✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (2332.615777ms)
✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (116.351318ms)
✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (273.12376ms)
✔ NO_COLOR: no escape codes, except reverse video on the selected row (364.070741ms)
✔ 1-9 shows the decide flow's own lines and question; only y resolves (89.596842ms)
✔ the app shows the same decide text as mosaic decide (29.042983ms)
✔ any key but y or Y at the question answers No; nothing is sent (255.948285ms)
✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (96.472956ms)
✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (336.228832ms)
✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (38.426831ms)
✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (25.398717ms)
✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (428.039111ms)
✔ quitting at the question answers No and sends nothing, armed or not (42.796073ms)
✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (37.418354ms)
✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (61.56692ms)
✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (385.202143ms)
✔ at every size the decide box shows each line y depends on, or says it is hidden (9426.102795ms)
✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (72.980966ms)
✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (35.582014ms)
✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (19.870299ms)
✔ keys: views, moving, trail of a selection, the command line, help and quit (81.303552ms)
✔ one option: the status line says Press 1, not 1-1 (21.924472ms)
✔ no business: the app says so and :business picks one (10.820238ms)
✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.896102ms)
✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (181.48198ms)
✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.45566ms)
✔ decide with --note still asks; a No sends nothing (11.643402ms)
✔ the app's business comes from a live bus host only (1.032531ms)
✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (6.95401ms)
✔ draw is pure: same state, same frame (0.763411ms)
✔ recordBootRefused keeps the last good load across refusals; recordBootOk clears the refusal (5.247539ms)
✔ an unknown key and a JSON syntax error each leave the bus down with the reason and path in the status (1216.589948ms)
✔ a missing file is recorded too, and a valid file clears the status on the next start (759.799481ms)
✔ CLI off, absent and other-only channel selections refuse every project/thread flow before any effect (23.287499ms)
✔ CLI enabled project/thread lists dispatch through selection without changing output (3.0513ms)
✔ both channels off recover through the existing human CLI, socket and organization writer (2952.479038ms)
✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (40.167655ms)
✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (32.737634ms)
✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (25.609112ms)
✔ decide prints a declining choice as declining (23.200523ms)
✔ an unknown outcome is reported once and never resent (37.509426ms)
✔ a decision closed before the answer arrives exits 2 and points at its trail (31.835804ms)
✔ a prefix that matches two open decisions exits 2 and resolves neither (27.359489ms)
✔ without --business a command uses the live host's business, and a stale host.json is not a host (22.14616ms)
✔ every human command refuses inside an agent run before it touches the bus (21.266649ms)
✔ usage errors exit 4; no business and no host is a usage error (25.252911ms)
✔ agents and tasks print through the broker (20.708942ms)
✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (2.513208ms)
✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (76.211605ms)
✔ trackers come from the tracker.* variables of the one project that names a tracker project (114.541538ms)
✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (71.498401ms)
✔ two projects that each name a tracker project refuse, since the boot shape holds one (66.901596ms)
✔ a business without tracker.baseUrl gets no trackers entry (77.934984ms)
✔ an unknown business and a broken system config refuse with exit 3 (105.369417ms)
✔ follow prints an unsolicited message after plain talk returned (53.407552ms)
✔ talk --follow continues after reply and prints a later unsolicited message (45.178504ms)
✔ inbox lists all unread human messages under decisions, does not deliver or read them (597.850917ms)
✔ follow refuses agent context and bad arguments (21.562119ms)
✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (26.685939ms)
✔ plain talk leaves the process SIGINT handlers unchanged (26.29087ms)
