✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (1820.143648ms)
✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (133.134403ms)
✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (233.074855ms)
✔ NO_COLOR: no escape codes, except reverse video on the selected row (285.161495ms)
✔ 1-9 shows the decide flow's own lines and question; only y resolves (193.772543ms)
✔ the app shows the same decide text as mosaic decide (132.297387ms)
✔ any key but y or Y at the question answers No; nothing is sent (1500.039271ms)
✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (1701.039251ms)
✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (1969.061615ms)
✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (357.275638ms)
✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (149.646164ms)
✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (1104.310459ms)
✔ quitting at the question answers No and sends nothing, armed or not (399.276391ms)
✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (167.383022ms)
✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (271.150539ms)
✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (1169.659027ms)
✔ at every size the decide box shows each line y depends on, or says it is hidden (9558.052761ms)
✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (217.353848ms)
✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (162.471199ms)
✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (61.851632ms)
✔ keys: views, moving, trail of a selection, the command line, help and quit (338.418971ms)
✔ one option: the status line says Press 1, not 1-1 (109.703123ms)
✔ no business: the app says so and :business picks one (77.794884ms)
✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (2.01419ms)
✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (179.143526ms)
✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.457948ms)
✔ decide with --note still asks; a No sends nothing (60.329389ms)
✔ the app's business comes from a live bus host only (1.042448ms)
✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (6.938024ms)
✔ draw is pure: same state, same frame (0.779856ms)
✔ recordBootRefused keeps the last good load across refusals; recordBootOk clears the refusal (12.183455ms)
✔ an unknown key and a JSON syntax error each leave the bus down with the reason and path in the status (929.023148ms)
✔ a missing file is recorded too, and a valid file clears the status on the next start (553.186126ms)
✔ CLI off, absent and other-only channel selections refuse every project/thread flow before any effect (21.558911ms)
✔ CLI enabled project/thread lists dispatch through selection without changing output (2.413031ms)
✔ both channels off recover through the existing human CLI, socket and organization writer (2927.676752ms)
✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (152.029628ms)
✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (132.187564ms)
✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (123.926376ms)
✔ decide prints a declining choice as declining (126.326882ms)
✔ an unknown outcome is reported once and never resent (195.287157ms)
✔ a decision closed before the answer arrives exits 2 and points at its trail (242.268477ms)
✔ a prefix that matches two open decisions exits 2 and resolves neither (141.068355ms)
✔ without --business a command uses the live host's business, and a stale host.json is not a host (103.429421ms)
✔ every human command refuses inside an agent run before it touches the bus (102.868117ms)
✔ usage errors exit 4; no business and no host is a usage error (169.256738ms)
✔ agents and tasks print through the broker (122.109511ms)
✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (2.021033ms)
✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (65.094245ms)
✔ trackers come from the tracker.* variables of the one project that names a tracker project (93.057876ms)
✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (51.397333ms)
✔ two projects that each name a tracker project refuse, since the boot shape holds one (49.008929ms)
✔ a business without tracker.baseUrl gets no trackers entry (46.787297ms)
✔ an unknown business and a broken system config refuse with exit 3 (91.844853ms)
✔ follow prints an unsolicited message after plain talk returned (204.509641ms)
✔ talk --follow continues after reply and prints a later unsolicited message (178.577729ms)
✔ inbox lists all unread human messages under decisions, does not deliver or read them (2780.602908ms)
✔ follow refuses agent context and bad arguments (112.630619ms)
✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (132.777151ms)
✔ plain talk leaves the process SIGINT handlers unchanged (217.102582ms)
✔ empty views say so (0.933361ms)
✔ the trail keeps the broker's order and names a decision's task without its rows (1.197495ms)
✔ tasks print the tracker fields the snapshot carries (0.203588ms)
✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (1055.584018ms)
✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (935.847306ms)
✔ the size cap refuses a push before any byte (568.948484ms)
✔ a fetch over the cap refuses before any byte reaches the reviewer (843.586559ms)
