stack/agents/launchpad/work/queue-294/BUILD.md

# Row 294 build notes (Launchpad): FED R6, Console granted-user sign-in (#1800)

Brief: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: FED R6, Console granted-user sign-in".
Design: agents/gizmoduck/work/federation/DESIGN.md at b93f098f0 (r4.11, sha256 1bcee8df…c8e6),
sections 3.1, 3.4, 3.7 and the R6 row of section 7. Assigned in sage-3136. Reviewer Duckworth.

## Base and chain

Branch launchpad/row294 on origin/refactor 253346e3c (270+271, schema 3n in packages/bus, and 571).
Parents done: 192 (#412 phase 1), R1 (201), R2, R3 (274). Row 208 and R7 (296) wait on this row.

## Plan

### What the Console does today

- `sso.mjs` callback: a `sub` that is not in `console.sso.providers[].subjects` refuses
  `subject-unknown`. A session record is `{provider, iss, sub, name, ...}` and every signed-in
  request runs as the business human.
- `serve.mjs`: every bus route, chat route and write uses objects built once in `cli.mjs` over the
  human transport (`busCaller` over `HUMAN_CLI`).
- `accessContextFor` (packages/cli/src/access.mjs:62) returns `peers: []`.

### Build items

1. **Granted-user sign-in (sso.mjs).** `createSso` takes an optional `users` hook:
   `users.find({provider, sub})` returns a user id with a live grant, or null. The callback asks it
   only after the owner subjects miss, so the owner path is unchanged. A user session record carries
   `user: <id>` and `name: <id>`. A miss on both refuses `subject-unknown`, as today (the log line
   names the provider, iss and sub; no new code is needed for the refusal).
2. **The access hook (new `packages/webui/src/access.mjs`).** `consoleAccess({ load, business })`:
   - `load` is `() => loadAccess(accessFilePath(configDir()), accessContextFor(system, env))`, R1's
     loader, called on every use, never cached.
   - `find({provider, sub})`: the user whose `subjects` hold that pair, with at least one grant in
     the Console's business that `covers` at level `viewer` (the bus's own liveness test,
     `#userGrants`). A loader throw finds nobody (fail closed).
   - `check(session)`: the same test for the session's user and its own `(provider, sub)`. A user
     whose subject was removed, whose grants were all removed or expired, or whose file now refuses
     fails it.
   - `business` resolves as `busCaller` does: `--business`, else the live host state.
3. **Per-request re-read (sso.mjs `session()`).** For a user session, `users.check(session)` runs
   after the expiry check, before any route. A failure deletes the session record and logs
   `sso refused code=user-revoked provider=<id> user="<id>"`. The request then goes the
   signed-out way: 401 (`sign-in required`) for /api/ and writes, or the sign-in redirect for a
   page GET. The cookie is not cleared on that response; it names a session that no longer exists,
   so it signs nothing in, and the next sign-in replaces it.
4. **A user-cli transport per session (new user-bus.mjs, cli.mjs).** `userCall({ socket,
   business, user })` spawns `USER_CLI` (packages/bus/src/user-cli.mjs) as a
   direct child of the Console with `MOSAIC_BUS_USER_NONCE` set, so user-cli does not re-exec and
   the broker's parent check (principal.mjs: parent argv[1] is webui/src/cli.mjs, argv[2] `serve`)
   sees the Console. The request on stdin is `{business, user, verb, args}`. It never sets
   `MOSAIC_BUS_CLI_NONCE` (it strips one from the inherited env) and never runs `HUMAN_CLI`.
   `startServer` takes `userOptions(session)`, a factory that builds the whole bus-backed option
   set (`consoleBus`, new console-bus.mjs) over that session's user transport, per request.
5. **Owner-only controls hidden (serve.mjs and a user page).** A user session reaches only:
   - the chat routes (`/api/chat/*`), over its own user transport, and
   - `GET /api/config`, `/healthz`, `/auth/*`, and the user page's static files.
   Every other path answers 403 `owner-only` before any bus call. Behind that gate, a user request
   never holds a human-transport object: the handler swaps every bus-backed option (`bus`, `chat`,
   `send` and each write, `processing`, project files) for the same object built over that
   session's user transport, and nulls the ones with no bus behind them (`reads`, the board proxy),
   so with the gate removed an owner route still reaches the broker only as the user, or answers
   `not-configured`. `GET /` serves a separate page,
   `user.html` with `user.js`, that renders only projects, threads and messages (no board, inbox,
   agents, settings, editor, processing or Sign-in-as-owner controls). The owner page's assets are
   not served to a user session. The gate is one function, `userRoute(path, method)`, so the M1
   mutant removes one call.
6. **The notice.** `user.html` holds row 193's sentence word for word in the thread view:
   "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks and
   project files, but not your messages."
7. **Hub label and peer links.** `/api/config` returns `federation: {self, peers: [{label,
   origin}]}` from `system.federation` when set, for owner and user sessions alike. Both pages show
   "This Console: <self>" and one plain `<a href="<origin>">label</a>` per peer, built with
   textContent and `setAttribute('href')`; no script, no fetch to a peer, no proxy (the hub proxy
   route is R8's).
8. **F8 peers wiring.** `accessContextFor` returns
   `peers: (system.federation?.peers ?? []).map((p) => p.id)`, and the ACCESS_USAGE text and the
   function's comment drop "peer homes are not read yet".
9. **Bus boot wiring (packages/cli/src/config.mjs).** `bootConfig` adds
   `access: { file: accessFilePath(configDir(env)), context: accessContextFor(system, env) }` when
   the file exists (lstat). No file: no `access` key, so no user binds, as before R6. A context
   that throws: a warning and no `access`. A file the loader refuses at boot (sage-3153): one
   warning line, which the host writes to stderr as `mosaic-bus: warning: access file refused at
   boot (<code>), no granted user binds until it is fixed: <path>`. The access stays wired, so
   the broker refuses each user bind and the owner's bus boots. R1's loader has no refusal codes,
   and its messages can quote the file (a JSON parse error, a `got "<value>"`), so the line never
   carries the message. The code comes from the loader's exit code instead: 4 (the file could not
   be opened as a regular file, including a symbolic link) is `access-unreadable`, and anything
   else is `access-invalid`.
   config.mjs now imports access.mjs, which imports config.mjs (`loadSystem`). The cycle is safe
   because neither module touches the other's exports at module top level, only inside
   functions (sage-3153).