✔ empty views say so (1.069737ms)
✔ the trail keeps the broker's order and names a decision's task without its rows (1.328072ms)
✔ tasks print the tracker fields the snapshot carries (0.208263ms)
✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (817.082183ms)
✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (704.566948ms)
✔ the size cap refuses a push before any byte (345.383351ms)
✔ a fetch over the cap refuses before any byte reaches the reviewer (493.56487ms)
✔ the socket refuses a request with no capability, an unknown one, and a bad request line (317.983294ms)
✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (471.659111ms)
✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (295.990704ms)
✔ a review of a project the business no longer has refuses unknown-project (298.166481ms)
✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (203.387846ms)
✔ close() answers host-closing to a connection still sending its request line (191.600143ms)
✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (594.544953ms)
✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (571.108752ms)
✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (686.884242ms)
✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (42.636733ms)
✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (506.044929ms)
✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (43.620072ms)
✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (300.795363ms)
✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (414.393849ms)
✔ land: the squash runs the gate in its own worktree, then main moves and the broker records it (384.722603ms)
✔ land: an arbiter-resolved landing's squash says the arbiter resolved it through the broker (363.510494ms)
✔ land: refusals before the gate answer the role at once and leave main and no worktree (382.583469ms)
✔ land: a failed gate is refused gate-failed with its step, told to the role, and main stays (343.323439ms)
✔ land: a record the broker refuses moves main back, and the landing is refused with the broker's code (345.32513ms)
✔ land: a second landing while one runs refuses land-busy, and close() stops the gate and refuses host-closing (330.056881ms)
✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1101.260827ms)
✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (359.134295ms)
✔ a second host for the same data root refuses with exit 3 while the first runs (222.607506ms)
✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (694.820729ms)
✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (2.076669ms)
✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (1.257038ms)
✔ a live host's lock stays, however old the file is (0.818999ms)
✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (1002.376168ms)
✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (259.95259ms)
✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (35.422432ms)
✔ a broker fork that throws leaves no host.lock and no host.json (41.938339ms)
✔ a broker send that throws leaves no host.lock and no host.json (37.568548ms)
✔ a broker that misses its boot wait leaves no host.lock and no host.json (36.133427ms)
✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (135.792091ms)
✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (145.92567ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (125.862597ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (132.213906ms)
✔ a host.json that can't be written stops both children and leaves no host.lock (260.52057ms)
✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (38.190974ms)
✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (149.354663ms)
✔ an error event on the broker while the notifier starts fails the start once the notifier replies (316.588941ms)
✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (272.187155ms)
✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (304.798199ms)
✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1166.199384ms)
✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (270.474916ms)
✔ a broker reply with no request waiting breaks the channel and the host exits 1 (138.712213ms)
✔ a notifier that refuses stops the broker and the host refuses with exit 3 (224.451114ms)
✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (218.596765ms)
✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (152.221702ms)
✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (217.49405ms)
✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (152.003691ms)
✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (230.720118ms)
✔ watchChildren reports a child that died before it was called, and one that dies later (33.459235ms)
