stack/agents/bubba/work/queue-288/BUILD.md

# Row 288 (#1793): C2-02 agent writes, notices, revert and Console saves

Owner: Bubba, Codex gpt-6.1-sol, thread 3d6672b5-5544-4b95-9e09-e79574f1aa14.
Reviewer: Webby. Gate and landing: Sage. Append-only build record.

## 2026-10-23 start and implementation plan

Base 45dca69f6 on bubba/row288. Direct mandate mos-1499 (Q245), confirmed sage-3613.
The canonical `scripts/mosaic queue next bubba` returned `nothing`; Sage owns the owner transition.
The initial worktree invocation refused linked-worktree use; retried in canonical checkout.

Spec: docs/plans/2026-10-20_case2-rows.md, C2-02; agents/gosalyn/work/case2/DESIGN.md ruling after r11.
Handoffs: Honker queue-283 BUILD.md Q4 (missing/non-100644 delete refuses); Morgana
queue-225 BUILD.md A2 at 66f7becf2 (strict revert arguments/result), confirmed by Fethry fethry-0005.
`project` is the business.projects key, never a chat UUID.

Dependencies merged with their commits intact, no amend or force-push:
- 283 origin/honker/row283-build 88ec5e8e4 (new E4 head to follow).
- 285 origin/scrooge/row285-r2 53db6b7ca.
- 286 origin/ludwig/row286-r2 573fa0be0.
- 284: no named remote branch yet. Tool changes come last.
All merge commits are marked Untested. Nothing has run under Node. Sage's latest instruction
sage-3613 reserves **all Node and test runs** for CLEAR; this supersedes the initial targeted-test
permission. Build untested now as instructed, then run RED/GREEN checks/mutants on CLEAR.

Architecture: one host-only plumbing writer under the existing library lock; broker authorizes and
selects credentials, then inserts the fixed notice directly. Human save/revert use editor +
library-human independently of seat lifecycle. No worktree, deferred push, role expansion or UI.

### Tasks and acceptance

- [ ] Plumbing: new library/src/write.mjs, mirror state publication and package exports; new
  library/tests/write.test.mjs. One-parent write/delete, byte-exact content, seat identity/trailer,
  stale-base, nonregular/missing deletes, retry once on an unrelated remote change, push failure
  without local ref movement, human editor and revert reachability/single-path checks.
- [ ] Broker + runtime: library.doc.write/delete, library.file.save, library.revert; strict keys,
  creative + library.write + live unheld project grant; direct exact notice; human-only save/revert.
  New bus/tests/library-write.test.mjs covers authorization, unchanged refs, A2 contract and socket.
- [ ] Transport: only human library.file.save joins the existing large-save exception. New tests
  prove >64 KiB save accepted, agent writes retain 64 KiB bound, malformed/oversize saves refuse.
- [ ] Tools after 284: library_doc_write/delete in harness tools; exact eight/ten-name snapshots
  in a new harness test; cli dispatch wiring.
- [ ] Verify on CLEAR: new tests, library/bus/harness suites and all scripts/test-*.sh on Sage's
  assigned slot. Mutants remove supporting guard and force push; both must fail. Fixture-token
  search over captured output. No gate, landing or queue move claimed before Sage's acceptance.

Pre-flight interfaces: broker consumes library writer {project,path,commit}; revert adds reverted;
writer consumes C2-03b push {pushed} or {raced,tip} and supportingPath(mapping,universe,path,tree).
State publication must add optional lastPush while preserving old state readability. Refusals must
restore fetched remote-tracking refs as well as preserve served. Runtime must bind credential file
references itself; no file, identity, message or credential is supplied by the agent.

Necessary file-scope additions: packages/bus/src/runtime.mjs (actual adapter injection),
packages/library/src/index.mjs (exports), and CLI's existing console adapter if saves require it.
Reported to Sage in bubba-0002. Existing tests will not be edited without Mos's OK via Sage.

Review focus: remote tip races, nonregular entries and folded paths, unsafe human credential before
git, revert after revoked/fired writer, and large-request exception never extending agent writes.

### Existing-test changes

None authored by Bubba yet. Dependency test changes remain their owners' original commits.

## 2026-10-23 first static build (not a gate result)

283 E4 merged intact at 76d651dba. Honker next reports e67c27b32 (test environment only), to merge
before push. Della reports row 284 has not been built/pushed; row224's 23816cf28 is not a 284 head.
No speculative 284 pin. Typed tools and served-blob lookup integration remain pending 284.