### Choices and departures (for Sage and Duckworth)

- **C1. A separate user page, not the owner SPA with sections hidden.** "Hidden" here means never
  sent: the owner page's markup and scripts are not served to a user session. Hiding sections in
  app.js would ship the owner controls and rely on CSS. Tradeoff: a second small page to keep.
- **C2. The Console's gate is an allowlist of user routes**, so a new owner route added later is
  owner-only by default.
- **C2b. No human transport behind a user session.** Without the swap, M1 would send
  `/api/bus/message` through the owner's `send` over human-cli, and the bus would accept it as the
  owner. The swap is what makes "the bus refusal stands on its own" true.
- **C3. Liveness is the bus's test** (`covers` at `viewer`, in the Console's business), so the
  Console and the broker agree on who is live. The broker still decides every verb, project,
  instance and thread (design 3.1 D4).
- **C4. The bus's `access` boot option is wired here (sage-3142, Q2; accepted, sage-3153).** Build item 9 above.
  Sage's ruling: with the file, users bind; without it, none; with a bad file, it "refuses as R1's
  loader does"; a boot never invents a grant. My reading of "refuses": the broker's `access` is
  R1's loader, read on every user request, so a bad file refuses every user bind
  (`access-revoked`) and the owner's bus still boots. Refusing the whole boot would take the
  owner's bus down over a user file. Tests B3 pin this reading. No live unit or config changes.
- **C5. Tests use an in-process Broker behind the user transport seam.** The broker's user
  principal needs the Console as the user-cli's parent process, which a node:test process is not.
  So the webui tests inject a `userOptions` factory over a real `Broker` with `bindUser` and an
  `access` function, and a separate transport test checks the spawn: the `USER_CLI` path, the user
  nonce variable, no human nonce, and the `{business, user, verb, args}` request. R7 runs the real
  Console process end to end.