✔ bus stop refuses to signal a live pid that is not a bus host (202.872591ms)
✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (340.015833ms)
✔ bus start refuses with exit 3 without a notifier config (126.012497ms)
✔ bus start runs until bus stop; status reports it while it runs (774.118552ms)
✔ bus-service.sh renders the unit and installs it into a given directory (58.881914ms)
✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (74.928893ms)
✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (15.02576ms)
✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (9.561751ms)
✔ row 165 CLI: instance add puts an instance in the file, validate exits 0, and the log names the human (233.270777ms)
✔ row 165 CLI: instance set passes the vars file and --no-launch, and a vars-only change needs no restart (180.499938ms)
✔ row 165 CLI: a refusal names its code and why, exits 2 and keeps the bytes (50.788077ms)
✔ row 165 CLI: usage errors exit 4 before any bus call, and an agent session is refused (24.058183ms)
✔ row 165: scripts/mosaic sends business instances and instance to packages/cli, and validate still to packages/business (214.78154ms)
✔ REQ-LIMIT-2 a claude-code launch asks mayLaunch with launch.account.name (37.818613ms)
✔ REQ-LIMIT-2 each login set the account can name is accepted when the bus host holds exactly it (48.111452ms)
✔ REQ-LIMIT-2 account-credential-missing: the named set is not a login set, or the bus host lacks part of it (44.097126ms)
✔ REQ-LIMIT-2 account-credential-ambiguous: the bus host sets a credential variable outside the named set, ANTHROPIC_BASE_URL included (32.63086ms)
✔ REQ-LIMIT-2 account-is-credential: launch.account.name is the value of a credential variable the bus host sets (23.133078ms)
✔ REQ-LIMIT-2 a pi launch carries account null and skips both account checks (31.498225ms)
✔ REQ-LIMIT-2 with no launch.account a claude-code launch carries null and the environment is not checked for ambiguity (14.061462ms)
✔ REQ-LIMIT-4 the launcher asks mayLaunch with the instance, provider, model and account (row 126), and goes on to authorization on an allow (31.36988ms)
✔ REQ-LIMIT-3 REQ-LIMIT-4 a launch whose subject is at its limit is refused limit-reached and logged with the check, limit and count (16.862189ms)
✔ REQ-LIMIT-4 fail closed: a refused op, a check failure or a malformed answer refuses limit-check-failed, naming the check and the code (109.08347ms)
✔ REQ-LIMIT-4 the launcher reaches token-limit only through the bus: launcher.mjs imports no limit check (0.935678ms)
✔ each launch rereads limits and model selections; lowered limits keep sessions and log exact hit (63.265832ms)
✔ row 65 a passing primary is the route: its provider and model reach mayLaunch, and a stated fallback is never used (31.14658ms)
✔ row 65 a failed primary preflight takes the stated fallback, and the limit checks see the fallback route (20.265697ms)
✔ row 65 a failed primary with no fallback refuses with the preflight code and never asks mayLaunch (14.777226ms)
✔ row 65 a fallback whose own preflight fails refuses with its code and names both reasons (12.94863ms)
✔ row 65 the fallback route spends launch.account when its module counts the account (16.76925ms)
✔ row 65 a missing harness, model or thinking var refuses no-route naming it, and the system execution keys never fill it (30.594766ms)
✔ row 65 a harness that is not switched on refuses harness-off, primary or fallback, and an off primary never falls back (48.718344ms)
✔ row 65 the loader refusing a module refuses harness-refused and names it; a module that throws refuses harness-failed (38.937069ms)
✔ row 65 a thinking level the route harness does not apply refuses thinking-unsupported, on the primary or a fallback taken (50.857459ms)
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1461.692098ms)
usage: {"event":"usage-unknown","business":"acme","run":"r0de0185f7d4e","instance":"chief","turn":"f32cc808-6389-42f6-8c0b-15156e6cf35a","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r921c72643562","instance":"coder","turn":"38e309df-1233-4372-9c31-0e3851666d1c","source":"@none","code":"baseline-unknown"}
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (824.483129ms)