✔ the socket refuses a request with no capability, an unknown one, and a bad request line (446.885291ms)
✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (644.977382ms)
✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (1666.76439ms)
✔ a review of a project the business no longer has refuses unknown-project (706.118608ms)
✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (358.220507ms)
✔ close() answers host-closing to a connection still sending its request line (350.779357ms)
✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (1149.108038ms)
✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (922.090013ms)
✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (1064.38469ms)
✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (42.605076ms)
✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (669.886036ms)
✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (23.36429ms)
✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (301.712963ms)
✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (539.078951ms)
✔ land: the squash runs the gate in its own worktree, then main moves and the broker records it (463.088732ms)
✔ land: an arbiter-resolved landing's squash says the arbiter resolved it through the broker (448.536895ms)
✔ land: refusals before the gate answer the role at once and leave main and no worktree (451.628195ms)
✔ land: a failed gate is refused gate-failed with its step, told to the role, and main stays (467.947176ms)
✔ land: a record the broker refuses moves main back, and the landing is refused with the broker's code (430.537013ms)
✔ land: a second landing while one runs refuses land-busy, and close() stops the gate and refuses host-closing (464.094096ms)
✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1093.324444ms)
✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (374.334953ms)
✔ a second host for the same data root refuses with exit 3 while the first runs (261.469686ms)
✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (727.162348ms)
✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (3.384312ms)
✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (1.027233ms)
✔ a live host's lock stays, however old the file is (0.692484ms)
✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (1106.949925ms)
✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (231.599495ms)
✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (32.669102ms)
✔ a broker fork that throws leaves no host.lock and no host.json (39.780944ms)
✔ a broker send that throws leaves no host.lock and no host.json (33.785563ms)
✔ a broker that misses its boot wait leaves no host.lock and no host.json (37.805946ms)
✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (233.981943ms)
✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (242.127932ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (509.05675ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (723.158109ms)
✔ a host.json that can't be written stops both children and leaves no host.lock (801.884287ms)
✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (34.718186ms)
✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (214.728592ms)
✔ an error event on the broker while the notifier starts fails the start once the notifier replies (357.792354ms)
✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (337.74207ms)
✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (353.97254ms)
✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1333.907889ms)
✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (572.015274ms)
✔ a broker reply with no request waiting breaks the channel and the host exits 1 (343.152013ms)
✔ a notifier that refuses stops the broker and the host refuses with exit 3 (381.590252ms)
✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (363.342788ms)
✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (217.859026ms)
✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (227.711159ms)
✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (176.674443ms)
✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (242.60763ms)
✔ watchChildren reports a child that died before it was called, and one that dies later (21.560456ms)
✔ bus stop refuses to signal a live pid that is not a bus host (203.09302ms)
✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (321.164264ms)
✔ bus start refuses with exit 3 without a notifier config (107.65574ms)
✔ bus start runs until bus stop; status reports it while it runs (789.175168ms)
✔ bus-service.sh renders the unit and installs it into a given directory (60.813384ms)
✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (76.804362ms)
✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (13.414979ms)
✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (8.686398ms)
✔ row 165 CLI: instance add puts an instance in the file, validate exits 0, and the log names the human (370.417721ms)
✔ row 165 CLI: instance set passes the vars file and --no-launch, and a vars-only change needs no restart (316.574761ms)
✔ row 165 CLI: a refusal names its code and why, exits 2 and keeps the bytes (366.206954ms)
✔ row 165 CLI: usage errors exit 4 before any bus call, and an agent session is refused (98.337263ms)
