stack/agents/sage/work/window-plan/repin-1024-draft0.md

10-24 window: re-pin 4429a104f to the row 234 landing, with the 3i-3j migration (draft 0)

Sage, 2026-10-21T01:05Z, draft 0, for mos-1145 under DECISIONS Q173. This is the skeleton. NEW isn't fixed yet, so Mos doesn't check this draft. Draft 1 names NEW and goes to Mos for the P0 check. The step layout follows repin-4429a104f.md. Steps that match are named, not copied.

Scope (mos-1145, mos-1134)

• One window carries the code of rows 190, 199 and 210, plus row 234 (row a) with its schema step 3i to 3j through activate --migrate, agent-run under Q173, backup first.
• Row a lands before the .53 and .54 installs, by 10-25 (mos-1134). If row 234 hasn't landed by 10-24 12:00Z, I ask Mos whether to run the window without it (no migration) or to move it.
• Jason has no step. Nobody acts as Jason. No pi (P19 383). No Save, no mosaic name. Nothing is pruned.
• --sso stays off. Row 200's activate --sso is in NEW as a tool. Turning it on changes who reaches the Console from outside, so that's Jason's (Q173 exclusion). It has its own window, the Q175 phase 2 window on 10-23 (mos-1148). That window runs first, so this window's OLD may be the phase 2 copy, and P1 reads it from status.

Names

• OLD, live: 4429a104f6d65ccf165f6c83b5d1dce3147dfde0, schema 3i, pointer pm: true (record 99a406ed3). P1 re-reads the activation id and the Console flags from status. I don't copy them from the last window.
• NEW: c771a36f4bd0b6c359282425c668996a90072f93, the row 234 landing (2026-10-21 06:16Z), unless Mos rules a later code landing. 194 is the open candidate. 210, 237, 232, 241, 242, 233 and 234 have landed.
• REPO, P, WIN=agents/sage/work/window-repin-<NEW12>/, SNAP: as in repin-4429a104f.md, with the sha checks at P0 and before S1, S2 and any D3.

What NEW carries over OLD (refactor c771a36f4)

git log --first-parent 4429a104f..HEAD, path-limited to packages, scripts, roles, contracts, adapters, skills and the package files:

Row	Commit	Live effect to check
201	afad4993f	business: access.json loader. Check: the live business has no access.json, and load stays LOAD_OK (P1).
204	d0bbc5c1c	business: 193a viewer level. Same check.
190	00d4cc1f6	Several instances per host. Touches stack-release.sh, webui-service.sh, bus-service.sh, stack-copy.sh. The default instance must render the same units: P2 diffs the rendered units OLD vs NEW for mosaic-stack, and any difference stops the window until it's explained.
200	9e1085816	Tool: activate --sso. Off here. --plan must show no --sso line.
199	cb5fdb064	Credential store per agent. Check: bus start with no store entries for the live agents changes nothing, and the chief's and pm's launches still pass. The P3 rehearsal covers start.
N3	390ea5261	README only.
230	c8bc5cf4c	Case 2 scripts, tools only. Not run live.
210	f5753c0e8	Host access. The live business has no hosts, so nothing is granted. Bus start runs the host-run sweep (M34d). P3 must show it removes nothing.
237	d7d943199	Publish busy check (199 N1).
232	e65a3ab4d	Installer I1: stack-release.sh --units external and stack-copy.sh copy --bundle, wrapper --create. Both are opt-in, and this window uses neither. The default units path must render the same units, so the P2 unit diff covers it with row 190. P0 checks that no window command line carries --units external.
241	5d4a61776	Test only (bus land.test.mjs). No live effect.
242	5fb736b92	Bus publish hold: after publish-timeout the bus holds the decision until its push ends, then records a late push. The live business has no publish in flight at W1, and P3 shows none open. Its follow-up fc1cb856b is comments only (git-socket.mjs).
233	57f59e0c3	Installer I3: new tool scripts/stack-upgrade.sh and a stack-release.sh change. This window doesn't run stack-upgrade.sh. The P2 unit diff covers the stack-release.sh change with rows 190 and 232.
234	c771a36f4	Machine grant row a and the 3i to 3j schema step (new tables hosts and host_grants). --plan must say migration: 3i -> 3j.
PRD 1.7+1.8	0adf8ddfe	docs/prd/mosaic-stack.md and packages/tasks/requirements.json move to version 1.8 (mos-1154, mos-1156, DECISIONS Q192). The live pm cites 1.6 until this window. Check after: the pm's requirements read answers version 1.8.

Service script drift OLD to HEAD is 415+/91- over the four scripts, mostly row 190. P5 holds them at NEW.

Backups and the migration

• W5: the stopped store backup that every activate takes (row 185), with SHA256SUMS, SCHEMA 3i and STAMP, plus the rollback set. Before --migrate writes, I check that SCHEMA reads 3i and the backup SHA256SUMS hash.
• W0b: the business file copy, as in the last window.
• Rollback after a migration isn't the plain rollback. OLD is 3i and the store is 3j, so going back needs --restore <W5 activation>, and that loses the events written after W5. The row 181 restore guard counts 11 tables, and the untimed ones need the D3 snapshot. Row 234 adds hosts and host_grants to the untimed list (T46), so at 3j the D3 snapshot covers them too. Draft 1 recounts the list from NEW. Mos decides any restore past W5, as before.
• Grant look-alikes (row 234 A22b, gizmoduck-0107). 3i-3j.sql adds events_grant_actor but doesn't check rows already in the store, so after the migration only the actor filter in GRANT_EVIDENCE (actor_role NULL, actor_run 'grant') ignores an old session-written row. P3, and again just before --migrate: on the backup copy, count the action.allowed events whose body.action or body.operation starts with grant., or whose body has hostLineLeft. Expect 0, since no grant code has run live. Any nonzero count stops the window until I've read those rows.
• P3 is the rehearsal with --migrate on a copy of the live backup. It must show the 3j step and the row counts before and after.

Row 42 (S7) interaction

Row 42's pieces may be in flight at window start (sage-1622, mos-1148 C1 and C2). W1 adds: list open pm tasks, and either pm finishes or parks them before W5, or I record which piece crosses the window. No restore while a piece has history unless the window fails.

Open before draft 1

• Q1, ruled by mos-1161: draft 1 doesn't wait for 194. NEW is the latest code landing when I cut draft 1. If 194 has landed with a green full gate (15 packages, ten script suites), NEW is the 194 landing and P3 also runs the lifecycle verbs once on the backup copy and gets one pm reply under the new roles/chief-of-staff files. A P3 failure that traces to 194 drops NEW back to c771a36f4 before anything touches live, and the window goes on. Otherwise NEW is c771a36f4 and 194 rides a later window.
• Q2, settled by mos-1148: phase 2 is its own window on 10-23. Draft 1 takes OLD and the Console flags, --sso included, from status after that window.
• Q3: who operates. If Darkwing is free, Darkwing operates and I check. Otherwise I operate as in the last window.
• The P-step evidence list for rows 199 and 210 at bus start. Both have landed (cb5fdb064, f5753c0e8), so it's due in draft 1. I take each log line and exit code from a P3 rehearsal run, not from the code.
• Rows 241 and 242 (bus): P3 shows no publish or land decision open before W5.