usage: {"event":"usage-unknown","business":"acme","run":"r05ebe186dc20","instance":"chief","turn":"11be8fcf-9a6a-4ee8-b02b-21b75a24d004","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"raf7f9e990531","instance":"pm","turn":"cfaf7e31-9b82-488c-a969-7bd36bd26c2a","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r05ebe186dc20","instance":"chief","turn":"0fc1f7a0-3218-4ac9-a024-844f393dcf88","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"raf7f9e990531","instance":"pm","turn":"8e189762-cf61-405a-928a-7d84d0934655","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"raf7f9e990531","instance":"pm","turn":"eb93fe2c-0a5b-454f-bd67-286e5c80de67","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r05ebe186dc20","instance":"chief","turn":"43dc93dc-3751-46c1-a71e-b3d595444fff","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"raf7f9e990531","instance":"pm","turn":"4dc12504-8527-4b0f-958f-6dd4654b7b3e","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r05ebe186dc20","instance":"chief","turn":"9a40e5b1-0943-43b2-ac86-9627b52ece51","source":"@none","code":"baseline-unknown"}
✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1134.386465ms)
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3802.625464ms)
✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (519.764923ms)
✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (366.075616ms)
usage: {"event":"usage-unknown","business":"acme","run":"r3df5ddd3b158","instance":"coder","turn":"87a58fbe-4786-4992-9e8d-44c8836a0aa4","source":"@none","code":"baseline-unknown"}
✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (552.405362ms)
✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (481.338629ms)
✔ after a restart, the new host's first tick starts a holder whose decision is still held (659.647165ms)
✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (490.274538ms)
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (188.027094ms)
✔ a runner that stops at once ends its launch with the runner's reason (268.851931ms)
✔ a Claude Code launch with no session credential refuses before it starts (164.111295ms)
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (265.478658ms)
usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/src/mosaic-stack-rocko-178/packages/plugins/harness/down is missing","kept":[]}
plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/mnt/storage/src/mosaic-stack-rocko-178/packages/plugins/harness/down is missing","kept":[]}
✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (294.27247ms)
✔ a runner killed from the host ends its launch as killed, not failed (313.707359ms)
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (141.57058ms)
✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (141.864869ms)
✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (149.955373ms)
usage: {"event":"usage-unknown","business":"acme","run":"r88b2713e71e1","instance":"chief","turn":"67f3b4a7-3cee-471f-b311-dac9f949ac79","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r1605ec4cf589","instance":"coder","turn":"61c5f7d1-c973-449b-af8a-e30f146d805a","source":"@none","code":"baseline-unknown"}
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1323.085177ms)
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (797.959031ms)
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3673.786349ms)
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (127.069753ms)
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (133.807797ms)
✔ a launch client that never closes its side doesn't hold the host's close (130.561068ms)
✔ a runner that ignores SIGTERM is killed when the host closes (1258.026576ms)
✔ REQ-LIMIT-3 REQ-LIMIT-4 formatTokens shows each limit counted, not enforced, or check failed, in reset path words (1.696802ms)
✔ REQ-LIMIT-2 row 126: any daily quota row adds one line after the list saying the count is this stack's own use (0.608638ms)
✔ REQ-LIMIT-3 the view prints the limits then the token lines; --json keeps tokens in the result (4.975797ms)
✔ REQ-LIMIT-3 reset reads the revision, then sends limits.set with one path per limit, a word per level (1.536349ms)
✔ REQ-LIMIT-3 reset with no path, or with --file, is refused before the bus (2.489071ms)
✔ migration needs no bus/config, prints whole converted document, is idempotent and never writes (29.135859ms)
✔ limits view/set use the human bus transport and pass only the explicit patch (2.288148ms)
✔ limits set passes an assistants patch through unchanged, and the usage names the key (1.793316ms)
✔ post-119 example and Jason fixture migrate with checked inherited models; wrong or absent config refuses (332.180611ms)
✔ plugins view/set use the human bus transport and pass only the explicit patch (vikunja:19/305) (3.520702ms)
✔ inbox --read marks one message by the id inbox prints, delivered or not, and leaves the rest unread (61.283367ms)
✔ inbox --read refuses an id that is not the human's, prints its code, still marks the rest and exits 2 (33.274901ms)
✔ inbox --read refuses an ambiguous or short prefix, names every match, reads nothing for them and marks the rest (1.570526ms)
