.byteLength(body) };
-    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
-      let text = '';
-      res.on('data', c => (text += c));
-      res.on('end', () => resolve({ status: res.statusCode, text }));
-    });
-    req.on('error', reject);
-    req.end(method === 'GET' ? undefined : body);
-  });
-}
-
-// A board that counts every call that reaches it.
-function countingBoard(hits, index = async () => ({ sessions: [], seen: [] })) {
-  return {
-    index: async () => { hits.push('index'); return index(); },
-    markSeen: async () => { hits.push('markSeen'); return { seen: [] }; },
-    reply: async () => { hits.push('reply'); return { status: 200, body: { delivered: true } }; },
-    conversation: async () => { hits.push('conversation'); return { status: 200, body: {} }; },
-  };
-}
-
-function stop(web) {
-  return new Promise(resolve => { web.closeAllConnections(); web.close(resolve); });
-}
-
-// M6, M7: under the preview, every board route refuses a request without the proxy header
-// (401) and a request with a foreign Host (403), and the board never runs.
-test('preview: every board route refuses without the proxy header (401) or with a foreign Host (403) before the board runs (M6, M7)', async t => {
-  const hits = [];
-  const web = await startServer({ port: 0, board: countingBoard(hits), preview });
-  t.after(() => stop(web));
-  const port = web.address().port;
-  for (const [method, path] of BOARD_ROUTES) {
-    const bare = await call(port, { method, path, headers: without(HEADER) });
-    assert.equal(bare.status, 401, `${method} ${path} without the header`);
-    const foreign = await call(port, { method, path, host: 'evil.example' });
-    assert.equal(foreign.status, 403, `${method} ${path} with a foreign Host`);
-  }
-  assert.deepEqual(hits, [], 'the board ran for a refused request');
-});
-
-// M5: without --send the seen write refuses and writes no mark file.
-test('seen without --send refuses and writes no mark (M5)', async t => {
-  const f = await fixture();
-  t.after(() => f.close());
-  const web = await startServer({ port: 0, board: f.board, preview });
-  t.after(() => stop(web));
-  const res = await call(web.address().port, { path: '/api/seen', body: JSON.stringify({ project: 'proj', agent: 'agent1', lastActivity: 'x', seen: true }) });
-  assert.equal(res.status, 403);
-  assert.equal(JSON.parse(res.text).sent, false);
-  assert.equal(existsSync(seenPath(join(f.root, 'board'))), false, 'a mark was written without --send');
-});
-
-// M10: positive control. With --send on the public name, both writes reach the in-process
-// board. A branch moved below the read-only refusal would answer 403 here and fail.
-test('with --send on the public name, seen and reply reach the in-process board (M10)', async t => {
-  const f = await fixture();
-  t.after(() => f.close());
-  const web = await startServer({ port: 0, board: f.board, preview, send: async () => ({ id: 'msg-0001' }) });
-  t.after(() => stop(web));
-  const port = web.address().port;
-  const rec = (await f.board.index()).sessions.find(r => r.agent === 'agent1');
-  const seen = await call(port, { path: '/api/seen', body: JSON.stringify({ project: rec.project, agent: rec.agent, lastActivity: rec.lastActivity, seen: true }) });
-  assert.equal(seen.status, 200, seen.text);
-  assert.equal(existsSync(seenPath(join(f.root, 'board'))), true, 'the seen write did not reach the board');
-  const reply = await call(port, { path: '/api/reply' });
-  assert.equal(reply.status, 200, reply.text);
-  assert.equal(JSON.parse(reply.text).delivered, true);
-  assert.equal(f.captures.length, 1);
-  assert.match(f.captures[0].args.at(-1), /^hi\n/);
-});
-
-// M3: the Console reads its board in-process. No request leaves the Console for a board URL.