Implemented (unrun): bare plumbing writer, one-parent commit and fixed trailer, exact-content blobs,
base comparison, supporting path guard and delete regular-blob check, one remote-race retry,
ref restoration on refusal, immediate served publication/lastPush; human save and reachable one-path
business-trailer revert; broker grants/identity/notice path; runtime adapter wiring; large-save socket
exception. New tests: library/tests/write.test.mjs and bus/tests/library-write.test.mjs. No old test edits.

### Approved scope additions, sage-3628

Every hunk outside the brief's owned list:
- `packages/bus/src/runtime.mjs`: `humanWriteOptions` checks editor before choosing the human slot;
  three library adapter entries bind dataRoot, command and the host-only seat store reference. These
  are needed to make actual bus calls reach the new writer without accepting agent-supplied files.
- `packages/library/src/index.mjs`: export writeLibraryDoc/saveLibraryFile/revertLibraryCommit so
  runtime's existing library module adapter can call them.
- `packages/library/src/sync.mjs`: shared write guard with opaque token compared by identity;
  push's race fetch recognizes only that owner and does not clear its guard; ordinary sync and a
  forged token still refuse library-sync-busy. Narrow publishLibraryWrite validates ids, reads the
  locked state, rebuilds the index via readLibrary, moves served/tracking and writes lastPush. The
  raw writeState remains private and is not exported through index.mjs.

Ludwig ludwig-0064 reviewed the intended interface and requested the opaque token (implemented),
narrow publication (implemented), whole library + bus library-credential checks and a token mutant
(planned). His 573fa0be0 remains current and unrun. 288's additions are separate commits, not folded
into 286. Tracking restores only if the whole write refuses, not between the first race and retry.

Known tradeoff, accepted by Sage sage-3628 for MVP: the brief holds the flock through network Git;
readers can hit the existing 5-second library-sync-busy while it runs. Structural supportingPath
preflight is pure and precedes Git; served/fetched listTree checks repeat it with the real tree before
any remote write. A tree-dependent check necessarily reads the tree first (Honker honker-0184 item2).

### Mutants for CLEAR

- Remove the `pathOf` calls for agent operations: the M12 broker/bare-ref tests must fail on a
  story/unsupported path while checking remote, tracking and served refs.
- Prefix the push refspec in syncCommand with `+`: write.test moved-target race must fail, because
  its command seam preserves production syncCommand's refspec (only remote URL/protocol are fixture).
- Replace `writers.get(mirror) === writeToken` with `true`: write.test forged-token case must fail.

No Node, test, build or mutant has run. `git diff --check` is clean. Counts are not claimed.

### Console dispatch integration

The existing cli delegates its transport wiring to console-bus.mjs, so the save dispatch needs that
file too: one null `librarySave` option and one `--send` assignment to library.file.save. cli.mjs
threads that option into startServer; row C2-11b owns the actual route/page that consumes it. New
webui/tests/library-write-options.test.mjs covers --send and the user transport boundary. 225 owns
libraryRevert dispatch; 288 adds only librarySave to avoid overlapping that ownership. Additional
scope reported to Sage and Fethry. No changes to an existing test.

## 2026-10-23 second static pass and dependency review

First push: c867cada9 on origin/bubba/row288, reported bubba-0005 to Sage/Webby/Mos and
bubba-0006 to Fethry/Ludwig. No PR created and no review/gate requested as complete.

Ludwig ludwig-0065 checked the exact sync diff against 286 without running anything. Token identity,
ordinary-sync exclusion, 286 R1 preservation, guard key and end-of-write tracking restoration fit.
F1: state publication could fail after served moved, leaving old state/new served. Root cause is
publication order without rollback, compared against sync's existing rollback. Added an unrun
filesystem rename-failure regression, then changed the narrow helper: on failure it validates the
state under the same lock, CAS-restoring served if state has not published the new commit. If rename
succeeded but directory fsync failed and the state validates against new served, it keeps that pair.
All failure cases answer outcome-unknown; tracking remains the commit already pushed remotely.
Verification is pending CLEAR, so this is a proposed fix, not a tested resolution.