✔ row 165: scripts/mosaic sends business instances and instance to packages/cli, and validate still to packages/business (159.301982ms)
✔ REQ-LIMIT-2 a claude-code launch asks mayLaunch with launch.account.name (28.685165ms)
✔ REQ-LIMIT-2 each login set the account can name is accepted when the bus host holds exactly it (39.378563ms)
✔ REQ-LIMIT-2 account-credential-missing: the named set is not a login set, or the bus host lacks part of it (39.128784ms)
✔ REQ-LIMIT-2 account-credential-ambiguous: the bus host sets a credential variable outside the named set, ANTHROPIC_BASE_URL included (27.247183ms)
✔ REQ-LIMIT-2 account-is-credential: launch.account.name is the value of a credential variable the bus host sets (16.695154ms)
✔ REQ-LIMIT-2 a pi launch carries account null and skips both account checks (18.129418ms)
✔ REQ-LIMIT-2 with no launch.account a claude-code launch carries null and the environment is not checked for ambiguity (9.232029ms)
✔ REQ-LIMIT-4 the launcher asks mayLaunch with the instance, provider, model and account (row 126), and goes on to authorization on an allow (25.788508ms)
✔ REQ-LIMIT-3 REQ-LIMIT-4 a launch whose subject is at its limit is refused limit-reached and logged with the check, limit and count (12.283778ms)
✔ REQ-LIMIT-4 fail closed: a refused op, a check failure or a malformed answer refuses limit-check-failed, naming the check and the code (109.107443ms)
✔ REQ-LIMIT-4 the launcher reaches token-limit only through the bus: launcher.mjs imports no limit check (0.818926ms)
✔ each launch rereads limits and model selections; lowered limits keep sessions and log exact hit (51.150945ms)
✔ row 65 a passing primary is the route: its provider and model reach mayLaunch, and a stated fallback is never used (30.444635ms)
✔ row 65 a failed primary preflight takes the stated fallback, and the limit checks see the fallback route (17.848808ms)
✔ row 65 a failed primary with no fallback refuses with the preflight code and never asks mayLaunch (14.672642ms)
✔ row 65 a fallback whose own preflight fails refuses with its code and names both reasons (11.077075ms)
✔ row 65 the fallback route spends launch.account when its module counts the account (16.146518ms)
✔ row 65 a missing harness, model or thinking var refuses no-route naming it, and the system execution keys never fill it (31.019476ms)
✔ row 65 a harness that is not switched on refuses harness-off, primary or fallback, and an off primary never falls back (37.668887ms)
✔ row 65 the loader refusing a module refuses harness-refused and names it; a module that throws refuses harness-failed (24.311746ms)
✔ row 65 a thinking level the route harness does not apply refuses thinking-unsupported, on the primary or a fallback taken (35.692964ms)
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1479.725239ms)
usage: {"event":"usage-unknown","business":"acme","run":"raa7bca529780","instance":"chief","turn":"e94beaf1-caf6-4952-bdf0-b400ab06dbd8","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r7d8a6be669cb","instance":"coder","turn":"d78760f0-f7ce-435c-965d-5de1fb5f0667","source":"@none","code":"baseline-unknown"}
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (1094.599525ms)
usage: {"event":"usage-unknown","business":"acme","run":"r06258e073571","instance":"chief","turn":"c55644f3-142d-4c29-8960-87daf03e8b31","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r87e1870d0c9f","instance":"pm","turn":"521afb74-1ee6-4abe-a75d-c00218bc1a58","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r06258e073571","instance":"chief","turn":"9e96fd97-ff51-49fb-979d-b4d33e5d927d","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r87e1870d0c9f","instance":"pm","turn":"bfeb39de-4c3c-4f63-b945-40617562cc49","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r06258e073571","instance":"chief","turn":"a07817ec-420e-4061-8470-03f653865027","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r87e1870d0c9f","instance":"pm","turn":"1f4dc3e5-d970-4e33-a811-3500ca799c8c","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r87e1870d0c9f","instance":"pm","turn":"87d6f1c3-3125-4c25-8b21-1c6d5a0a22d1","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r06258e073571","instance":"chief","turn":"0f92414f-fdc1-4f70-8e96-973fcf3b93df","source":"@none","code":"baseline-unknown"}
✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1761.413284ms)
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3389.723678ms)
✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (899.191138ms)
✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (590.140202ms)
usage: {"event":"usage-unknown","business":"acme","run":"rb4fb55159003","instance":"coder","turn":"45438a59-2120-4ce4-93cb-bbc2783489b1","source":"@none","code":"baseline-unknown"}
✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (1010.356247ms)
✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (697.570173ms)
✔ after a restart, the new host's first tick starts a holder whose decision is still held (797.119314ms)
✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (618.302051ms)
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (258.630648ms)
✔ a runner that stops at once ends its launch with the runner's reason (334.486201ms)