-test('a board read makes no request to a board URL (M3)', async t => {
-  const hits = [];
-  const web = await startServer({ port: 0, board: countingBoard(hits) });
-  t.after(() => stop(web));
-  const base = `http://127.0.0.1:${web.address().port}`;
-  const urls = [];
-  const realFetch = globalThis.fetch;
-  globalThis.fetch = (url, opts) => { urls.push(String(url)); return realFetch(url, opts); };
-  t.after(() => { globalThis.fetch = realFetch; });
-  assert.equal((await globalThis.fetch(base + '/api/board')).status, 200);
-  assert.deepEqual(hits, ['index'], 'the board ran once, in-process');
-  assert.equal(urls.length, 1, 'the spy saw the test request');
-  assert.ok(urls.every(u => u.startsWith(base)), `a request left the Console: ${urls.join(', ')}`);
-});
-
-// M14: a board read never blocks the Console's loop. The board is a real createBoard, and its tmux
-// check runs through a shim on PATH that sleeps 1 s. A 10 ms timer records the longest stall of the
-// loop while /api/board is pending; a spawnSync in the read path stalls the loop for the shim's full
-// second. /healthz is timed by elapsed time from the same moment.
-test('a board read never blocks the loop: the timer gap and /healthz stay short while /api/board is pending (M14)', async t => {
-  const root = mkdtempSync(join(tmpdir(), 'webui-m14-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const shim = join(root, 'shim'), sessionsDir = join(root, 'sessions'), seatsDir = join(root, 'seats');
-  for (const d of [shim, sessionsDir, seatsDir]) mkdirSync(d);
-  writeFileSync(join(shim, 'tmux'), '#!/bin/sh\nsleep 1\nexit 1\n');
-  chmodSync(join(shim, 'tmux'), 0o755);
-  const PATH = process.env.PATH;
-  process.env.PATH = `${shim}:${PATH}`;
-  t.after(() => { process.env.PATH = PATH; });
-  const board = createBoard({ specs: [{ agent: 'agent1', project: 'proj', sessionsDir, tmux: { socket: null, session: 'agent1' } }], boardDir: join(root, 'board'), seatsDir, discordDataRoot: root, host: 'm14' });
-  const web = await startServer({ port: 0, board });
-  t.after(() => stop(web));
-  const base = `http://127.0.0.1:${web.address().port}`;
-  let last = Date.now(), worst = 0;
-  const tick = setInterval(() => { const now = Date.now(); worst = Math.max(worst, now - last); last = now; }, 10);
-  t.after(() => clearInterval(tick));
-  const pending = fetch(base + '/api/board');
-  const t0 = Date.now();
-  const health = await fetch(base + '/healthz');
-  const healthMs = Date.now() - t0;
-  assert.equal(health.status, 200);
-  assert.ok(healthMs < 500, `/healthz took ${healthMs} ms while the board read was pending`);
-  assert.equal((await pending).status, 200);
-  clearInterval(tick);
-  assert.ok(worst < 500, `the loop stalled for ${worst} ms during the board read`);
-});

packages/webui/tests/board-refused.test.mjs

@@ -1,148 +0,0 @@
-// Row 198 r4 (sage-3618, mos-1506): the board refusal. The in-process board never answers 403 (consoleRead
-// has no 403 code), so the browser stubs the answer: while the board is refused, Fetch fulfils /api/board
-// and /api/conversation(s) with 403 board-refused, as the old fake board server did. The assertions are the
-// refusal block that 4d8123b0a deleted from shell.test.mjs, ported one for one (BUILD.md, r4 mapping).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { browser } from './browser.mjs';
-import { close } from './fixture.mjs';
-import { startServer } from '../src/serve.mjs';
-import { ReadError } from '../src/reads.mjs';
-import { sendConfig } from './board-route.mjs';
-
-// The old fake board's data: agent1 waiting on you in proj, plus agent2 and agent3, one conversation.
