# Row 294 (FED R6, #1800) candidate manifest, round 4

Round 4 (Mos mos-1419 through Sage sage-3238, after run 3's third red): two test files, no product
file. The manifest adds packages/cli/tests/stack-release.test.mjs (19 paths).

- packages/cli/tests/stack-release.test.mjs (old test): the rehearsal fixture's copy list at :1991
  gains 'packages/cli/src/access.mjs' and 'packages/cli/src/transport.mjs', with a row 294 comment
  at :1987. 294's config.mjs imports access.mjs, which imports transport.mjs. No assertion changes.
- packages/cli/tests/access-boot.test.mjs (new test): a TRACKER constant holds the tracker warning
  the shared helpers.mjs business makes. B1 and B2 pin `[TRACKER]`; B3 pins `[TRACKER, <the access
  refusal line>]` and checks the joined warnings for secret-marker. boot() is unchanged.

Round 3 (cb1648f3…78de) was approved by Duckworth (rev 3462, c31045). Its text follows unchanged.

Round 3 (sage-3212, Mos ruling pending in sage-3211): one line in granted-user.test.mjs G5. The
baseline is `SELECT coalesce(max(seq), 0) n FROM events`, because max(seq) is NULL on the fixture's
empty events table and run 2 read 0 events added. Only that file's hash moves; still 18 paths. Round 2
(7ec7b1ea…315b) was approved by Duckworth (rev 3455). Its text follows unchanged.


Branch launchpad/row294, base c902a767d (the round 1 head ee77b3635 rebased with range-diff all "="
and stable patch-ids unchanged; receipts in run1/). The round 3 head is the commit that adds this
file. MANIFEST.sha256 lists the 18 code and test paths changed from the base, hashed from that
commit's blobs (`sha256sum -c` passes on it). BUILD.md, ASSERTION-PRESERVATION.json and run1/ are
the row note and are not in the manifest. webui/src/bus.mjs is byte-identical to the base
(channel-proof hash pin, C7). packages/cli/tests/access.test.mjs is unchanged;
packages/cli/src/access.mjs overlaps row 295, which rebases after this row (sage-3153).

Round 1 was 0b3f9c9d…94f3, approved by Duckworth (rev 3435, duckworth-0249b). Round 2 changes two
tests after run 1 went red, and no product file:

- packages/webui/tests/browser.test.mjs (new to the manifest; an old test, Mos's ruling (a) in
  mos-1412): the script-list pin at :22 gains '/federation.js' at index 2 and the :21 comment adds
  row 294. No other line changes. ASSERTION-PRESERVATION.json has the old and new lines.
- packages/webui/tests/granted-user.test.mjs, G5 (new test, a run 1 placement Sage accepted in
  sage-3194): exactly one `action.refused` per refused verb, the count from the verb list's length,
  each body exactly `{ code: 'access-refused' }`, and every other table's row count unchanged.

Run 1 (webui only, stopped at the first red) is recorded in BUILD.md. The whole gate runs fresh on
Sage's next CLEAR: npm ci --ignore-scripts at the root and in packages/webui, the webui, cli and
bus suites, every scripts/test-*.sh, then mutants M1-M11, with the limits in BUILD.md.

## Exception for Duckworth to rule on: the owner transport in a user's chat (C6; mos-1394, sage-3157)

> In a granted user's chat the Console uses the owner's transport for one call: `plugins` with
> `{}`, the channel gate read. Nothing else goes over it. Its answer stays in the Console and is
> never sent to the user. No value from the user's session or request reaches the call. Mos ruled
> in mos-1394 that this is not an access-rule change, because the Console reads its own channel
> gate, and that it holds only while nothing from the user reaches the call. Every chat verb goes
> over the user's own transport. Where: createChat's `owner` (chat.mjs) and userOptionsFor
> (console-bus.mjs), wired with `ownerCall` in cli.mjs. Pinned by G9 and mutants M8, M10 and M11.
> If this reads as owner authority used for the user, it goes back to Mos.

## Other choices

C1-C9 and rulings sage-3142, sage-3153 and sage-3157 are in BUILD.md. In short: a separate user
page (C1); an allowlist gate of user routes (C2); every bus-backed option swapped to the user
transport behind the gate (C2b); liveness by the broker's own `covers` test (C3); the bus boot
`access` wiring, where a bad file refuses each user bind and writes one stderr line with the path
and a code, never the contents (C4, item 9); and user-bus.mjs as a copy of the spawn code (C7).