✔ inbox --read-all marks every message the inbox walk lists, delivered or not, and inbox then shows 0 unread (1302.261677ms)
✔ inbox --read stops on an error that is not about one message (0.831364ms)
✔ inbox --read and --read-all refuse bad combinations; other verbs refuse them (18.255247ms)
✔ the human names an instance, lists it, and talk's message.send reaches it by that name (35.798465ms)
✔ name and names refuse the wrong number of arguments with the usage (22.284666ms)
✔ zoned uses the IANA zone across DST (25.016647ms)
✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (35.435518ms)
✔ two blocking decisions get two DMs with different nonces (22.734513ms)
✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.429105ms)
✔ a failed DM is journaled, backs off, and is retried until it lands (27.714943ms)
✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (30.586201ms)
✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (34.443951ms)
✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (20.392829ms)
✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (215.889847ms)
✔ a restart after the second refusal does not send before that refusal's 30 min are up (102.029069ms)
✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (25.593798ms)
✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (19.964079ms)
✔ an inbox read failure is logged and the next poll retries (6.545148ms)
✔ no Discord id reaches the journal or the log (18.994391ms)
✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (2.946641ms)
✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (3.512135ms)
✔ the journal: a whole file that is one torn line truncates to empty (1.648753ms)
✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (0.750334ms)
✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.848009ms)
✔ the journal: a line with a wrong type refuses with exit 3 and names the field (2.566419ms)
✔ the journal: a symlinked directory refuses and says it is a link (0.527657ms)
✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.639585ms)
✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.565885ms)
✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.616881ms)
✔ digest content stays within Discord's 2000 characters (0.305677ms)
✔ runLoop never overlaps ticks and stops after the one in flight (111.36288ms)
✔ a human command refused with human-required prints the other-tree line and exits 3 (3.37971ms)
✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (1.458639ms)
✔ other exit-3 refusals print no other-tree line (2.101456ms)
✔ the line names no path (0.855808ms)
✔ threads project resolution explains a business repository and falls back if its file cannot load (67.826629ms)
✔ project create prints the repository-name refusal and exits two without writing (27.464067ms)
✔ project init/check use declared business repo and never contact the bus (200.875299ms)
✔ project commands validate args and refuse undeclared projects and agent init (60.445801ms)
✔ project create and list validate their arguments before any bus call (53.957385ms)
✔ project dispatcher reaches the human CLI (140.351439ms)
✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (911.187562ms)
✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (768.264469ms)
✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (703.903714ms)
✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (515.376891ms)
✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (3848.94321ms)
✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (666.395659ms)
✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (313.034297ms)
✔ install never shows a template name on systemd 261; template drop-ins still refuse (275.43034ms)
✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (261.756234ms)
✔ inherited mosaic-.service.d override refuses without changing the unit (303.339073ms)
✔ inherited service.d override refuses without changing the unit (285.998163ms)
✔ inherited drop-in unreadable directory or file refuses before writing (244.903507ms)
✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1441.134025ms)
✔ T2 activate installs exactly the pointer's pm, claude and Console flags (1753.85473ms)
▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
  ✔ pm (869.590779ms)
  ✔ claude (767.043033ms)
  ✔ console (750.660036ms)
✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (2388.159867ms)
▶ T4 each item 3 refusal changes nothing and logs one line with its code
  ✔ copy-missing (691.638452ms)
  ✔ copy-unreachable (716.330699ms)
  ✔ copy-schema-unknown (659.603557ms)
  ✔ already-active (636.771889ms)
  ✔ instance-busy (another business active) (658.554946ms)
  ✔ instance-busy (this business activating) (714.466489ms)