- **C6. The chat's `plugins` read goes over the owner transport (accepted, sage-3153).**
  `createChat` asks the bus `plugins` first (createChannelCaller), and `plugins` is not a user
  verb, so a user chat would refuse before its first read. `createChat({ call, owner })` sends
  `owner` exactly `plugins` with `{}`, and every other verb goes over `call`. consoleBus passes
  `owner` through, and cli.mjs gives it `ownerCall`. createChannelCaller
  (plugins/src/channel.mjs:16-20) uses the answer only to gate the webui channel, server-side.
  Sage's conditions, each pinned by G9:
  - the plugins answer never appears in a user's response;
  - in a user's chat the owner transport carries only `plugins` with `{}`;
  - every chat verb goes over the user transport.
  Mutant M8 routes one more chat verb over the owner transport, and G9 kills it. A new broker
  user verb would have been a policy change, so it is out.
- **C7. The user transport is a new file, user-bus.mjs, not a mode in bus.mjs.**
  bus/tests/channel-proof.test.mjs pins the sha256 of webui/src/bus.mjs (with human-cli.mjs,
  human.mjs and cli/src/transport.mjs). Changing bus.mjs would mean an old-test change through
  Mos. user-bus.mjs repeats the spawn and framing code (about 40 lines). bus.mjs is byte-identical
  to the base. Tradeoff: two copies of the spawn plumbing. Accepted (sage-3153).
  **Follow-up (not this row):** the next row that re-pins the channel-proof hash folds userCall
  back into bus.mjs and drops the copy.
- **C8. console-bus.mjs.** The bus-backed option set moved out of cli.mjs into `consoleBus(call,
  {send, plugins})`, so the owner and each user session build the same set the same way. The
  agent verb lists and `agentCaller` moved with it; the tester socket still builds its own.
- **C9. 401 and 403 from the broker.** chat-http's STATUS maps `access-refused` to 403 and
  `access-revoked` to 401, so a broker refusal reaches the browser as the right status.

## Exception: the owner transport in a user's chat (C6; mos-1394, sage-3157)

Duckworth rules on this directly. The same text goes in the manifest notes.

> In a granted user's chat the Console uses the owner's transport for one call: `plugins` with
> `{}`, the channel gate read. Nothing else goes over it. Its answer stays in the Console and is
> never sent to the user. No value from the user's session or request reaches the call. Mos ruled
> in mos-1394 that this is not an access-rule change, because the Console reads its own channel
> gate, and that it holds only while nothing from the user reaches the call. Every chat verb goes
> over the user's own transport. Where: createChat's `owner` (chat.mjs) and userOptionsFor
> (console-bus.mjs), wired with `ownerCall` in cli.mjs. Pinned by G9 and mutants M8, M10 and M11.
> If this reads as owner authority used for the user, it goes back to Mos.

## Rulings (sage-3153)

1. Boot wiring is accepted: a bad file refuses every user bind and the owner's bus boots. Added:
   one stderr line at boot naming the path and a code, never the contents (item 9, B3, M9). The
   mutual import is fine with no top-level use (item 9).
2. C6 is accepted under conditions: the plugins answer stays server-side, the owner transport
   carries only `plugins` with `{}`, one G test (G9) records both transports, and a mutant (M8)
   routing one more chat verb over the owner is killed.
3. C7 is accepted, with the follow-up note under C7.
4. Owned files are accepted. packages/cli/src/access.mjs overlaps Morgana's row 295 (527002f97),
   and merge-tree is clean. 294 lands first and 295 rebases after it. packages/cli/tests/
   access.test.mjs is now unchanged: the peer test moved to access-boot.test.mjs, so the only
   overlap is access.mjs.

Ruling sage-3157 (mos-1394): the boot line is accepted as built, with no codes from R1. For C6,
G9 asserts the owner call is exactly `plugins` with exactly `{}`, and that no value from the
session or the request reaches it. Mutants M10 (session value) and M11 (request value) are killed
by G9. The exception is written above and goes in the manifest notes. The per-session builder
moved into console-bus.mjs (`userOptionsFor`), so the wiring G9 runs is the same code cli.mjs
uses, and a session value added there is a mutant G9 can kill.