✔ a Claude Code launch with no session credential refuses before it starts (206.407516ms)
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (319.557378ms)
usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/dewey-scratch/b177/packages/plugins/harness/down is missing","kept":[]}
plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/dewey-scratch/b177/packages/plugins/harness/down is missing","kept":[]}
✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (391.506377ms)
✔ a runner killed from the host ends its launch as killed, not failed (383.906785ms)
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (232.475611ms)
✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (252.800272ms)
✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (222.843954ms)
usage: {"event":"usage-unknown","business":"acme","run":"rca5de11f0503","instance":"chief","turn":"528c8b73-2ae0-4437-949d-87c13652b55b","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"rb4f96681b27c","instance":"coder","turn":"0c9857c9-ecd2-4afe-9625-5462f2ea288b","source":"@none","code":"baseline-unknown"}
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1371.388333ms)
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (977.613454ms)
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3914.147191ms)
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (199.371259ms)
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (209.108584ms)
✔ a launch client that never closes its side doesn't hold the host's close (199.189456ms)
✔ a runner that ignores SIGTERM is killed when the host closes (1385.70783ms)
✔ REQ-LIMIT-3 REQ-LIMIT-4 formatTokens shows each limit counted, not enforced, or check failed, in reset path words (1.279412ms)
✔ REQ-LIMIT-2 row 126: any daily quota row adds one line after the list saying the count is this stack's own use (0.381048ms)
✔ REQ-LIMIT-3 the view prints the limits then the token lines; --json keeps tokens in the result (4.123476ms)
✔ REQ-LIMIT-3 reset reads the revision, then sends limits.set with one path per limit, a word per level (1.114695ms)
✔ REQ-LIMIT-3 reset with no path, or with --file, is refused before the bus (2.115054ms)
✔ migration needs no bus/config, prints whole converted document, is idempotent and never writes (17.920893ms)
✔ limits view/set use the human bus transport and pass only the explicit patch (1.39668ms)
✔ limits set passes an assistants patch through unchanged, and the usage names the key (1.018118ms)
✔ post-119 example and Jason fixture migrate with checked inherited models; wrong or absent config refuses (273.854926ms)
✔ plugins view/set use the human bus transport and pass only the explicit patch (vikunja:19/305) (2.241207ms)
✔ inbox --read marks one message by the id inbox prints, delivered or not, and leaves the rest unread (207.751383ms)
✔ inbox --read refuses an id that is not the human's, prints its code, still marks the rest and exits 2 (371.262946ms)
✔ inbox --read refuses an ambiguous or short prefix, names every match, reads nothing for them and marks the rest (0.919702ms)
✔ inbox --read-all marks every message the inbox walk lists, delivered or not, and inbox then shows 0 unread (7616.836866ms)
✔ inbox --read stops on an error that is not about one message (0.609096ms)
✔ inbox --read and --read-all refuse bad combinations; other verbs refuse them (107.245777ms)
✔ the human names an instance, lists it, and talk's message.send reaches it by that name (142.115102ms)
✔ name and names refuse the wrong number of arguments with the usage (105.724385ms)
✔ zoned uses the IANA zone across DST (24.586308ms)
✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (130.104271ms)
✔ two blocking decisions get two DMs with different nonces (126.447661ms)
✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.308364ms)
✔ a failed DM is journaled, backs off, and is retried until it lands (317.058879ms)
✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (154.686755ms)
✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (122.139293ms)
✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (120.34392ms)
✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (343.524032ms)
✔ a restart after the second refusal does not send before that refusal's 30 min are up (199.985294ms)
✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (125.379999ms)
✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (127.182864ms)
✔ an inbox read failure is logged and the next poll retries (6.2672ms)
✔ no Discord id reaches the journal or the log (200.442766ms)
✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (28.249728ms)
✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (49.423559ms)
✔ the journal: a whole file that is one torn line truncates to empty (27.138741ms)
✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (2.058896ms)
✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.887613ms)
✔ the journal: a line with a wrong type refuses with exit 3 and names the field (5.288759ms)
✔ the journal: a symlinked directory refuses and says it is a link (0.444805ms)
✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.606381ms)
✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.431567ms)
✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.634184ms)
✔ digest content stays within Discord's 2000 characters (0.315602ms)
✔ runLoop never overlaps ticks and stops after the one in flight (110.982361ms)
✔ a human command refused with human-required prints the other-tree line and exits 3 (2.551079ms)
✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (0.904432ms)
✔ other exit-3 refusals print no other-tree line (1.64646ms)
✔ the line names no path (0.160881ms)
✔ threads project resolution explains a business repository and falls back if its file cannot load (435.652194ms)
✔ project create prints the repository-name refusal and exits two without writing (159.673867ms)
✔ project init/check use declared business repo and never contact the bus (143.693966ms)
✔ project commands validate args and refuse undeclared projects and agent init (38.016821ms)
✔ project create and list validate their arguments before any bus call (36.203825ms)
✔ project dispatcher reaches the human CLI (101.701488ms)
✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (747.260444ms)
✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (776.771456ms)
✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (657.464135ms)
✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (587.080614ms)
✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (4769.008423ms)
✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (597.3448ms)
✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (328.638139ms)
✔ install never shows a template name on systemd 261; template drop-ins still refuse (315.033094ms)
✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (359.562585ms)
✔ inherited mosaic-.service.d override refuses without changing the unit (378.067448ms)
✔ inherited service.d override refuses without changing the unit (340.542508ms)
✔ inherited drop-in unreadable directory or file refuses before writing (368.559017ms)
✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1668.850483ms)
✔ T2 activate installs exactly the pointer's pm, claude and Console flags (1893.572406ms)
▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
  ✔ pm (1578.790733ms)
  ✔ claude (883.555686ms)
  ✔ console (905.741654ms)
✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (3368.865142ms)
▶ T4 each item 3 refusal changes nothing and logs one line with its code
  ✔ copy-missing (722.531889ms)
  ✔ copy-unreachable (871.771732ms)
  ✔ copy-schema-unknown (846.404052ms)
  ✔ already-active (702.555997ms)
  ✔ instance-busy (another business active) (737.843141ms)
  ✔ instance-busy (this business activating) (691.922013ms)
  ✔ drop-in-override (807.890605ms)
  ✔ no-pointer (480.067913ms)
✔ T4 each item 3 refusal changes nothing and logs one line with its code (5862.47728ms)
✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (1697.37908ms)
✔ T6 a migration without --migrate rolls back with migration-needs-flag (1766.945127ms)
✔ T7 --migrate takes the backup before the migration runs (1828.74674ms)
✔ T8 a failed migration restores the backup and keeps the store it replaced (1731.417497ms)
✔ T9 a store outside the target's chain rolls back with store-newer (1557.402124ms)
▶ T10 each gate check failing alone rolls back and puts every file back
  ✔ units-inactive (4812.576194ms)
  ✔ bus-status (5116.477085ms)
  ✔ healthz (4309.222641ms)
  ✔ copy-check (4469.944016ms)
  ✔ pm-launch-unconfirmed (4563.211465ms)
✔ T10 each gate check failing alone rolls back and puts every file back (23272.340526ms)
▶ T10b the PM check needs exactly one launched line for a live run of this start
  ✔ no launched line (4561.619834ms)
  ✔ two lines (4551.478564ms)
  ✔ a changed word (5797.365818ms)
  ✔ run not in launches list (4688.231647ms)
  ✔ run started before the start (4665.778274ms)
  ✔ a human launch with no journal line (5758.756254ms)
  ✔ run for another business (4665.304405ms)
  ✔ run not live (4658.64307ms)
  ✔ one well-formed line and a live run pass (1577.453365ms)
✔ T10b the PM check needs exactly one launched line for a live run of this start (40925.998145ms)
✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (6540.50293ms)
✔ T12 rollback takes the previous copy from the log (2484.028945ms)
✔ T13 a rollback across a migration needs --restore, then restores and goes live (3030.446056ms)
✔ T14 events written after the backup need --events N with the right N (3566.673068ms)
✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5186.534146ms)
✔ T14c a rollback without --restore whose gate fails runs item 6 (5232.999393ms)
✔ T15 --plan names the migration and the restore and changes nothing (1955.668517ms)
✔ T26 --plan lists the commits an activate adds, after the migration lines (989.438673ms)
✔ T27 --plan names each migration step, or says the steps cannot be read (826.992489ms)
✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (423.096136ms)
▶ T23 --plan reads the store without changing a file, stopped or held
  ✔ stopped store (500.469084ms)
  ✔ held store (501.139329ms)
✔ T23 --plan reads the store without changing a file, stopped or held (1002.117195ms)
✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1070.077833ms)
✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (722.384481ms)
