stack/agents/filbert/work/queue-85/r1/body.md

Row 85 round 1 (#1579), Filbert: changes requested.

Candidate manifest SHA-256: efb6a65671fae3a727b8d58823e678513f1187c7abc6fce48007411cee0da0dd. Base: 0d71b9ddd. Packet: agents/rocko/work/queue-85/r1/. This answers request 28241.

I rebuilt the candidate in my own worktree at 0d71b9ddd and applied build.patch. All 11 manifest hashes match, git diff --check is clean, and the patch touches only the 11 paths. None of the 11 paths changed from 0d71b9ddd to the current refactor head (99472cf7, packet only). No literal bidi or control characters appear in the new or changed lines.

B1 (blocking): bus-service.sh install always refuses on this host

install_guard runs systemctl --user show [email protected] -p DropInPaths and dies if that read fails. systemd 261 on this host refuses show on a template name:

$ systemctl --user show [email protected] -p DropInPaths -p LoadState
Failed to get properties: Unit name [email protected] is neither a valid invocation ID nor unit name.
rc=1

I ran the candidate's install --dir <scratch> --no-reload with a stand-in systemctl that answers list-units with an inactive instance and passes show to the real systemctl. It refuses with refusing: systemctl --user show [email protected] failed; nothing was changed and writes nothing. So step 4 of the Pinned stack update (bus-service.sh install --copy ID --pm) can never succeed on the live system, even after Mos stops the bus and removes pm.conf. The tests don't catch it, because every fake systemctl in stack-copy.test and host.test answers show for any name, the template included.

There is a second gap in the same guard. It finds instance drop-ins only through instances that list-units --all lists. A stopped instance that nothing references can be unloaded, and then its mosaic-bus@<id>.service.d/*.conf is never read. Today the unit is enabled, so it stays loaded, but the brief asks that install refuse while any mosaic-bus@ drop-in sets ExecStart or WorkingDirectory.

Suggested fix, Rocko's choice:

• Show a concrete instance. systemctl --user show mosaic-bus@<business>.service -p DropInPaths loads the instance, and its DropInPaths includes the template's .d directory as well as its own. Check it for each listed instance, plus [email protected] (or a --business flag).
• Or read the drop-in directories directly, from each path in systemd-analyze --user unit-paths, for [email protected]/*.conf and mosaic-bus@*.service.d/*.conf.
• Add a test whose fake systemctl fails show on a template name the way systemd does, plus one with an instance drop-in for an instance that isn't listed.

What Sage asked me to check

Same-copy proof and other-tree refusal. The integration test copies a fixture repository with the real package locks, runs npm ci, starts bus host up and Console /healthz 200 from the copy, then serves a broker built from the copy's own store, broker, server and human modules. The copy's scripts/mosaic talk pm prints sent and the fixture reply. The checkout's human-cli.mjs and a second copy's human-cli.mjs, against the same socket, each exit nonzero with stderr exactly human-required, so neither is a load failure.

The "existing test ancestry seam" is the readProcess option of verifyHuman (human.mjs:52). human.test.mjs:25 and :104 already use it. The test keeps the real readProcess result for the proof pid, including uid, startTime, the nonce in env and argv[1], and changes only ppid to 1, so the ancestry walk ends at the CLI process. The argv[1] !== resolve(cliPath) check runs on real data. human.mjs is unchanged in the candidate. This matches the brief.

Every live step stopped and gated on Mos. TOOLS.md "Pinned stack update" says it is an operator plan, not an agent action, and that both reviews and the landing come first. Steps 2, 4 and 5 say "With Mos's go". Steps 3 and 6 are Mos's own actions, and step 7 is Jason's mosaic talk. Step 1 (copy) writes only files under the copies directory. Both READMEs say each live step needs Mos's go and agents stop before the sequence. BUILD.md has the STOP heading. The word STOP doesn't appear per step in TOOLS.md, but every live step names Mos or Jason. Satisfied, apart from N1.

README edits in the named sections. The cli README edits are inside ## Bus host: the ### Unit list and a new ### One pinned copy placed before ## Notifier. The webui README edit replaces row 77's service paragraph inside ## Preview behind a sign-in proxy (row 74), which is where the service text lives. TOOLS.md changes the bus-service usage lines, adds the stack-copy.sh entry with the update plan, and edits the webui-service.sh entry. Nothing else in the files changed. Satisfied.

Other checks

• stack-copy.sh copy refuses a worktree without --allow-worktree. It requires reachability from both refs, refuses a symlink target, guards both manifests before npm ci, removes write permission, renames beside the target, and cleans up on failure. webui-service.sh copy now execs it.
• The live wrapper's lease line matches the exact line wrapper requires (grep -Fxc gives 1), and line 2 carries the marker. The rewrite will drop the Q81 comment lines 3 to 5. They describe the Q81 worktree, so dropping them is right.
• check reads effective WorkingDirectory and ExecStart and exits 1 on any mismatch or absence, naming all three.
• The template change is only @PM_FLAGS@. The --claude pin is unchanged.

Notes

• N1, should-fix along with B1. The first rollback can't follow "repeats steps 2-6 with the prior full copy id". Before the first update the bus runs the checkout with pm.conf, the wrapper execs the Q81 worktree, and the Console runs the checkout or a row 77 copy under mosaic-console/. None of these is a copy id under mosaic-stack/copies, and wrapper accepts only such a copy. The plan should say what the first rollback restores: save the current wrapper file, reinstall the bus without --copy and restore pm.conf, and the Console's prior install.
• N2. The proof test builds its own authenticateHuman with a cliPath it computes, rather than through runtime.mjs:68. A regression in how the runtime derives cliPath would pass this test. The bus start case from the copy covers loading, not the proof binding. This is acceptable for this row, so it's only a note.
• N3. webui-service.sh install --copy ID for an existing row 77 copy now needs --copies ~/.local/share/mosaic-console. The README says Console-only copies aren't migrated, so the docs cover it.
• N4. TOOLS.md:305 has an en dash in "2-6". This is cosmetic.

My review is static, apart from the two read-only systemctl --user show calls and the scratch-directory install above, which wrote nothing and reloaded nothing. I ran no suites, mutants or queue-commit.sh. The packet's Docker-disabled gate leaves Sage's rerun as the check of record.