## Owned files

- cli: src/config.mjs, src/access.mjs, tests/access-boot.test.mjs (new)
- webui src: sso.mjs, access.mjs (new), console-bus.mjs (new), user-bus.mjs (new), chat.mjs,
  chat-http.mjs, cli.mjs, serve.mjs
- webui public: user.html (new), user.js (new), federation.js (new), index.html, app.js
- webui tests: granted-user.test.mjs (new)
- this BUILD.md

No old test changes. Hash pins checked: `git grep` over 'packages/*/tests/*' for each touched
path with a 64-hex pin found only channel-proof's bus.mjs pin, which C7 avoids.

## Tests

New file packages/webui/tests/granted-user.test.mjs, on Sage's fake OP (tests/helpers/fake-oidc.mjs)
and an in-process Broker with an access function, like bus/tests/user-principal.test.mjs:

- G1 a granted user signs in: session cookie set, `/api/config` says `user`, `GET /` is the user
  page, the chat lists reach the broker as `user:<id>`.
- G2 an ungranted `sub` is refused: a user in the file with no grant, a grant for another business,
  an expired grant, and a sub in no file; each is `subject-unknown`, no cookie, nothing bound.
- G3 revoked mid-session: sign in, then remove the grant, remove the subject, expire the grant,
  or make the loader refuse. The next chat read is 401 with a `user-revoked` log line and no
  transport call. Restoring the grant does not bring the session back, and `GET /` redirects to
  sign-in.
- G4 owner verbs: for each owner route (board reads under /api/bus/*, settings, names, instances,
  routes, agents, processing, project files, /api/bus/message, /api/board), a user session gets
  403 `owner-only` and the transport ran zero times.
- G5 the bus refusal stands alone: the same session's user transport, called directly with each
  owner verb, gets `access-refused` from the broker. The only write is the broker's own refusal
  evidence: exactly one `action.refused` event per verb, the count taken from the verb list's length
  (22 today), each body exactly `{ code: 'access-refused' }`, and every other table's row count
  unchanged (round 2; run 1 placed the round 1 "events unchanged" pin as a test defect, sage-3194).
  The broker's `#refused` (bus broker.mjs:4423) writes the code alone and no verb, so the test can't
  match each event to its verb; pinning the whole body means a field added there shows up here.
- G9 the C6 seam (sage-3153, sage-3157), with the test's userOptions built by userOptionsFor as
  cli.mjs builds them: a user session runs the chat's project list, thread create, list,
  open, send and messages. The owner transport (a recording `ownerCall`) saw only
  `['plugins', {}]`. Each chat verb went over the user transport, and `plugins` never did. A
  marker in the owner's answer appears in no response. Every owner call is exactly
  `['plugins', {}]`, and none of alice, alice-sub, the thread name, the message body, the project
  id or the thread id appears in what the owner transport received.
- G6 the notice: the user page's notice element text equals the sentence exactly.
- G7 hub label and peer links render from config: `/api/config` carries self and the peers'
  labels and origins; the user and owner pages show "This Console: hub" and an `<a>` per peer with
  the configured href and label (browser test, sso-browser.test.mjs style).
- G8 the transport: `userCall` over a recording unix socket in a scratch dir. While the child
  waits for the answer, the test reads /proc/<pid>/cmdline (argv[1] is USER_CLI), environ
  (MOSAIC_BUS_USER_NONCE set; MOSAIC_BUS_CLI_NONCE absent though the parent env passed one) and
  stat (ppid is the test process, so user-cli did not re-exec). The request line is
  `{verb, args, user: {business, user, nonce, pid}}`, which user-cli builds from
  `{business, user, verb, args}`.

packages/cli/tests/access-boot.test.mjs (sage-3142), over bootConfig and startBroker in a scratch
root, the boot config through a JSON round trip as over the host IPC:

- B1 with access.json: `access.file` and `context.peers` set; alice (home a configured peer)
  binds; bob gets `access-revoked`.
- B2 without the file: no `access` key; alice gets `access-revoked`.
- B3 with text that is not JSON, a home that is not a configured peer, and a symbolic link: the
  bus boots and alice gets `access-revoked`. The warnings are exactly one line, with
  `access-invalid`, `access-invalid` and `access-unreadable` and the path, and none quotes the
  file (a marker string in the file is absent from the line).

access-boot.test.mjs also holds the F8 peer test: a grant whose user's home is a configured peer id
validates; an unconfigured peer id refuses `home must be a configured peer`.

Old tests: the sso.test.mjs and serve tests stay as they are. If one needs a change, it goes to
Mos through Sage first (mos-1272).

## Mutants

| # | Change | Killed by | Expected |
|---|---|---|---|
| M1 | remove the `userRoute` gate call in serve.mjs | G4 (:239, first route answers 403 `access-refused`, not `owner-only`) | G4 red at :239 on its first route; G5 green in the same run |
| M2 | skip `access.check(session)` per request | G3 | red |
| M3 | change one word of the notice in user.html | G6 | red |
| M4 | `peers: []` back in accessContextFor | the F8 peer test and B1 (access-boot.test.mjs) | red |
| M5 | sign-in skips the grant test (any listed user signs in) | G2 | red |
| M6 | userCall sets MOSAIC_BUS_CLI_NONCE or runs HUMAN_CLI | G8 | red |
| M7 | bootConfig drops `access` | B1 | red |
| M8 | chat.mjs routes `thread.list` over `owner` too | G9 | red |
| M9 | accessFor drops the boot refusal line | B3 | red |
| M10 | userOptionsFor passes `owner: (v, a) => owner(v, { ...a, sub: session.sub })` | G9 | red |
| M11 | chat.mjs keeps the last request's args in `channel()` and passes them to `owner('plugins', …)` | G9 (thread create's `{project, name}` reaches owner) | red |

M1 is the brief's "owner verb still refused by the bus": with the Console gate gone, the owner
verb reaches the broker over the user transport and the broker refuses it (`access-refused`, 403).
G4 kills M1 at :239 on its first route, because it pins the Console's own code `owner-only`. The
count and "nothing written" asserts at :242-244 come after the loop, so under M1 they never run;
the run records G4's failure with the actual value (`access-refused`). The bus refusing on its own
is shown by G5, green in the same M1 run. (Corrected per Duckworth C1, duckworth-0249b; the earlier
row said G4's "refused, nothing written" stayed green, which cannot be observed under M1.)

## Run limits

Each run is `timeout -k 10 LIMIT`. TMPDIR comes from `mktemp -d /mnt/storage/scratch/tmp/gXXXXXX`. A
timeout with no failed test goes to Sage first. A timeout in the shell phase goes to Mos unplaced
(mos-1275). Under sage-3187, every LIMIT is at least 3x the longest recorded run, set before any run.
The order is the webui, cli and bus suites whole, then each scripts/test-*.sh, then the mutants.

| Run | Longest recorded | Receipt | LIMIT |
|---|---|---|---|
| webui suite | 57 s | gizmoduck queue-264 BUILD.md:474 (row 278 run 3) | 600 s |
| cli suite | 682 s | gizmoduck queue-270 BUILD.md:660 (7328da8ca) | 2100 s |
| bus suite | 25 s | gizmoduck queue-270 BUILD.md:658 | 900 s |
| scripts/test-auth.sh | 1.9 s | 3b91cfdaf:agents/gander/work/queue-253/run5-gate/SUMMARY.json | 126 s |
| scripts/test-conductor.sh | 8.1 s | same | 145 s |
| scripts/test-config.sh | 3.2 s | same | 130 s |
| scripts/test-discord.sh | 8.8 s | same | 147 s |
| scripts/test-extension-package.sh | 3.0 s | same | 130 s |
| scripts/test-foundation.sh | 49.4 s | same | 269 s |
| scripts/test-land-work.sh | 16.9 s | same | 171 s |
| scripts/test-queue.sh | 35.2 s | same | 226 s |
| scripts/test-release.sh | 12.2 s | same | 157 s |
| scripts/test-task.sh | 36.8 s | same | 231 s |
| each mutant probe (its killing file alone) | none: granted-user.test.mjs and access-boot.test.mjs are new | the first green run in the suites sets the record | 300 s |