Added the actual broker-to-bare tests for each M12 path refusal (both agent verbs), unchanged remote
and all mirror refs, exact write/delete notices, and human revert after fixture grant removal/hold.
The bare fixture moved to new library/tests/write-fixture.mjs so broker tests reuse real plumbing.
Added the raw socket proof-nested-save-name case to pin the parsed-verb large-request check.
Missing editor/slot tests now make the mirror metadata invalid first: reaching Git would change the
refusal, so the tests check the pre-Git gate rather than merely count remote commands.

Additional required doc hunk: packages/library/README.md appends the four verb contracts,
lastPush shape, exact notice, lock tradeoff and publication failure behavior. No existing test from
the dependency/base has changed. All new/modified tests in this pass were authored by this row.
`git diff --check` remains clean. No Node/tests/build/mutants run; 284 and CLEAR remain pending.

## 2026-10-23 early review follow-up (Webby E1-E6; Ludwig F2)

Sage sage-3652 approves console-bus.mjs wiring (null option + --send dispatch), confirms editor.user
as the sole human login source and reserves CLEAR for T3/T4 after T2. Ordinary sync()'s separate
post-rename fsync gap stays out of 288 per that ruling; no change to sync()'s existing rollback.

Honker 283 head 46bad7ea3 merged intact: mapping editor.user is optional, and if present uses the
existing plain Gitea-user pattern. The omission at mapping level is valid; human writes refuse it.

- Ludwig F2 / Webby E6: confirmed the previous runtime used the fetch bot's mapping.user wrongly.
  Runtime now passes mapping.editor.user to humanCredential, never mapping.user. Missing user gives
  library-human-missing before Git. New real-runtime cases pin both save and revert with a separate
  fetch-bot login, positive pushes under her-gitea-login, and no command for an absent editor login.
  The broker's credential.agent is s.role, not args: added an exact assertion and strict-key refusal
  cases for caller-supplied agent and credential.
- E1: replaced the business-id RegExp interpolation with a literal startsWith(business.id + '/')
  check and ID_PATTERN on only the instance suffix. New acme.co vs acme-co trailer test.
- E2: new broker→bare case holds the seat in the fetch command. beforePush must refuse
  library-write-no-grant with all local refs and the remote unchanged and no notice. New mutant:
  remove `options.beforePush?.();` in write.mjs; the E2 test must fail.
- E3: new broker cases for expired rotate_by, fire.stopped without fire.done, missing role.publish
  project, grant/identity Gitea-user mismatch, and missing identity name/email, for both agent verbs.
- E4: the exceptional publication failure currently returns outcome-unknown before the broker has
  a successful result to put in a notice, so a remote agent commit can exist without a Console
  notice. There is no durable notice outbox/retry in this row. The trailer commit remains human
  revertible by id after sync; this is an explicit known failure-mode gap for the manifest, not
  a claim that every failed publication emits a notice. A new real-push test breaks state decoding
  after push admission, pins outcome-unknown, old served and no notice. It also found a local error
  propagation gap: errors before publishLibraryWrite's internal try now normalize to outcome-unknown
  in the writer once push has succeeded, so the caller is never told an ordinary refused-write code.
- E5: 284 still has no build. Tools/8-or-10 snapshot and served-blob integration remain pending.
  librarySave is intentionally only an adapter option until C2-11b supplies its route/page.

All tests above are newly authored by row288 and remain unrun; no changes to baseline/dependency
tests. RED/GREEN and mutants await CLEAR. Proposed fixes are not claimed verified. The new host-only
library write module imports the existing pure ID_PATTERN to match the broker's accepted instance ids.

## 2026-10-23 mos-1520 ruling: post-push notice is required

Correction to the E4 interpretation above: Mos rejected the known-gap treatment. The requirement
stays: a pushed agent commit has the exact notice even if local publication then fails. This is not
an outbox or retry. The writer now calls the broker's trusted synchronous onPushed callback as soon
as push returns pushed:true, before publication. The callback records the exact library-write notice
and action.allowed in the normal Console-store transaction. Publication failure still answers
outcome-unknown. The notice's Revert can refuse library-revert-not-agent until sync makes that commit
reachable from served; README now says that explicitly and removes the rejected gap description.

The row's own real-push corruption test now pins the exact notice body with the pushed id, old
served and outcome-unknown; after restoring readable state it pins Revert's refusal before sync and
success after sync. The successful-write adapter fixture calls onPushed too, matching runtime's
writer contract. No existing baseline/dependency test changed (mos-1520 explicitly authorizes this
row's test correction without mos-1272).

