stack/agents/sage/work/window-plan/repin-4429a104f.md

Re-pin 490e2771d to 4429a104f (row 192, Q175 phase 1), with npm ci in the new copy

Sage, 2026-10-20, draft 1, for mos-1099 item 3 under DECISIONS Q173. Mos checks this file at its commit before P0. Any change to this file or to NEW after the check means Mos checks again (mos-0849/0850).

This is a smaller window than repin-rows-177-185.md (draft 2, which Mos checked in mos-0929). Where a step is the same, this file names that file's step and says what differs. The 7332 matrix, the snapshot, the W9 list and the rollback compare are reused unchanged.

Who, and what nobody does

• Sage operates, as the tester. Darkwing holds the gate lane for row 190 round 3 tonight, so I take the operator seat. Mos verifies each step's output before the next one and runs rehearse (P3), which reads the live config and a live backup (docs/TOOLS.md rehearse: Jason or Mos runs it).
• Jason has no step. Q173 covers a re-pin of this test system with a backup first and a STATE report after. Nothing is pruned.
• Nobody acts as Jason: no --by jason, no human shell or tmux pane, every bus read and write carries --tester, and no request carries jason.woltje. bus.tester stays as it is; if it isn't true, stop at P1.
• No pi (mos-0865 D2, P19 #383). No Save in the human Console, no mosaic name.
• Outside reach doesn't change. The Console keeps its current flags. --sso stays off: row 192's sign-in code is dormant without the flag, and cli.mjs:57 refuses --sso with the preview flags the pointer carries anyway. The proof pair stays unset. The tunnel still forwards 7332 only (P4 and W10 check it).

Names

• OLD, live: 490e2771d3d057ab76991e2c7859cd251857e64c, activation 20261020T192956Z-490e2771d3d0, pointer pm: true, schema 3i, Console --port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username --allow-user jason.woltje --tester-port 7333 (no --send, read from stack-release.sh status between 21:36Z and 21:39Z).
• NEW: 4429a104f6d65ccf165f6c83b5d1dce3147dfde0, row 192's landing, 103 commits past OLD (git rev-list --count 490e2771d..4429a104f). The 106 that status showed is OLD to HEAD 305857c8f, so it also counts the three record commits below. The commits after it (5b8def2f1 plans, 176a6bf4b sessions, 305857c8f queue) are records and don't move NEW. If another code row lands before W0 (row 190 is the likely one), NEW stays here unless Mos rules otherwise.
• REPO: the canonical checkout. activate runs REPO's webui-service.sh, so the four service scripts are held at NEW for the window (P5).
• P=/mnt/storage/scratch/sage-pin-de352dfaf (business-check.mjs, console-check.sh, checked against agents/sage/work/window-plan/repin-de352dfaf/SCRIPTS.sha256).
• WIN=agents/sage/work/window-repin-4429a104f/, where every transcript goes.
• SNAP=$WIN/snapshot.mjs, a copy of agents/darkwing/work/window-rows-177-185/snapshot.mjs, sha256 639fd28a2674aaa03ce824e3394b4052f21cdef7d6fa49bae61a9927ed341e67 (mos-0899). I check the sha before S1, S2 and any D3.

What NEW carries over OLD

The path-limited log over packages, scripts, roles, contracts, adapters, skills and the package files:

Row	Commit	Live effect
186	269134d8d	Tool only: the activate plan's backup line says what the run will do.
187	9a71e4e80	Tool: activate sets, carries and drops the proof pair. The pointer has no pair, so nothing changes.
188	8fc0ee216	Tool: proof file checks on a carried pair. No pair, no effect.
163	8ecc7a239	Tool: rehearse, which P3 uses, and bus start --no-launch. CLI cli.mjs and launcher.mjs gain the --no-launch path; the default start is unchanged.
189	ace27dc5e	Tool: activate --no-send. Live already runs without --send; the pointer carries that.
192	4429a104f	Console --sso (off here), scripts/mosaic-config.mjs load becomes async, webui-service.sh renders --sso only when given, and a new dependency, oauth4webapi 3.8.8. cli.mjs imports sso.mjs at the top, so the Console won't start from a copy without that module.

No schema step: SCHEMA_VERSION (packages/bus/src/store.mjs:17) is 3i at OLD and NEW, and no migration was added. --plan must say migration: none. No roles, skills, contracts, adapters or plug-in kinds changed. So: no harness set, no skill carry, no pm-on. One activate --pm.

npm ci in the new copy

mos-1099 asks for npm ci in the new copy. stack-copy.sh copy already does it: it extracts the archive to a temp dir, refuses without package.json and package-lock.json (:55), runs npm ci --no-audit --no-fund there and writes no copy if it fails (:56). W0 checks the result: node_modules/oauth4webapi/package.json in the copy reads 3.8.8, and node --input-type=module -e "await import('oauth4webapi')" from the copy exits 0. The live copy is 163M; /home has 30G free (94% used), enough for one more.