The script limits are Gander's SHELL-LIMITS values (3x the longest recorded run, plus 120 s), as
recorded in agents/gander/work/queue-276/BUILD.md. If a new file's suite time is over 100 s, its
mutant LIMIT goes to 3x that time before the probes run.

## Review

Round 1, manifest 0b3f9c9d…94f3 (ca710eabd): Duckworth APPROVE (static), duckworth-0249b, note
agents/duckworth/work/row294/ROUND1-ca710eabd.md on duckworth/reviews 5b7089ea1. The owner-transport
exception is accepted and does not go to Mos.

- C1: the M1 row and note above are corrected. The M1 run records G4's :239 failure value and G5.
- C2: the gate runs on Sage's CLEAR.
- N1 (no test reaches the C2b swap): no M12 in this row. Adding one needs a new test and a new
  manifest round after approval; the brief does not require it. Left as a follow-up for Sage to
  place: a test that a user session's options carry no owner caller besides `plugins`, with an M12
  where serve.mjs keeps the owner's `send` for a user session.
- N2, N3: accepted as they stand; no change.
- N4: the user-bus.mjs fold-back (C7) is proposed to Sage as a queue row, for the next
  channel-proof re-pin.

Round 2 (Mos mos-1412 through Sage sage-3195; for Duckworth): two test changes after run 1, no
product change. The manifest adds packages/webui/tests/browser.test.mjs (18 paths).

- Red 1, old test, Mos approved (a): browser.test.mjs:22 pins index.html's script list. It gains
  '/federation.js' at index 2, where 294's index.html:7 puts it, ahead of brand.js. The :21 comment
  adds row 294 and federation.js. No other assertion in the file changes. Old and new lines are in
  ASSERTION-PRESERVATION.json. (b), loading the federation view another way, was rejected.
- Red 2, new test G5: the pin is the one in the G5 note above. Mos's suggestion is taken: the count
  is `refusals.length`, not a literal. The verb check is not possible, because the event names no
  verb; the test pins the whole body instead.

Round 3 (sage-3212; goes to Mos as the row's second red, sage-3211, before any push or run): one
changed line, in new test G5. Its baseline was `SELECT max(seq) n FROM events`. The G5 fixture has
an empty events table, so that is NULL and `seq > NULL` matches no row: run 2 read 0 events added
where run 1's count(*) had shown 22. The line is now `SELECT coalesce(max(seq), 0) n FROM events`.
Nothing else in G5 and no product file changes. The manifest stays 18 paths; only
granted-user.test.mjs's hash moves. My round 2 check missed the empty-table case.

Round 4 (Mos mos-1419 through Sage sage-3238, after run 3's third red): two test files, no product
file. The manifest adds packages/cli/tests/stack-release.test.mjs (19 paths).

- stack-release.test.mjs, an old test: the rehearsal fixture copies a fixed list of config.mjs's
  imports into each scratch copy. 294's config.mjs imports access.mjs, which imports transport.mjs
  (transport.mjs imports only errors.mjs). The :1991 list gains both, with a row 294 comment at
  :1987. No assertion changes. The real copy carries all of packages/cli/src (stack-copy.sh
  COPY_PATHS), so the product was not affected.
- access-boot.test.mjs, new test B1-B3: the shared helpers.mjs business sets tracker.baseUrl
  without tracker.project, so bootConfig warns about it before any access line (trackerFor runs
  before accessFor in config.mjs). A TRACKER constant holds that line. B1 and B2 pin `[TRACKER]`.
  B3 pins `[TRACKER, <the access refusal line>]`, and the secret-marker check reads every warning
  joined. boot() still records every warning. Mos chose a full pin over a filter: it also catches a
  second tracker line, a reordering, and config.mjs:102's context warning. I proposed a
  startsWith('access file') filter; Sage found it would hide that :102 warning.
- My miss: B1-B3 were new and had not run before the gate.