-function board() {
-  const state = { refused: false, down: false, mode: 'ok' };
-  let index = { sessions: [], counts: {}, generatedAt: new Date().toISOString() };
-  const one = { agent: 'agent1', project: 'proj', state: 'waiting', waitingOnYou: true, task: 'Fixture task', lastActivity: '2026-10-10T00:00:00Z', lastAssistantText: 'Input needed: fixture', registered: null };
-  const catalogue = { conversations: [{ project: 'proj', seat: 'agent1', conversation: 'c1', availability: 'available', title: 'Fixture', conversationCreatedAt: '2026-10-10T00:00:00Z', lastActivityAt: '2026-10-10T00:00:00Z' }] };
-  const page = { page: { branch: 'b1', entries: [{ message: 'm1', role: 'assistant', createdAt: '2026-10-10T00:00:00Z', content: [{ block: 0, type: 'text', text: 'Fixture history line' }] }] }, view: { incomplete: false, defaultBranch: 'b1', branch: 'b1' }, cursor: null, follow: null };
-  const set = (sessions, counts) => { index = { sessions, counts, generatedAt: new Date().toISOString() }; state.mode = 'ok'; };
-  return {
-    state,
-    board: {
-      index: () => {
-        if (state.down) throw new ReadError('read-failed', 'board unavailable');
-        if (state.mode === 'fail') throw new Error('board scan failed');
-        return index;
-      },
-      conversation: url => {
-        if (state.mode === 'fail') throw new Error('catalogue read failed');
-        return { status: 200, body: url.pathname === '/api/conversations' ? catalogue : page };
-      },
-      markSeen: () => ({ status: 200, body: { ok: true } }),
-      reply: () => ({ status: 200, body: { delivered: true } }),
-    },
-    one: () => { state.refused = false; state.down = false; set([one, { ...one, agent: 'agent2', state: 'working', waitingOnYou: false }, { ...one, agent: 'agent3', state: 'idle', waitingOnYou: false, seen: true }], { waiting: 1, working: 1 }); },
-    registered: () => { state.refused = false; state.down = false; set([{ ...one, registered: { alive: true, tmux: { session: 'fixture' } } }], { waiting: 1 }); },
-    fail: () => { state.refused = false; state.mode = 'fail'; },
-    unavailable: () => { state.refused = false; state.down = true; },
-    refuse: () => { state.refused = true; },
-  };
-}
-
-test('a board refusal fails closed: the page hides, the banner says refused, the conversation closes and clears', { timeout: 180000 }, async () => {
-  const brd = board(); brd.one();
-  const web = await startServer({ port: 0, board: brd.board });
-  const base = `http://127.0.0.1:${web.address().port}/`, b = await browser();
-  const out = process.env.WEBUI_EVIDENCE;
-  if (out) mkdirSync(out, { recursive: true });
-  const shot = async name => { if (out) await b.screenshot(join(out, `shell-${name}.png`)); };
-  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
-  const text = sel => b.evaluate(`document.querySelector(${JSON.stringify(sel)})?.textContent ?? null`);
-  const count = sel => b.evaluate(`document.querySelectorAll(${JSON.stringify(sel)}).length`);
-  const flat = async () => assert.equal(await b.evaluate('document.documentElement.scrollWidth<=document.documentElement.clientWidth'), true, 'sideways scroll at 400px');
-  const refresh = async () => { await b.evaluate('document.querySelector("#refresh").click()'); await wait('!document.querySelector("#refresh").disabled'); };
-  // The stub: while refused, the board's reads get the 403 the old fake server gave; otherwise they go on to the Console.
-  // /api/config answers with send on (mos-1524: config only), so the conversation's reply form is drawn.
-  await b.call('Fetch.enable', { patterns: [{ urlPattern: '*/api/board*', requestStage: 'Request' }, { urlPattern: '*/api/conversation*', requestStage: 'Request' }, { urlPattern: '*/api/config', requestStage: 'Request' }] });
-  b.on('Fetch.requestPaused', async ({ requestId, request: req }) => {
-    if (new URL(req.url).pathname === '/api/config') {
-      await b.call('Fetch.fulfillRequest', { requestId, responseCode: 200, responseHeaders: [{ name: 'content-type', value: 'application/json' }], body: Buffer.from(await sendConfig(base)).toString('base64') }).catch(() => {});
-      return;
-    }
-    const answer = brd.state.refused
-      ? b.call('Fetch.fulfillRequest', { requestId, responseCode: 403, responseHeaders: [{ name: 'content-type', value: 'application/json' }], body: Buffer.from(JSON.stringify({ error: 'board-refused' })).toString('base64') })
-      : b.call('Fetch.continueRequest', { requestId });
-    answer.catch(() => {});
-  });
-  try {
-    await b.call('Page.addScriptToEvaluateOnNewDocument', { source: 'window.errors=[];addEventListener("error",e=>errors.push(e.message));addEventListener("unhandledrejection",e=>errors.push(String(e.reason)));' });
-    await b.viewport(400, 900);
-    await b.navigate(base); await wait('!document.querySelector("#sessions [aria-busy]")');
-    await refresh(); await wait('document.querySelectorAll("table.sessions tbody tr").length===2');
-
-    // Board, a refusal: fails closed. The kept rows are hidden, and so is everything drawn from
-    // them: the open inspector, the project filter, the project tree's counts and the footer.