Backups

Before	Backup	Taken by
W5	the stopped store, $DATA/backups/stack/<W5 activation id>/ with SHA256SUMS, DATA_ROOT, SCHEMA 3i, STAMP	stack-release.sh (row 185: every activate)
W5	the rollback set (units, wrapper, pointer)	stack-release.sh
W9	the business file, cp -p to ~/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-<stamp> with its sha256, as evidence nothing wrote it	Sage, in W0b

Before the window (nothing stopped)

#	Who	Step
P0	Mos	The $P sha check, as in the 177-185 plan P0.
P1	Sage	The business file, read only, the same values as the 177-185 plan P1. I report its sha256 now rather than assume the 06:15Z value. business-check.mjs for OLD now and for NEW after W0: LOAD_OK both.
W0	Sage	cd $REPO && scripts/stack-copy.sh copy $NEW, in a gap between gate-lane runs, since npm ci is heavy. Then the two npm checks above, and diff <(git -C $REPO show $NEW:package-lock.json) $COPIES/$NEW/package-lock.json empty. W0 writes only under copies/ and changes nothing live, so it moves before P2 and P3, which need the copy.
P2	Sage	console-check.sh $NEW against a stub Console of NEW on a scratch port, once without and once with --tester-port on a second scratch port. CONSOLE_PASS both.
P3	Mos	scripts/stack-release.sh rehearse $NEW mosaic-stack --backup 20261020T192956Z-490e2771d3d0 --port <scratch>. It must pass every gate check but the PM's. It stops no unit and writes no pointer. Transcript in $WIN/p3/. Correction (mos-1107): rehearse starts NEW's Console with only --port and --business, not the pointer's flags. So Mos also starts NEW's Console by hand with the pointer's flags on two scratch ports and reads healthz and /api/config on both, then stops it ($WIN/p3/flags-check.txt, flags-console.log).
P4	Sage	The tunnel read, as in the 177-185 plan P4.
P5	Sage	git -C $REPO diff --quiet $NEW HEAD -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh and an empty git status --porcelain on the same four. Row 190 round 3 touches webui-service.sh; if it lands before W5, P5 fails and the window waits for Mos's ruling.
P6	Sage	The 7332 matrix (a)-(g) on OLD, as in the 177-185 plan, saved as $WIN/matrix-old.txt.

The window

#	Who	Step
W0b	Sage	The business file copy.
W1	Sage	Idle check (mosaic agents --business mosaic-stack --tester, mosaic launches list), the start stamp from date -u, then S1 node $SNAP --store "$DATA/bus/bus.sqlite" --held.
W2	Sage	stack-release.sh status mosaic-stack: pointer on OLD, pm: true, 3i, last line ok, unit flags match.
W3	Sage	stack-release.sh activate $NEW mosaic-stack --pm --plan. Must show from OLD to NEW, migration: none, the backup line, and the Console line with OLD's flags exactly: no --send, no --sso, no proof pair, --tester-port 7333. Any other difference stops here.
W4	Sage	The unit reads, as in the 177-185 plan W4.
W5	Sage, on Mos's go	stack-release.sh activate $NEW mosaic-stack --pm. Exit 0, result ok, every gate check including pm_launched. Record the activation id, the backup path and STAMP, and the backup SHA256SUMS sha256. Then status.
W9	Sage, after Mos verifies W5	The 177-185 plan's W9 list unchanged, the chief turn and the one assistant thread turn included (mos-0929 Q3), plus two lines: the webui journal since the W5 stamp (with UTC) has one Proxy: proxy proof off and no Sign-in: line, and ls -l /proc/<Console pid>/cwd names the NEW copy.
W10	Sage	The browser check on 127.0.0.1:7333 and the matrix again as $WIN/matrix-new.txt, identical to matrix-old.txt. Then P4 again. Corrections after the window (mos-1135, mos-1137): the matrix line for a file the pin changes isn't "identical". Line (g) serves index.html, which row 192 grows by 121 bytes (6470 to 6591), so (g) is 200 non-json at 6575 bytes, not 6454. The two browser checks come from the 177-185 window, before row 192 and before a second thread project. "Only tester forms" now allows #sign-out while it is hidden and /api/config has no sso: true. "Chat lists the W9 thread" now reads every .chat-projects section.panel list (chat.js:93 renders one per project), not the first.
W11	Sage	STATE report in $WIN/STATE.md, posted on P19 386 and P19 412 and on Gitea #1690.

Stop conditions and rollback

The same as the 177-185 plan. Two failures in one window: stop and report (mos-0823).

Rollback: stack-release.sh rollback mosaic-stack --plan, then the real run. The previous distinct copy in the log is 490e2771d, both are 3i, so no --restore and no data loss. OLD takes the same Console flags. The R1 and R1post compares are as in the 177-185 plan. A restore past W5 follows that plan's D3 steps, with Mos deciding.

Keep every copy. Prune nothing.

Questions for the plan check

• Q1: NEW is row 192 alone, not bundled with row 190. Row 190 (several instances) changes stack-release.sh and webui-service.sh and deserves its own window. I recommend running this one first.
• Q2: Sage operates instead of Darkwing, who is on the row 190 gate. OK?
• Q3: W0 before P2 and P3. It writes a copy only. OK?

What Sage ran for this plan

Read only, 2026-10-20 between 21:36Z and 21:39Z (clock read 21:39:50Z at the commit): stack-release.sh status mosaic-stack (pointer, last five log lines, unit flags match, 106 commits of drift), git rev-list --count, SCHEMA_VERSION at both ends, the path-limited log, git diff --stat on the service scripts, CLI and config loader, stack-copy.sh:23-56, webui/src/cli.mjs:15-120, docs/TOOLS.md on rehearse, du -sh of the live copy and df -h /home. Nothing live was changed.