Residual Console-store failure: if notice insertion/routing/its event transaction fails, the broker
calls a separate host log sink with {event:library-notice-store-failed,code:outcome-unknown,business,
instance,op,commit}. It logs no args, path content, credential, raw SQL or exception output. Runtime's
new library.log adapter writes this metadata to stderr. The caller gets outcome-unknown even if
recording action.refused in that same broken store fails. A new real-push test uses temporary SQLite
abort triggers on notice insertion and refusal evidence, checks remote advanced/served unchanged,
no message, the exact external log and outcome-unknown. It does not claim a notice can be stored in
a failed Console store. If the host log sink itself also fails, no durable log can be promised; the
caller still receives outcome-unknown. The runtime log hunk is the required residual-failure wiring.

Mutant added: move `options.onPushed?.({ project: context.project, path: change.path, commit });`
from before `await publishLibraryWrite(...)` to immediately after that await inside the same try.
Successful operations keep their notice, but the outcome-unknown publication path drops it. The
C2-02 E4 real-push corruption test must fail on its exact notice assertion. Run on CLEAR and restore.

No Node/tests/build/mutants run. Static git diff --check clean. Della's first284 head0ed4fbab9 is
explicitly incomplete and not a finished dependency; waiting for her complete-head pin before tools.

Webby webby-0253 (static, cef503cb9) closes E4 per mos-1520; no tests ran. N1: a failed notice insert throws from onPushed before publication, so served stays at the prior commit until sync; the store-failure test pins this safe direction. Only E5 (284 tools/snapshot integration) remains open in this early review.

## 2026-10-23 complete284 merge and final tool integration (unrun)

Della della-0037 supplied complete untested head47db04eba85ac3ceb7e81385603f97bb6f8c1a38,
replacing the incomplete head. Merged intact as c0ca3894c. Its22423816cf28 and2164f3fbc25a
lineage is retained. Three conflicts were in overlapping production wiring only:
- broker.mjs: keep Della's LIBRARY_LOOKUPS object and #requestLibraryLookup byte-for-byte, and
  keep288 writer/notice methods; LIBRARY_VERBS contains both sets and request dispatch calls lookup.
- runtime.mjs: keep lookup adapter plus288's metadata log and write adapters.
- library/index.mjs: keep index/query exports,286's push/humanCredential exports and288's writer exports.
No dependency test body was changed in the merge. These are overlapping consumer integrations,
not rewrites of dependency commits. Every prerequisite still needs its own gate (mos-1351).

Added library_doc_write/library_doc_delete after the five lookups, only for a creative definition
with a within-role library.write grant and library enabled. Closed schemas carry exactly
{universe,path,base,content} and {universe,path,base}; base is string-or-null with 40-lowercase-hex
pattern. No project, business, author, credential, commit or message. tools.action is library.write.
New harness/tests/library-write-tools.test.mjs pins per-role eight/ten names, both schema invariants,
no repo/commit/business/accept, exact required/verb/action, nullable base, and missing library/grant
or noncreative exclusion. This satisfies sage-3678 and mos-1523's replacement coverage condition.

Publication's narrow helper now calls indexFor for the new served commit instead of only readLibrary,
so the284 lookup index is rebuilt before publication. New broker integration uses library.get's
served blob as write/delete base, independently checks served:path, reads the new text/blob immediately,
preserves default-canon null, then sees null after delete. No change to284's query behavior.

### Authorized baseline-test migration, own commit (mos-1523 via sage-3677)

File: packages/harness/tests/library-tools.test.mjs. Numstat: +4/-4, exactly.
The noncreative LOOKUPS assertion at :33 is unchanged. Every existing lookup schema assertion stays.
The four old/new lines are:

```diff
-  ? ['web_search', 'web_fetch'] : []), ...LOOKUPS];
+  ? ['web_search', 'web_fetch'] : []), ...LOOKUPS, 'library_doc_write', 'library_doc_delete'];
-test('M3: per-role snapshots contain six names, or eight with the C2-08 web grant', t => {
+test('M3: per-role snapshots contain eight names, or ten with the C2-08 web grant', t => {
-  for (const [i, tool] of tools.filter(t => t.name.startsWith('library_')).entries()) {
+  for (const [i, tool] of tools.filter(t => LOOKUPS.includes(t.name)).entries()) {
-  assert.deepEqual(tools.map(t => t.name), ['send_message', ...LOOKUPS]);
+  assert.deepEqual(tools.map(t => t.name), ['send_message', ...LOOKUPS, 'library_doc_write', 'library_doc_delete']);
```

Additional schema mutant (mos-1523): add `commit: str("caller commit")` to writeBase in tools.mjs,
thereby adding it to either/both write schemas. The new-file schema test must fail both its exact
property set and forbidden-property assertions. Run on CLEAR and restore. No further assertion
change in library-tools.test.mjs is authorized or made.