-    await b.evaluate('document.querySelector("#projects [data-project=proj]").click()');
-    assert.equal(await b.evaluate('document.querySelector("#projects [data-project=proj]").getAttribute("aria-pressed")'), 'true');
-    await b.evaluate('document.querySelector("table.sessions [data-open]").click()'); await wait('!document.querySelector("#inspector").hidden');
-    assert.equal(await text('#footer'), 'waiting 1 · working 1');
-    assert.equal(await b.evaluate('document.querySelectorAll("#projects .count").length'), 2);
-    assert.equal(await count('#seen .wait-item'), 1);
-    brd.refuse(); await refresh();
-    assert.equal(await b.evaluate('document.querySelector("#error").className'), 'banner ref');
-    assert.match(await text('#error'), /The board refused the read\. refused: board-refused/);
-    assert.equal(await b.evaluate('getComputedStyle(document.querySelector("#board-view")).display'), 'none');
-    assert.equal(await b.evaluate('document.querySelector("#board-refused").hidden'), false);
-    assert.equal(await b.evaluate('document.querySelector("#inspector").hidden'), true);
-    assert.equal(await b.evaluate('document.body.classList.contains("has-inspector")'), false);
-    assert.equal(await b.evaluate('document.querySelectorAll("#projects .count, #projects [data-project]").length'), 0);
-    assert.equal(await text('#footer'), 'Board not read: refused');
-    assert.equal(await text('#fresh-board'), 'Board not read: refused');
-    assert.doesNotMatch(await text('#status'), /Scanned/);
-    for (const id of ['#waiting-count', '#seen-count', '#session-count']) assert.equal(await text(id), '–', id);
-    await flat(); await shot('board-refused-400');
-
-    // A failed read after the refusal shows the board again, empty: no row, card or count from
-    // the refused scan, and the footer says what the banner says. With nothing focused, focus stays put.
-    await b.evaluate('document.activeElement.blur()');
-    brd.unavailable(); await refresh();
-    assert.equal(await b.evaluate('document.activeElement === document.body'), true, 'a failure with nothing focused leaves focus alone');
-    assert.equal(await b.evaluate('document.querySelector("#error").className'), 'banner err');
-    assert.match(await text('#error'), /board unavailable.*No board data loaded\./);
-    assert.notEqual(await b.evaluate('getComputedStyle(document.querySelector("#board-view")).display'), 'none');
-    assert.equal(await count('#sessions tr, #sessions [data-open], #waiting .wait-item, #seen .wait-item, #board-view [data-history]'), 0);
-    for (const id of ['#waiting-count', '#seen-count', '#session-count']) assert.equal(await text(id), '–', id);
-    assert.equal(await text('#footer'), 'Board not read: the read failed');
-    assert.equal(await text('#fresh-board'), 'Board not read: the read failed');
-    assert.equal(await text('#status'), 'Not read: the read failed');
-    assert.equal(await text('#projects'), 'Not read: the read failed.');
-    await flat(); await shot('board-refused-then-failed-400');
-    brd.one(); await refresh();
-    assert.equal(await b.evaluate('document.querySelector("#error").hidden'), true);
-    assert.equal(await b.evaluate('document.querySelector("#projects [data-project=\'\']").getAttribute("aria-pressed")'), 'true');
-    assert.notEqual(await b.evaluate('getComputedStyle(document.querySelector("#board-view")).display'), 'none');
-    assert.equal(await text('#footer'), 'waiting 1 · working 1');
-    // A good read after a failed one drops the stale words.