  ✔ drop-in-override (678.791186ms)
  ✔ no-pointer (341.508285ms)
✔ T4 each item 3 refusal changes nothing and logs one line with its code (5099.369753ms)
✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (1676.139454ms)
✔ T6 a migration without --migrate rolls back with migration-needs-flag (1486.251953ms)
✔ T7 --migrate takes the backup before the migration runs (1511.193095ms)
✔ T8 a failed migration restores the backup and keeps the store it replaced (1541.731926ms)
✔ T9 a store outside the target's chain rolls back with store-newer (1419.85681ms)
▶ T10 each gate check failing alone rolls back and puts every file back
  ✔ units-inactive (4721.875102ms)
  ✔ bus-status (5075.136418ms)
  ✔ healthz (5373.887048ms)
  ✔ copy-check (4575.306504ms)
  ✔ pm-launch-unconfirmed (4527.376957ms)
✔ T10 each gate check failing alone rolls back and puts every file back (24274.493777ms)
▶ T10b the PM check needs exactly one launched line for a live run of this start
  ✔ no launched line (4524.042241ms)
  ✔ two lines (4457.316658ms)
  ✔ a changed word (4499.440062ms)
  ✔ run not in launches list (4649.072896ms)
  ✔ run started before the start (5930.840583ms)
  ✔ a human launch with no journal line (4455.936914ms)
  ✔ run for another business (4651.165974ms)
  ✔ run not live (4676.21762ms)
  ✔ one well-formed line and a live run pass (1476.01253ms)
✔ T10b the PM check needs exactly one launched line for a live run of this start (39321.430334ms)
✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (8846.212349ms)
✔ T12 rollback takes the previous copy from the log (2457.434144ms)
✔ T13 a rollback across a migration needs --restore, then restores and goes live (3102.106258ms)
✔ T14 events written after the backup need --events N with the right N (3732.512519ms)
✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (6828.286643ms)
✔ T14c a rollback without --restore whose gate fails runs item 6 (6323.353235ms)
✔ T15 --plan names the migration and the restore and changes nothing (1906.121349ms)
✔ T26 --plan lists the commits an activate adds, after the migration lines (960.562491ms)
✔ T27 --plan names each migration step, or says the steps cannot be read (770.562992ms)
✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (346.297125ms)
▶ T23 --plan reads the store without changing a file, stopped or held
  ✔ stopped store (446.616381ms)
  ✔ held store (423.999814ms)
✔ T23 --plan reads the store without changing a file, stopped or held (871.131948ms)
✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1028.050778ms)
✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (658.612713ms)
✔ T19 a started line with no final line: status shows it and every changing verb refuses (873.400294ms)
✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (907.625017ms)
✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1074.078016ms)
▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
  ✔ bus.sqlite-wal (1390.939514ms)
  ✔ bus.sqlite-shm (1381.36989ms)
  ✔ clean (1421.145369ms)
✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (4194.086839ms)
▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
  ✔ unit path (605.518067ms)
  ✔ drop-in directory (591.302723ms)
  ✔ drop-in file (600.412646ms)
  ✔ relative unit path (595.152719ms)
✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (2393.431913ms)
▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
  ✔ --plan (620.786387ms)
  ✔ rollback --restore (1814.703687ms)
✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (2435.961219ms)
✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (4140.665653ms)
▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
  ✔ Environment double quotes (1296.352671ms)
  ✔ Environment single quotes (1264.563767ms)
  ✔ Environment backslash (1282.823067ms)
  ✔ ExecStart quotes (1264.912338ms)
  ✔ Console ExecStart quotes (1283.534229ms)
✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (6393.102682ms)
▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
  ✔ usage: not with --pm, and only for activate (472.601224ms)
  ✔ pm-after-harness-target (702.210324ms)
  ✔ pm-after-harness-set (1035.28074ms)
  ✔ a pointer without pm (647.899618ms)
  ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (1456.344307ms)
✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (4315.171263ms)
▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
  ✔ read_pointer (1071.870782ms)
  ✔ pm-pending, already-adopted and the status line (2073.970546ms)
✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (3146.270896ms)
▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
  ✔ not-pending (546.156343ms)