All code/tests/mutants remain unrun. No Node, build or syntax check before Sage's named CLEAR.
Static diff --check is clean. Scope additions stay listed above, now including indexFor import and
call in the previously approved narrow publication helper. E5 implementation is present; review and
acceptance are pending evidence, not claimed complete.

## 2026-10-23 testing and landing boundary (sage-3682)

Latest complete dependency2845d587a552 (test/docs only over47db04eba) merged intact as f8f79ea2f.
Own tool implementation cd2f50dae and separate mos-1523 migration29455c0c5 are pushed; Webby reads
E5 and Dewey checks the migration. Static manifest-r1 covered21 own paths at f8f79ea2f.

Sage reserves first focused runs/RED-GREEN/mutants for T7, provisionally about22:25Z, unless he
explicitly frees an earlier lane. No Node before his CLEAR. This is a schedule, not CLEAR. Full
library/bus/harness and shell gates still need their own authorized slot; no gate result is claimed.

Before the gate, incorporate landed refactor after283/224/284 land while preserving every
prerequisite. Under the standing add-commits/no-force-push rule, update this published branch by merge
rather than rewriting its pushed history. 288 lands last in the chain; no landing is authorized here.

## 2026-10-23 E5 static closure and N2 wording

Dewey dewey-0948: the mos-1523 migration at29455c0c5 is static CLEAN, exactly+4/-4, with the
noncreative assertion unchanged and new-file schema coverage meeting every condition. Webby
webby-0263: E5 closed on29455c0c5/cd2f50dae (f8f79ea2f;98ca25ab1 only BUILD.md), nothing blocking.
Both ran nothing; Webby did not read the scratch manifest, so no manifest verification is implied.

Webby N2: delete inherited the write base description "or null to create". Delete now overrides only
that description: "The existing file's blob from library_get; a missing file cannot be deleted".
The reviewed nullable-base schema/required keys/verbs remain unchanged. The row's new schema test
pins create wording only on write and existing-file wording without create on delete. No further
assertion change in the baseline library-tools.test.mjs. No Node/tests run; still await Sage CLEAR.

## 2026-10-23 dependency283 follow-up (honker-0195)

Merged origin/honker/row283-build b2a1f4092 intact, fast-forward lineage from46bad7ea3. It changes
supporting.test's helper and Honker's BUILD receipts only; no production source changed. Honker
reports library98/98, business231/231 and14/14 mutants killed on that dependency head. Those are
his dependency receipts, not verification of288's combined branch. No288 Node/tests run; Sage's
CLEAR is still required. The dependency's own gate/landing remains Sage's responsibility.

## 2026-10-23 new candidate after283 landing (sage-3727, honker-0200)

Created bubba/row288-r2 from the preserved published bubba/row2887c53adf10, then rebased with
--rebase-merges --no-update-refs onto93694c5185d0a7f989d2fe78fb620e44599b744e. This supersedes
the earlier merge-only refresh plan for this candidate: Sage explicitly requested a fresh branch,
not a force-push. Both local and remote bubba/row288 remain7c53adf10, unchanged.

Git skipped12 duplicate283 commits already replayed upstream. Range-diff of
45dca69f6..bubba/row288 against93694c518..bubba/row288-r2 (before this receipt) has35 equal
commits,12 dropped,0 modified,0 added. Full output: scratch/bubba-row288/rebase-r2-range-diff.txt
under /mnt/storage. The other prerequisite commits retain their patches; row216/224 identities are
unchanged where Git could retain them. This is not new verification of any prerequisite.

Replayed merges had the same launcher-footer and broker/runtime/index conflicts as before. Reused
the exact previously reviewed combined file bytes, keeping both launcher test bodies and all lookup
and writer paths. Static comparison before this receipt: all21 own manifest paths byte-identical
to7c53adf10; all16 other changed paths exactly match93694c518 upstream. These include newly landed
226 and coordination/docs changes already on that base, not new288 edits. No baseline assertion or
production change was introduced by conflict resolution.