-    brd.fail(); await refresh(); assert.match(await text('#fresh-board'), /stale/);
-    brd.one(); await refresh(); assert.match(await text('#fresh-board'), /^Board scanned \d\d:\d\d:\d\d UTC/); assert.doesNotMatch(await text('#fresh-board'), /stale/);
-
-    // A refusal with a conversation open closes it and clears its history and reply form: the
-    // session is in no scan the page holds.
-    brd.registered(); await refresh(); await wait('document.querySelectorAll("table.sessions tbody tr").length===1');
-    await b.evaluate('document.querySelector("table.sessions [data-history]").click()');
-    await wait('document.querySelector("#conv-log").textContent.includes("Fixture history line")');
-    assert.equal(await b.evaluate('document.querySelector("#conv-form").hidden'), false);
-    // Fix to HEAD behaviour: a failed catalogue read leaves no session from the last one in the picker.
-    assert.equal(await count('#conv-pick option'), 1);
-    brd.fail(); await b.evaluate('document.querySelector("table.sessions [data-history]").click()');
-    await wait('document.querySelector("#conv-status").textContent.startsWith("History unavailable")');
-    assert.equal(await count('#conv-pick option'), 0, 'no stale session in the picker');
-    brd.registered(); await b.evaluate('document.querySelector("table.sessions [data-history]").click()');
-    await wait('document.querySelector("#conv-log").textContent.includes("Fixture history line")');
-    brd.refuse(); await refresh();
-    assert.equal(await b.evaluate('document.querySelector("#conversation").hidden'), true);
-    assert.equal(await b.evaluate('document.body.classList.contains("has-conversation")'), false);
-    assert.equal(await count('#conv-log > *'), 0);
-    assert.equal(await b.evaluate('document.querySelector("#conv-form").checkVisibility()'), false);
-    assert.equal(await b.evaluate('getComputedStyle(document.querySelector("#board-view")).display'), 'none');
-    assert.equal(await b.evaluate('document.querySelector("#board-refused").hidden'), false);
-    // Fix to HEAD behaviour: focus went back to History, which the refusal removed; it lands on the page, not <body>.
-    assert.equal(await b.evaluate('document.activeElement.id'), 'main', 'focus after a refusal closes the conversation');
-    brd.one(); await refresh(); await wait('document.querySelectorAll("table.sessions tbody tr").length===2');
-    assert.deepEqual(await b.evaluate('window.errors'), []);
-  } finally { await b.close(); await close(web); }
-});

packages/webui/tests/board-route-map.test.mjs

@@ -1,32 +0,0 @@
-// Row 198 (mos-1513): the write mapping the browser tests reach through board-route.mjs, pinned in node
-// against the named send listener itself. The Console's own gate, parse and status mapping answer here;
-// the browser tests only get back what this listener returns.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { close, fixture } from './fixture.mjs';
-import { forward, namedListener } from './board-route.mjs';
-
-test('named send listener maps the board writes: seen is 200, a delivered reply is 200 delivered, an exit-4 reply is 200 not delivered', { timeout: 60000 }, async t => {
-  const f = await fixture();
-  const named = await namedListener(f.board);
-  t.after(async () => { await close(named); await f.close(); });
-  const port = named.address().port;
-  const rec = (await f.board.index()).sessions.find(r => r.agent === 'agent1');
-  const row = `${rec.project}/${rec.agent}`;
-
-  const seen = await forward(port, '/api/seen', JSON.stringify({ project: rec.project, agent: rec.agent, lastActivity: rec.lastActivity, seen: true }));
-  assert.equal(seen.status, 200, seen.text);
-
-  const delivered = await forward(port, '/api/reply', JSON.stringify({ agent: row, text: 'hi' }));
-  assert.equal(delivered.status, 200, delivered.text);
-  assert.equal(JSON.parse(delivered.text).delivered, true);
-  assert.equal(f.captures.length, 1);
-
-  f.failReply();
-  const refused = await forward(port, '/api/reply', JSON.stringify({ agent: row, text: 'hi' }));
-  assert.equal(refused.status, 200, refused.text);
-  const body = JSON.parse(refused.text);
-  assert.equal(body.delivered, false);
-  assert.equal(body.exitCode, 4);
-  assert.equal(f.captures.length, 2);
-});

packages/webui/tests/board-route.mjs

@@ -1,75 +0,0 @@
-// Row 198 (mos-1513): the browser tests reach the real board routes. Fetch intercepts the page's
-// /api/config (send on) and its /api/reply and /api/seen writes. Node forwards each write to a named
-// send listener on the same board, with the preview Host, the https Origin and the signed user header,
-// so the server's own gate, parse and status mapping answer and the page gets that answer back.