  ✔ harness-unset (1761.174903ms)
  ✔ a launched line passes: the bus alone restarts with --pm (2576.74449ms)
  ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (5203.596389ms)
  ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (7341.952219ms)
✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (17430.559526ms)
▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
  ✔ rollback from pending gates pm_launched on the old copy (2745.60029ms)
  ✔ after the harness set, rollback refuses until harness is gone (3906.867061ms)
  ✔ activate names every kind the target lacks (928.41324ms)
✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (7581.491848ms)
✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (2452.423613ms)
✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (4817.161908ms)
✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (2617.012838ms)
✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (543.533704ms)
✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (571.124622ms)
✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (7942.832962ms)
✔ T42 tester-port pm-on preserves pointer Console flags (2324.016413ms)
▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
  ✔ activate then pm-on on the same copy (2372.540768ms)
  ✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (4830.861877ms)
  ✔ adopt takes the next free id too (444.20602ms)
  ✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (690.657601ms)
  ✔ --restore takes an id with or without -1 to -9 and nothing else (696.312036ms)
✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (9035.494488ms)
▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
  ✔ a bad tester port (1472.224115ms)
  ✔ without --plan a bad port is usage before any pointer read (265.648084ms)
  ✔ a target Console without --tester-port (720.78982ms)
✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (2459.290328ms)
✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (2414.045933ms)
✔ T178 proxy proof pair survives a tester-port replacement as well (1408.353033ms)
✔ row 175: each read with --tester inside an agent prints the human form's output, and refuses without --tester (109.285458ms)
✔ row 175: --tester on limits set, reset and migrate and every write form outside W1-W7 exits 4 before any call (23.633369ms)
✔ row 175: scripts/mosaic sends plugins, name, names, follow, threads and thread to packages/cli, not the seat CLI (865.355405ms)
✔ row 175 W7: project init --tester makes the repository under the project area, committed by tester (416.280681ms)
✔ row 175 W7: a repo outside the project area refuses tester-project-area before any bus call, and nothing changes (188.271559ms)
✔ row 175 W7: the tester bind refuses tester-off and tester-required before any directory (1153.650006ms)
✔ talk --tester sends a message as tester from inside an agent and prints the role's reply (38.108719ms)
✔ talk --tester sends text with no prefix, and follow --tester reads (22.811431ms)
✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (28.60422ms)
✔ decide, stop and launches take no --tester (20.253966ms)
✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.510305ms)
✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (0.711827ms)
✔ talk --tester to a stopped role exits 3, prints no sent line and stores nothing (18.694813ms)
✔ only a --tester send refused tester-target-not-running is rewritten (17.586373ms)
✔ REQ-CLI-1 project create and list work on the bus record and refuse what the broker refuses (42.7912ms)
✔ REQ-CLI-1 thread create, list, open and read (69.173788ms)
✔ REQ-CLI-1 thread read pages through every message, oldest first (484.938314ms)
✔ REQ-CLI-1 the business needs exactly one threaded instance to create a thread (55.893263ms)
✔ REQ-CLI-1 a thread is its id, an id prefix of 8 characters or more, or <project>/<name>; anything else is refused before any write (68.547255ms)
✔ REQ-CLI-2 REQ-THREAD-2 talk --thread sends to the thread and prints only the reply to it; the rest stays unread (43.3963ms)
✔ REQ-CLI-2 talk --thread --wait gives up with exit 1 and leaves the thread's messages unread (1043.023498ms)
✔ REQ-CLI-2 talk --thread --follow and follow --thread print and read only that thread's messages (91.394231ms)
✔ REQ-CLI-2 plain talk to the assistant asks for a thread and exits 2 without a write (24.223105ms)
✔ REQ-USER-2 a thread of another user is refused for talk, open, read and follow, and nothing is written (54.188506ms)
✔ REQ-CLI-1 the new verbs refuse inside an agent run, as every human verb does (18.538688ms)