Sage's base93694c518 is an ancestor of the candidate; old283 b2a1f4092 is not. Static diff --check
clean. No Node, test, syntax, build, mutant or gate run. Named CLEAR/T7 still pending;288 lands last.

## 2026-10-24 static preflight before landed284 base (sage-4282)

No Node, npm, test, syntax, mutant, queue command or gate ran. Still on bubba/row288-r2,
b44152ac6 plus this static follow-up; await Sage's landed284 base before a fresh candidate branch.
Do not treat the earlier T7 estimate as CLEAR. Webby remains reviewer.

### Updated C2-02 brief and contract names (webby-0282 N1)

Read C2-02 on origin/refactor 95d4991d20a4ef291c824d37c886eaeaa9be7062; current brief blob 85e6fe2ecfc53ed615b7b61aade88ae0cbb222ef
(the new ruling is identified by Sage as5e8a720b). Statically checked both the candidate and current
refactor versions of all six creative contracts: roles/companion.md, research.md, ideas.md,
proofreader.md, fact-checker.md and continuity.md. Every one names library_doc_write and
library_doc_delete, exactly the two add() names in candidate harness/src/tools.mjs. No role contract
change is needed or made. Exact-name evidence is tool-contract-audit.json in the scratch dir below.

### mos-1584 fixture audit

The new row288 harness tests reach businessDoc through resolvedFor, but their callbacks add only a
creative role; they add no library business project. library:true is the typedTools option, not a
businessDoc project. The broker/runtime/bare-library tests build minimal business objects directly,
not businessDoc. The migrated baseline harness test likewise adds no library business project.
There is therefore no new row288 businessDoc-with-library fixture requiring a chief-reference edit.
The current and future landed-base imported fixtures must be rechecked after the pending rebase;
any validating businessDoc fixture that adds a library project must retain/provide chief gitea.

Shortened only two row288-authored fixture credential values: write-fixture.mjs uses fx288-write,
and the runtime test's two slots use fx288-human. Both are11 characters, below24. This corrects the
25-character runtime value and avoids an edge at the older23-character write value. No assertion
changed, no baseline test edit and no credential file was read. No live credential action occurred.

### mos-1612 whole-file run-list preparation (not run authorization)

Static lexer traversed real import/re-export/require and new-URL module-entry edges, skipping
comments/quoted fixture code; reverse closures carry a chain witness for every selected test.
Used the union of this older candidate and the current refactor source snapshots so newer importers
are visible without prematurely rebasing. It selected270 whole test files. Required whole library,
bus and harness suites add17 distinct files, making a proposed union of287 (not a narrow grep list):
bus115, business2, cli58, harness16, library13, plugins1, processing-control1, seat5, tasks9, webui67.
The brief also names all12 scripts/test-*.sh runners. No file/runner was executed.

packages/cli/tests/case1-accept.test.mjs is explicitly excluded under mos-1592/1612. The11
nonliteral-import files have a manual expression audit; all already occur in the import-selected
whole-file set. Generated programs and runtime plugin discovery are recorded static limitations,
not asserted fully resolved by the lexer. Whole suites and the named script runners retain their
brief-required coverage. Regenerate after landed284 rebase; report exact final sha/list before CLEAR.
Each approved gate later needs own root/webui npm ci, required editor build, short scratch TMPDIR,
whole files and gate skip receipts under the then-current rules. These are plans, not past evidence.

Artifacts: /mnt/storage/scratch/bubba-row288/static-2026-10-24/
- import-run-list.py SHA256 ec18031c87bf6f96b3e794e2e56747bc5e1fe37580de7ce9444c60cd5f18ddc0
- whole-files.txt SHA256 b2d6c11349268c347e51a64fe6bf9e7c4d560238a8fc5b5e10f600f1e6e8a39e
- import-witnesses.json SHA256 01702657d34c4f2c0635f38741d0a5b57cfdda63d5e96897f188d03971afd5d9
- dynamic-import-audit.txt SHA256 42b8721fde783c618e1347f2609ad6e4ae3144f563272f0bbbeb45c34f751018
- brief-required-whole-files.txt SHA256 254828414cd9b1b0a785df5c23b7f2b9ea7564d1f85e648899801e46194d135f
- proposed-whole-files.txt SHA256 bee666dce2c3f2d0bafe7e963fb443ad356b6ae8719ac3cb8ee413a329578035
- brief-script-runners.txt SHA256 02cd25af486c163189977106e055575145bffba688c7836e2a508f5ec91e76d4
- tool-contract-audit.json SHA256 bf07865d796b8b0aed85d84c015430ea03468c5331bcaae9eb80efafe1a182be
- fixture-audit.json SHA256 436a69a6b8548d8426390e867ed4b0f83693a3116d825c26c6f8a3e788f477d6