-// Nothing here re-implements boardSend; the node route tests pin what the listener returns.
-import { request } from 'node:http';
-import { startServer } from '../src/serve.mjs';
-import { close } from './fixture.mjs';
-
-export const ROUTE = { host: 'board-route.example', header: 'X-authentik-uid', user: 'board-route-user' };
-const JSON_HEADER = [{ name: 'content-type', value: 'application/json' }];
-
-// The named send listener on the board: the preview Host, so the server's own gate and status mapping answer.
-export function namedListener(board) {
-  return startServer({ port: 0, board, preview: ROUTE, send: async () => ({ id: 'board-route' }) });
-}
-
-// One POST to the named listener, as the browser's forwarded write would arrive. Resolves { status, text }.
-export function forward(port, path, body) {
-  return new Promise((resolve, reject) => {
-    const headers = { host: ROUTE.host, origin: `https://${ROUTE.host}`, [ROUTE.header]: ROUTE.user, 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) };
-    const req = request({ host: '127.0.0.1', port, method: 'POST', path, headers }, res => {
-      let text = '';
-      res.setEncoding('utf8');
-      res.on('data', chunk => { text += chunk; });
-      res.on('end', () => resolve({ status: res.statusCode, text }));
-    });
-    req.on('error', reject);
-    req.end(body);
-  });
-}
-
-// The page's /api/config body with send on and everything else as the Console answers it. The base URL may end in a slash.
-export async function sendConfig(base) {
-  return JSON.stringify({ ...(await (await fetch(new URL('/api/config', base))).json()), send: true });
-}
-
-// Config only (mos-1524): Fetch answers the page's /api/config with send on and leaves every write alone, so the
-// writes go to the page's own listener on its existing path. The Fetch domain stays on until the browser closes.
-export async function sendOnConfig(b, base) {
-  await b.call('Fetch.enable', { patterns: [{ urlPattern: '*/api/config', requestStage: 'Request' }] });
-  b.on('Fetch.requestPaused', async ({ requestId }) => {
-    try {
-      await b.call('Fetch.fulfillRequest', { requestId, responseCode: 200, responseHeaders: JSON_HEADER, body: Buffer.from(await sendConfig(base)).toString('base64') });
-    } catch {
-      await b.call('Fetch.failRequest', { requestId, errorReason: 'Failed' }).catch(() => {});
-    }
-  });
-}
-
-// Returns a function that closes the named listener. Call it in the test's finally, before the browser closes.