✔ T19 a started line with no final line: status shows it and every changing verb refuses (969.107184ms)
✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (969.959328ms)
✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1175.380037ms)
▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
  ✔ bus.sqlite-wal (1436.327041ms)
  ✔ bus.sqlite-shm (1447.730291ms)
  ✔ clean (1479.985722ms)
✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (4364.631354ms)
▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
  ✔ unit path (648.037477ms)
  ✔ drop-in directory (654.488385ms)
  ✔ drop-in file (641.282917ms)
  ✔ relative unit path (673.323526ms)
✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (2617.844965ms)
▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
  ✔ --plan (659.368605ms)
  ✔ rollback --restore (1887.920316ms)
✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (2547.762919ms)
✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (4279.961921ms)
▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
  ✔ Environment double quotes (1474.64194ms)
  ✔ Environment single quotes (1384.148328ms)
  ✔ Environment backslash (1399.502041ms)
  ✔ ExecStart quotes (1422.335844ms)
  ✔ Console ExecStart quotes (1395.084697ms)
✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (7076.674693ms)
▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
  ✔ usage: not with --pm, and only for activate (556.240449ms)
  ✔ pm-after-harness-target (824.20076ms)
  ✔ pm-after-harness-set (1116.748312ms)
  ✔ a pointer without pm (713.537453ms)
  ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (1541.835105ms)
✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (4753.498043ms)
▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
  ✔ read_pointer (1139.683821ms)
  ✔ pm-pending, already-adopted and the status line (2189.344143ms)
✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (3329.497482ms)
▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
  ✔ not-pending (592.673375ms)
  ✔ harness-unset (1819.161434ms)
  ✔ a launched line passes: the bus alone restarts with --pm (2683.745727ms)
  ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (5266.249205ms)
  ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (9897.310944ms)
✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (20260.066994ms)
▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
  ✔ rollback from pending gates pm_launched on the old copy (2752.590301ms)
  ✔ after the harness set, rollback refuses until harness is gone (3850.928146ms)
  ✔ activate names every kind the target lacks (989.139116ms)
✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (7593.433013ms)
✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (2527.015666ms)
✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (5060.304344ms)
✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (2901.368563ms)
✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (581.849235ms)
✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (627.341394ms)
✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (6738.294093ms)
✔ T42 tester-port pm-on preserves pointer Console flags (2413.208528ms)
✔ row 175: each read with --tester inside an agent prints the human form's output, and refuses without --tester (309.180519ms)
✔ row 175: --tester on limits set, reset and migrate and every write form outside W1-W7 exits 4 before any call (151.457581ms)
✔ row 175: scripts/mosaic sends plugins, name, names, follow, threads and thread to packages/cli, not the seat CLI (734.48418ms)
✔ row 175 W7: project init --tester makes the repository under the project area, committed by tester (559.504669ms)
✔ row 175 W7: a repo outside the project area refuses tester-project-area before any bus call, and nothing changes (364.177059ms)
✔ row 175 W7: the tester bind refuses tester-off and tester-required before any directory (1179.318572ms)
✔ talk --tester sends a message as tester from inside an agent and prints the role's reply (231.031797ms)
✔ talk --tester sends text with no prefix, and follow --tester reads (123.326143ms)
✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (135.665495ms)
✔ decide, stop and launches take no --tester (103.480587ms)
✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.567075ms)
✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (1.04223ms)
✔ talk --tester to a stopped role exits 3, prints no sent line and stores nothing (118.400388ms)
✔ only a --tester send refused tester-target-not-running is rewritten (112.946852ms)
✔ REQ-CLI-1 project create and list work on the bus record and refuse what the broker refuses (165.53988ms)
✔ REQ-CLI-1 thread create, list, open and read (244.986601ms)
✔ REQ-CLI-1 thread read pages through every message, oldest first (2782.603969ms)
✔ REQ-CLI-1 the business needs exactly one threaded instance to create a thread (1134.638868ms)
✔ REQ-CLI-1 a thread is its id, an id prefix of 8 characters or more, or <project>/<name>; anything else is refused before any write (853.942664ms)
✔ REQ-CLI-2 REQ-THREAD-2 talk --thread sends to the thread and prints only the reply to it; the rest stays unread (299.333508ms)
✔ REQ-CLI-2 talk --thread --wait gives up with exit 1 and leaves the thread's messages unread (1335.138968ms)