## 2026-10-25 landed-base transplant (sage-4338), UNTESTED

Named base: 78b69e1e68b2b8a9dc4c02564381a0792c0c7549, including landed284 ce0b6ed41.
New branch bubba/row288-r3-landed; published r2 e7c31a90d is untouched.
The initial --rebase-merges replay tried to reapply already-landed285 and conflicted;
aborted without resolving those conflicts. Transplanted only the twelve Bubba nonmerge
commits, in order, onto the named base using cherry-pick. No dependency commits replayed.

Conflict resolutions (no test conflicts, no assertion changes):
- BUILD-LOG.md and docs/SESSIONS.md: preserve the entire upstream side, append Bubba entries.
- broker.mjs: retain landed LIBRARY_LOOKUPS and lookup dispatch, add writer verbs/methods;
  retain the complete landed library.status replyLimits branch after writer/save/revert dispatch.
- server.mjs: retain landed refusal envelope including reason, combine project/library save detection.
- library/index.mjs: retain every landed export, append the writer exports.
- webui cli.mjs and console-bus.mjs: preserve landed libraryRevert and add librarySave alongside it.
- runtime.mjs (notice follow-up): retain landed lookup adapter, add metadata-only log sink.
All other changes merged automatically. No business role/vocabulary file or dependency packet changed.
Baseline test migration remains packages/harness/tests/library-tools.test.mjs +4/-4 (mos-1523).
Only additional own-test edit removes a trailing blank EOF line in write-fixture.mjs.

Line-reference recheck: the sole explicit source-line citation in this append-only packet,
noncreative LOOKUPS :33, is still exactly line33 of library-tools.test.mjs and unchanged.
Historical fired-chief path4308 described an older broker; current fire.stopped/fire.done are
broker.mjs5126/5147 (firing detection863-865). Those historical receipts remain historical.
Old head/brief identifiers and T7 times above are historical, not the present base or CLEAR.

Final import-list audit uses candidate + exact named-base import graphs, eleven changed source
modules as roots, and all touched tests; no text grep selects a test. 272 whole files selected,
plus17 brief-required library/bus/harness files =289 files. Package counts: bus116, business2,
cli59, harness16, library13, plugins1, processing-control1, seat5, tasks9, webui67.
All12 current scripts/test-*.sh runners retained. case1-accept.test.mjs excluded explicitly.
The eleven nonliteral import expression sites were rechecked; whole parent tests already selected.
Generated programs/runtime plugin discovery remain documented static limitations.
Artifacts and chain witnesses: /mnt/storage/scratch/bubba-row288/static-r3/.
No Node, npm, test, syntax check, build, mutant or gate run. Pending Sage CLEAR.

## 2026-10-25 first CLEAR and delete-path RED/GREEN (sage-4396/4398)

Own root npm ci rc0; own webui npm ci rc0; editor build rc0. Fresh TMPDIR from mktemp
under /mnt/storage/scratch/tmp. All Node whole-file runs nice19, timeout600 kill-after10.
Initial own write.test.mjs rc1,10 pass/2 fail: delete and revert-to-absent hit library-git.
Isolated bare Git confirms update-index --force-remove rc128 (requires worktree), while
--index-info rc0. First replacement and two delimiter-investigation reruns still rc1,
10/2: runGit's stdin argument names an input FILE, not input text. No pre-existing test
ran or was edited. Final correction writes a private NUL-delimited removal record in the
already-cleaned staging dir and supplies that file to update-index -z --index-info.
Whole write.test.mjs now rc0,12/12,0 skipped/cancelled. Source-only fix in owned write.mjs.
Logs remain /mnt/storage/scratch/bubba-row288/gate-r3/ (write-fixed through write-fixed4).
Sage4398 authorizes this fix and requires committed new candidate + driver restart from
first whole file. Focused green is not the complete gate; remaining acceptance pending.