usage: {"event":"usage-unknown","business":"acme","run":"rdd1808596a54","instance":"assistant","turn":"8413bf83-9b8e-4afc-ba04-545450f5ed4e","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r41edb2650e51","instance":"assistant","turn":"2a488e59-c2db-4e7b-8692-f2f791f7abc3","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r7ccaf699e214","instance":"assistant","turn":"5b0eb2e3-0b81-489e-884b-a7c74bece2df","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r077c7a42bc9d","instance":"assistant","turn":"6c55c099-1c69-451d-b14e-9a0d887dc2a1","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 REQ-MSG-1 a thread message starts the thread's session, which stops when idle; its history survives the stop and a restart and no other thread sees it (5653.374788ms)
usage: {"event":"usage-unknown","business":"acme","run":"r6378fa284f68","instance":"assistant","turn":"c34f9591-061b-4b87-a675-9353a809573e","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r1428d15e96c6","instance":"assistant","turn":"69f58609-baf4-439a-b715-1de1d9cc4008","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a running thread counts against its model's limit and an idle-stopped one doesn't (1668.530894ms)
usage: {"event":"usage-unknown","business":"acme","run":"r9755f92fc9ef","instance":"assistant","turn":"4c52b069-24f9-4e38-b62a-3352fc82e73e","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a turn longer than the idle time isn't stopped, and the thread idles out after it (4390.384659ms)
usage: {"event":"usage-unknown","business":"acme","run":"r066d171919f9","instance":"assistant","turn":"e5a3f956-221d-4651-af59-fda399c80c46","source":"@none","code":"baseline-unknown"}
usage: {"event":"usage-unknown","business":"acme","run":"r066d171919f9","instance":"assistant","turn":"238efd03-4dab-4cb9-9a0f-224900c04b34","source":"@none","code":"baseline-unknown"}
✔ REQ-THREAD-2 REQ-LAUNCH-1 a message sent after the idle snapshot keeps the session, which answers it (2830.584827ms)
✔ REQ-ROLE-2 REQ-LAUNCH-1 a thread held by a run the launcher didn't start gets no second session (53.471296ms)
usage: {"event":"usage-unknown","business":"acme","run":"r986c2d3ace11","instance":"assistant","turn":"2b72ca48-57f7-41f6-b96a-30f2c87b2336","source":"@none","code":"baseline-unknown"}
✔ REQ-LAUNCH-1 a thread run's session file has no landing, even when landHolders names its instance (287.333407ms)
✔ REQ-LAUNCH-1 a run that ends without taking its thread's message isn't started again for that message (154.426858ms)
✔ REQ-THREAD-2 REQ-LAUNCH-1 a thread id that isn't a safe segment, or a thread of a non-thread instance, launches nothing (188.65564ms)
✔ REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a thread (57.706526ms)
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0}
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0}
✔ REQ-LIMIT-3 REQ-LIMIT-4 a thread start whose instance is at its token limit is refused, logged once with the limit and the count (167.897962ms)
usage: {"event":"usage-unknown","business":"acme","run":"rd2b711b2bbf2","instance":"assistant","turn":"2d75e729-15ce-4ffc-8170-ff1fdea945ef","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mustStop","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":1}
✔ REQ-LIMIT-4 a thread run at its token limit stops at the end of its turn: the reply lands, and the end record names the limit (273.854256ms)
task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (435.658145ms)
✔ the transport writes {business, verb, args} to the child and reads its JSON (54.611699ms)
✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2225.04242ms)
✔ busExit and refuseInsideAgent (0.695019ms)
✔ REQ-LIMIT-4 mosaic usage shows each token kind and unknown turns beside every total (101.047518ms)
✔ usage is dispatched by scripts/mosaic and the shared read adapter (152.502912ms)
✔ talk sends a REQUEST, prints and reads only the reply to it, and leaves other messages unread (64.112603ms)
✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1037.162914ms)
✔ a late reply the Console has listed stays unread for mosaic inbox, and the next talk skips it (2051.677435ms)
✔ talk says when the role isn't running, whether launch.by was told, and how to start launch.by (48.896566ms)
✔ talk to a role launch.by can't launch says it isn't in the launch block (19.039325ms)
✔ talk to a stopped role prints the waiting line once, skips a non-reply and prints the reply (50.103774ms)
✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (18.298879ms)
✔ launches off and on go to the broker and change the business's launch state (16.657237ms)
✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (15.521598ms)
ℹ tests 408
ℹ suites 0
ℹ pass 408
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 213037.078385