## Runs

### Run 1, 2026-10-23 04:57Z (sage-3187 CLEAR), head 685ff053b, manifest 0b3f9c9d…94f3

Before the run, the branch was rebased from 253346e3c onto c902a767d. `git range-diff -s` showed all 6
commits "=", and the stable patch-ids matched. The head was pushed as launchpad/row294-on-c902a767d
024499fc2. TMPDIR was under /mnt/storage/scratch/tmp. npm ci --ignore-scripts ran at the root only.

| Step | Result | Time | Limit |
|---|---|---|---|
| webui suite | 365 tests: 362 pass, 2 fail, 1 skip | 55.8 s | 600 s |

The driver stopped at the first red, so the cli, bus, scripts and mutants did not run. The slot was
returned (launchpad-0060).

- browser.test.mjs:22, an old test, pins index.html's script list. 294 adds `/federation.js` at
  index 2. It went to Mos through Sage (sage-3192); I made no change before the ruling.
- G5:262, a new test, failed `22 !== 0`: the broker writes one `action.refused` per refusal. This
  was placed as a test defect under mos-1272 and accepted by Sage (sage-3194). It is fixed in round 2.
- The skip was the editor rebuild check (editor-provenance.test.mjs:162), which needs esbuild
  0.28.2 from packages/webui's own lockfile. An environment fix: the next run also runs npm ci
  --ignore-scripts in packages/webui (sage-3194).
- The last landed whole-webui gate skipped the same test: row 264a's run, webui 345 pass of 346 with
  1 skipped, "the esbuild 0.28.1 editor rebuild" (gizmoduck queue-264 BUILD.md:516-518, DEFERRED
  264a N2). Row 270's gate ran only webui pinned-copy.test. The fresh 294 gate still runs npm ci in
  packages/webui first, so the test should run here. If it skips again, the run names it and says why.

### Run 2, 2026-10-23 05:33Z (sage-3199 CLEAR), head 66c181717, manifest 7ec7b1ea…315b

Duckworth's round 2 approve was recorded first (duckworth-0253, rev 3455, comment 31029). Drivers
and logs are in run2/. TMPDIR was under /mnt/storage/scratch/tmp.

| Step | Result | Time | Limit |
|---|---|---|---|
| npm ci --ignore-scripts, root | ok, esbuild 0.28.1 | 2.2 s | 900 s |
| npm ci --ignore-scripts, packages/webui | ok, esbuild 0.28.2 | 1.2 s | 900 s |
| webui suite | 365 tests: 364 pass, 1 fail, 0 skipped | 58.2 s | 600 s |

The driver stopped at the first red. The slot was returned (launchpad-0070), and I made no edit.

- The editor rebuild check ran and passed, and browser.test.mjs passed with the round 2 pin.
- G5:269 failed `0 !== 22`, "one event per refused verb". Every verb was still refused with
  `access-refused`. Placed as a test defect (the NULL baseline, round 3 above); as the row's
  second red it went to Mos through Sage (sage-3211) before the fix runs.

### Run 3, 2026-10-23 05:55Z (sage-3231 CLEAR), head f26584089, manifest cb1648f3…78de

Duckworth's round 3 approve was recorded first (duckworth-0255b, rev 3462, c31045). The drivers,
summary, webui log and the cli failure section are in run3/. TMPDIR was under
/mnt/storage/scratch/tmp.

| Step | Result | Time | Limit |
|---|---|---|---|
| npm ci --ignore-scripts, root | ok | 2.2 s | 900 s |
| npm ci --ignore-scripts, packages/webui | ok | 2.2 s | 900 s |
| webui suite | 365 tests: 365 pass, 0 fail, 0 skipped | 58.2 s | 600 s |
| cli suite | 909 tests: 889 pass, 20 fail, 0 skipped | 541.5 s | 2100 s |

The driver stopped at the cli suite, so the bus suite, the scripts and the mutants did not run. No
failure was compactions-launch, so the :229 rerun rule did not apply. The slot was returned
(launchpad-0076), and I made no edit before Mos's ruling (round 4 above).