## 2026-10-25 new broker-fixture RED/GREEN, driver restart pending

Candidate7932c979a driver first library file rc0,12/12; second own bus library-write rc1,
0/14 (fixture FK and undefined dataRoot). Own fixture lacked gitea_users parent; insert
with valid16-hex nonce, consistent with landed credential tests. First attempted fixture
nonce was invalid and INSERT OR IGNORE hid it; corrected nonce, no product/schema changes.
Every bare.dataRoot reference was undefined: use bare.context.dataRoot. After these fixes,
whole file rc1,13/14, last assertion assumed lines were strings; query returns [line,text].
Corrected this row's new assertion to exact [1,'new served text']; whole file rc0,14/14,
0 skipped/cancelled. Intermediate logs bus-fixture-fixed{,2,3} under gate-r4 retained.
Only owned new bus/tests/library-write.test.mjs changes (+14/-12); no pre288 test changed
or failed. Commit this fixture correction, then restart all289 whole files from the start.

## 2026-10-25 creative typed-tool fixture RED/GREEN

Candidate4fb11e74a restart: library write12/12 rc0; bus write14/14 rc0; own harness
library-write-tools rc1,0/3 before assertions: new creative role fixture omitted the
Gitea credential reference required by landed285. Added the same fixture reference copy
as landed library-tools.test.mjs (no credential file read); no assertion changes. Whole
own harness file now3/3 rc0. Only new owned test+BUILD changed. No pre288 test failed.
Commit and restart driver from first whole file again; gate still not claimed green.

## 2026-10-25 completed candidate gate (sage-4396), SLOT RETURNED

Tested candidate2848d832e (three additive fix commits after requested8a47c462a).
Driver restarted from first whole file after EACH fix. Positive gate-r6: all289 whole
files rc0,2604 pass/0 fail/0 cancelled/1 deliberate FED R7 skip. Full required suites:
library168/168 (13 files), bus1035/1035 (116), harness180/180 (16). Other selected:
business25/25, cli619 pass/1 skip, plugins8/8, processing-control7/7, seat69/69,
tasks95/95, webui398/398. Case1 acceptance excluded. Final import graph regenerated on
2848d832e in static-r6: whole-files.txt byte-identical to static-r3 selection.

All12 scripts rc0: test-auth,conductor,config,discord,extension-package,
federation-acceptance,foundation,land-work,push-check,queue,release,task.
FED R7 dedicated runner covers ordinary-suite skip. Queue wrapper28/0 and node156/156;
canonical-root verify/render check deliberately skipped in this linked worktree.
Root/webui own npm ci and editor build rc0 before runs. All tests nice19, sequential,
whole-file timeout600/kill-after10; scripts timeout1800/kill-after10. Fresh mktemp TMPDIR
/mnt/storage/scratch/tmp/ for each restarted driver; no /tmp test root.

Six mutants killed (each rc1), restored positive whole files each rc0:
- M1 supporting checks removed: broker M12 refusal assertion.
- M2 forced push refspec: unrelated-blob retry/new-parent and guard assertions.
- M3 forged owner token: missing expected rejection in exact-token test.
- M4 beforePush grant recheck removed: held-during-fetch expected rejection.
- M5 notice after publication: E4 exact notice and failed-store assertions.
- M6 caller commit in schema: exact property-set schema assertion.
Source SHA256 restored after every mutant; git status clean afterward.
Captured logs across all four run attempts scanned for both fixture credentials:0 hits.
No pre288 test failed; no pre288 assertion changed beyond approved mos-1523 +4/-4.

Per-run rc and log hashes: gate-r6-results.tsv; counts: gate-r6-summary.json in this
packet. Full logs, mutant diffs, drivers and JSONL receipts under
/mnt/storage/scratch/bubba-row288/gate-r6/. Earlier RED/intermediate logs retained in r3-r5.
Slot-returned report sent to Sage as bubba-0034; no further tests after slot return.

Review notes to carry into request (webby-0296): N1 baseline library-tools.test.mjs73
still says tool names unchanged while the pin gains writer names; retained to honor the
narrow +4/-4 permission. N2 librarySave is dispatch plumbing only; C2-11b owns the route
that consumes it. N3 sync comment omission is cosmetic and unchanged from reviewed r2.
Commit-count correction: r3 initial head8a47c462a had13 commits, twelve transplants plus
receipt (BUILD +36, SESSIONS +2, fixture EOF -1). Current tested head adds three fix commits.
Formal manifest review/gate acceptance and landing remain Sage/Webby stages, not claimed.