-export async function routeWrites(b, base, board) {
-  const listener = await namedListener(board);
-  const port = listener.address().port;
-  await b.call('Fetch.enable', { patterns: [
-    { urlPattern: '*/api/config', requestStage: 'Request' },
-    { urlPattern: '*/api/reply', requestStage: 'Request' },
-    { urlPattern: '*/api/seen', requestStage: 'Request' },
-  ] });
-  b.on('Fetch.requestPaused', async ({ requestId, request: req }) => {
-    try {
-      const path = new URL(req.url).pathname;
-      let answer;
-      if (path === '/api/config') {
-        answer = { status: 200, text: await sendConfig(base) };
-      } else {
-        answer = await forward(port, path, req.postData ?? '');
-      }
-      await b.call('Fetch.fulfillRequest', { requestId, responseCode: answer.status, responseHeaders: JSON_HEADER, body: Buffer.from(answer.text).toString('base64') });
-    } catch {
-      await b.call('Fetch.failRequest', { requestId, errorReason: 'Failed' }).catch(() => {});
-    }
-  });
-  return () => close(listener);
-}

packages/webui/tests/browser-edge.test.mjs

@@ -1,31 +1,26 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
 import { browser } from './browser.mjs';
 import { close } from './fixture.mjs';
-import { routeWrites } from './board-route.mjs';
 import { startServer } from '../src/serve.mjs';
 
 test('browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback', { timeout: 120000 }, async () => {
-  let index = { sessions: [], counts: {}, generatedAt: 'fixture time' }, held = null, sends = 0, holdBoard = true, releaseBoard;
+  let index = { sessions: [], counts: {}, generatedAt: 'fixture time' }, held = null, sends = 0, holdBoard = true, boardResponse;
   let resolveBoardRequest;
   const boardRequested = new Promise(resolve => { resolveBoardRequest = resolve; });
-  // The board runs in-process (row 198): index() is the page's /api/board read, reply() its reply.
-  const board = {
-    index: () => {
-      if (!holdBoard) return index;
-      resolveBoardRequest();
-      return new Promise(resolve => { releaseBoard = resolve; });
-    },
-    reply: () => { sends++; return new Promise(resolve => { held = resolve; }); },
-  };
-  const web = await startServer({ port: 0, board });
+  const server = createServer(async (req, res) => {
+    for await (const chunk of req) { void chunk; }
+    res.setHeader('content-type', 'application/json');
+    if (req.url === '/api/board') { if (holdBoard) { boardResponse = res; resolveBoardRequest(); return; } return res.end(JSON.stringify(index)); }
+    sends++; held = res;
+  });
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  const web = await startServer({ port: 0, board: `http://127.0.0.1:${server.address().port}` });
   const b = await browser();
-  const base = `http://127.0.0.1:${web.address().port}`;
-  let stopRoute;
   const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out')})()`);
   try {
     await b.call('Page.addScriptToEvaluateOnNewDocument', { source: 'Object.defineProperty(window,"localStorage",{get(){throw new Error("storage denied")}});window.errors=[];addEventListener("error",e=>errors.push(e.message));' });
-    stopRoute = await routeWrites(b, base, board);
     await b.viewport(320); await b.navigate(`http://127.0.0.1:${web.address().port}`);
     // Row 95: with storage denied the toggle starts off and still turns on; the page throws nothing.
     assert.match(await b.evaluate('document.querySelector("#status").textContent'), /Machine sessions hidden/);
@@ -35,7 +30,7 @@ test('browser edge states: loading, empty, malformed, stale, hostile/long values
     let timer;
     try { await Promise.race([boardRequested, new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Show machine sessions made no /api/board request in 5 s')), 5000); })]); }
     finally { clearTimeout(timer); }
-    holdBoard = false; releaseBoard(index);
+    holdBoard = false; boardResponse.end(JSON.stringify(index));
     await wait('document.querySelector("#sessions").textContent.includes("No sessions")');
     assert.equal(await b.evaluate('document.querySelector("#waiting-count").textContent'), '0');
     assert.equal(await b.evaluate('document.documentElement.dataset.palette'), 'harbor');
@@ -57,7 +52,7 @@ test('browser edge states: loading, empty, malformed, stale, hostile/long values
     await b.evaluate('document.querySelector("#refresh").click()'); await wait('!document.querySelector("#refresh").disabled');
     assert.equal(await b.evaluate('document.querySelector(".reply-form button").disabled'), true);
     await b.evaluate('document.querySelector("#reply").focus()'); await b.call('Input.insertText', { text: 'newer ' });
-    held({ status: 200, body: { delivered: true, sentAt: 'fixture', session: agent } });
+    held.end(JSON.stringify({ delivered: true, sentAt: 'fixture', session: agent }));
     await wait('document.querySelector(".receipt")?.textContent.startsWith("delivered")');
     assert.equal(sends, 1); assert.match(await b.evaluate('document.querySelector("#reply").value'), /newer/);
     // A stale registration removes the form, but does not destroy its draft.