- stack-release.test.mjs, 17 failures: R1-R7, R9-R12, R14, R15, row 233's --backup last test, and
  row196's rehearsal test at :2586 with its socket copy and legacy copy subtests. Each rehearsal
  failed at scratch-config: "Cannot find module …/packages/cli/src/access.mjs imported from
  …/packages/cli/src/config.mjs". My launchpad-0076 put the two subtests under row 233; they are
  row196's.
- access-boot.test.mjs B1, B2 and B3: `warnings` also held the fixture's tracker line.

### Run 4, 2026-10-23 06:20Z (sage-3244 CLEAR, sage-3248 go), head 8616b9a4f, manifest a1ff5d67…9b99

Duckworth's round 4 approve was recorded first (duckworth-0257b, rev 3469, c31053). The run started
at 06:20:53Z, on duckworth-0257b's relay of sage-3247; sage-3248 arrived seconds later with the same
go. TMPDIR was /mnt/storage/scratch/tmp/gd3JQ8r. Receipts are in run4/: summary.txt, the drivers,
suite-totals.txt (the three suites' node --test totals; the whole logs stay in scratch), every
scripts/test-*.sh log, and each mutant's diff and TAP output with mutants.json.

| Step | Result | Time | Limit |
|---|---|---|---|
| npm ci --ignore-scripts, root | ok | 1.9 s | 900 s |
| npm ci --ignore-scripts, packages/webui | ok | 0.5 s | 900 s |
| webui suite | 365 tests: 365 pass, 0 fail, 0 skipped | 57.9 s | 600 s |
| cli suite | 909 tests: 909 pass, 0 fail, 0 skipped | 600.1 s | 2100 s |
| bus suite | 873 tests: 873 pass, 0 fail, 0 skipped | 24.4 s | 900 s |
| scripts/test-auth.sh | ok, 15 passed | 0.8 s | 126 s |
| scripts/test-conductor.sh | ok | 6.8 s | 145 s |
| scripts/test-config.sh | ok | 2.5 s | 130 s |
| scripts/test-discord.sh | ok | 7.3 s | 147 s |
| scripts/test-extension-package.sh | ok | 1.2 s | 130 s |
| scripts/test-foundation.sh | ok | 39.1 s | 269 s |
| scripts/test-land-work.sh | ok | 11.8 s | 171 s |
| scripts/test-queue.sh | ok | 20.4 s | 226 s |
| scripts/test-release.sh | ok | 2.7 s | 157 s |
| scripts/test-task.sh | ok, 91 passed; the two live provider cases skip by design (row 244), no Docker group skipped | 13.9 s | 231 s |

No step was rerun, so the :229 rule was not used. The worktree was clean after the scripts and after
every mutant restore.

Mutants, each its killing file alone under timeout -k 10 300, all killed (MUTANTS rc=0, 06:34:22Z):

| # | Seconds | Red |
|---|---|---|
| M1 | 1.9 | G4 only; G5 ok in the same run |
| M2 | 2.1 | G3 |
| M3 | 1.8 | G6, and G7 (the page text changed under it) |
| M4 | 0.5 | the F8 peer test, B1 |
| M5 | 2.1 | G2, G3 |
| M6 | 2.0 | G8 |
| M7 | 0.3 | B1, B3 |
| M8 | 2.1 | G1, G9 |
| M9 | 0.4 | B3 |
| M10 | 2.0 | G9 |
| M11 | 2.0 | G9 |

M1 record (Duckworth C1): G4's first failure is its first route, `GET /api/bus/inbox: 502
{"error":"access-refused","message":"access-refused"}`, expected 403 (run4/M1.tap). The failing
assertion is granted-user.test.mjs:241, the loop's status check. The Mutants table above says :239;
round 2's `tables` helper moved it down two lines. With the Console gate gone, the broker refuses
the owner verb itself, and the Console answers 502 with the broker's code. G5, the bus refusing
every owner verb on its own, is `ok 5` in the same TAP.