✔ REQ-CLI-2 talk --thread --follow and follow --thread print and read only that thread's messages (729.238836ms)
✔ REQ-CLI-2 plain talk to the assistant asks for a thread and exits 2 without a write (333.281402ms)
✔ REQ-USER-2 a thread of another user is refused for talk, open, read and follow, and nothing is written (420.735543ms)
✔ REQ-CLI-1 the new verbs refuse inside an agent run, as every human verb does (212.944508ms)
usage: {"event":"usage-unknown","business":"acme","run":"rc92291297f43","instance":"assistant","turn":"0646e4f3-15d7-42a1-929c-36a5e1ff4a11","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"rd96700c8f6d2","instance":"assistant","turn":"dadb2ac3-b558-4efd-8bfb-b047108a9d5c","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r950170a7f77e","instance":"assistant","turn":"7db185ba-da21-4e2a-8d0a-0cae05c6a68b","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"rf62a5ab0f3c7","instance":"assistant","turn":"25e6e137-88a8-4dad-81ad-9abef4d889d5","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 REQ-MSG-1 a thread message starts the thread's session, which stops when idle; its history survives the stop and a restart and no other thread sees it (7023.594763ms)
usage: {"event":"usage-unknown","business":"acme","run":"racf73cd894dc","instance":"assistant","turn":"80cdc258-25cf-462c-8a24-9e4764d8affd","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r5e8d9e3f6def","instance":"assistant","turn":"514b4616-c6e1-44ed-84e4-658509bcfc86","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a running thread counts against its model's limit and an idle-stopped one doesn't (1891.499719ms)
usage: {"event":"usage-unknown","business":"acme","run":"r8f141ad7c5cd","instance":"assistant","turn":"1e3be03f-29a9-4b07-95d1-706c23905611","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a turn longer than the idle time isn't stopped, and the thread idles out after it (4535.60303ms)
usage: {"event":"usage-unknown","business":"acme","run":"r375f7f1b8535","instance":"assistant","turn":"713e4642-0c17-4436-894a-b898f7901244","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r375f7f1b8535","instance":"assistant","turn":"f016e90a-7398-41e2-8443-27bdc6d87934","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a message sent after the idle snapshot keeps the session, which answers it (2819.087261ms)
✔ REQ-ROLE-2 REQ-LAUNCH-1 a thread held by a run the launcher didn't start gets no second session (118.321908ms)
usage: {"event":"usage-unknown","business":"acme","run":"r0f667939690a","instance":"assistant","turn":"d2b79ce9-8922-4afc-a580-5362e7c69345","source":"@none","code":"baseline-unknown"}
✔ REQ-LAUNCH-1 a thread run's session file has no landing, even when landHolders names its instance (399.416283ms)
✔ REQ-LAUNCH-1 a run that ends without taking its thread's message isn't started again for that message (232.457552ms)
✔ REQ-THREAD-2 REQ-LAUNCH-1 a thread id that isn't a safe segment, or a thread of a non-thread instance, launches nothing (272.817345ms)
✔ REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a thread (99.721428ms)
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0}
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0}
✔ REQ-LIMIT-3 REQ-LIMIT-4 a thread start whose instance is at its token limit is refused, logged once with the limit and the count (221.413588ms)
usage: {"event":"usage-unknown","business":"acme","run":"r1242a2b435ed","instance":"assistant","turn":"0cb85415-d0bb-4df1-aadf-576ef182584f","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mustStop","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":1}
✔ REQ-LIMIT-4 a thread run at its token limit stops at the end of its turn: the reply lands, and the end record names the limit (347.421479ms)
task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (547.994108ms)
✔ the transport writes {business, verb, args} to the child and reads its JSON (53.368471ms)
✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2150.950624ms)
✔ busExit and refuseInsideAgent (0.696299ms)
✔ REQ-LIMIT-4 mosaic usage shows each token kind and unknown turns beside every total (73.793158ms)
✔ usage is dispatched by scripts/mosaic and the shared read adapter (112.433477ms)
✔ talk sends a REQUEST, prints and reads only the reply to it, and leaves other messages unread (327.425828ms)
✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1147.426704ms)
✔ a late reply the Console has listed stays unread for mosaic inbox, and the next talk skips it (2323.787288ms)
✔ talk says when the role isn't running, whether launch.by was told, and how to start launch.by (294.940494ms)
✔ talk to a role launch.by can't launch says it isn't in the launch block (154.599892ms)
✔ talk to a stopped role prints the waiting line once, skips a non-reply and prints the reply (254.126678ms)
✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (103.521876ms)
✔ launches off and on go to the broker and change the business's launch state (117.172378ms)
✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (104.823235ms)
ℹ tests 396
ℹ suites 0
ℹ pass 396
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 200944.314293