@@ -97,5 +92,5 @@ test('browser edge states: loading, empty, malformed, stale, hostile/long values
     assert.match(await b.evaluate('document.querySelector("#error").textContent'), /Invalid board session data/);
     assert.equal(await b.evaluate('document.querySelectorAll("table.sessions [data-open]").length'), 1);
     assert.deepEqual(await b.evaluate('window.errors'), []);
-  } finally { releaseBoard?.(index); held?.({ status: 200, body: {} }); await stopRoute?.(); await b.close(); await close(web); }
+  } finally { boardResponse?.end(); held?.end(); await b.close(); await close(web); await close(server); }
 });

packages/webui/tests/browser.test.mjs

@@ -4,17 +4,14 @@ import { mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { browser } from './browser.mjs';
 import { fixture } from './fixture.mjs';
-import { routeWrites } from './board-route.mjs';
 
 test('served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures', { timeout: 120000 }, async () => {
   const f = await fixture(), b = await browser();
   const out = process.env.WEBUI_EVIDENCE;
   if (out) mkdirSync(out, { recursive: true });
   const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out')})()`);
-  let stopRoute;
   try {
     await b.call('Page.addScriptToEvaluateOnNewDocument', { source: 'window.errors=[];addEventListener("error",e=>errors.push(e.message));addEventListener("unhandledrejection",e=>errors.push(String(e.reason)));' });
-    stopRoute = await routeWrites(b, f.base, f.board);
     await b.viewport(1440); await b.navigate(f.base); await wait('document.querySelectorAll("table.sessions tbody tr").length===3');
     assert.equal(await b.evaluate('document.querySelector("#waiting-count").textContent'), '2');
     assert.equal(await b.evaluate('document.querySelectorAll("#projects [data-project]").length'), 3);
@@ -112,15 +109,15 @@ test('served Console browser: real board fixtures, keyboard, drafts, receipts, t
       await b.evaluate('document.querySelector("#close").click()');
     }
     // Empty and unreachable pages are tested as browser responses, never live data claims.
-    // Fail only the fixture board's reads. The page keeps the last data and names the board it could not reach (row 198: the Console).
-    f.board.setDown(true);
+    // Stop only the fixture board. The page keeps the last data and reports its URL.
+    await new Promise(r => f.board.close(r));
     await b.evaluate('document.querySelector("#refresh").click()');
     await wait('!document.querySelector("#error").hidden');
     const error = await b.evaluate('document.querySelector("#error").textContent');
-    assert.ok(error.includes('in the Console')); assert.match(error, /Showing last known data/);
+    assert.ok(error.includes(f.boardURL)); assert.match(error, /Showing last known data/);
     assert.ok(await b.evaluate('document.querySelectorAll("table.sessions tbody tr").length') > 0);
     assert.deepEqual(await b.evaluate('window.errors'), []);
     await b.navigate(f.base); await wait('!document.querySelector("#error").hidden');
     assert.match(await b.evaluate('document.querySelector("#error").textContent'), /No board data loaded/);
-  } finally { await stopRoute?.(); await b.close(); await f.close(); }
+  } finally { await b.close(); await f.close(); }
 });

packages/webui/tests/bus-browser.test.mjs

@@ -98,7 +98,7 @@ test('S5 pages in a browser: real broker rows, inert text, Copy, routes, failure
   assert.ok(comments.label.includes('\u001b'), 'the label excerpt keeps the ESC byte');
   assert.ok(comments.label.includes('\u202e'), 'the label excerpt keeps the bidi character');
   writeFileSync(fieldsFile, JSON.stringify(hostile));
-  const web = await startServer({ port: 0, board: f.board, bus: s.bus, fieldsFile }), base = `http://127.0.0.1:${web.address().port}/`;
+  const web = await startServer({ port: 0, board: f.boardURL, bus: s.bus, fieldsFile }), base = `http://127.0.0.1:${web.address().port}/`;
   const out = process.env.WEBUI_EVIDENCE;
   if (out) mkdirSync(out, { recursive: true });
   const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);