stack/docs/plans/DEFERRED.md

Deferred list

One line per item, written from evidence, never from inertia. Add a line when a gap is found and not fixed in the current piece; strike it (move to Done at the bottom with the commit) when a piece closes it. Nothing here starts on its own; a line becomes a piece only when Jason calls it. Check it at every gate. Started 2026-09-12 during the control board MVP.

Open

• Inherited Discord engine test intermittency during #1512 review. Frozen serialized run recorded a tool-turn engine assertion failure and then timed out at 120s. A later full TAP run with a 15s test deadline passed 351/351. Rocko isolated the busy/settled-event test race and missing failure cleanup; Darkwing independently reproduced the event-split assertion. Rocko also reported a timeout-log test race and a separate engine followUp-after-timeout defect. No live incident established. Row21 owner orch-01 notified; no Discord source takeover. Not assumed identical to earlier concurrent hangs. Integration held pending owner disposition; logs and scope in agents/darkwing/work/relaunch-activity/r1-review.md. (2026-09-15) Outcome 2026-09-26: 1685deb4 fixed the busy/settled race and the engine no longer sends a follow-up (held prompts). A re-run of the frozen candidate against 21e3e908 passed the serial acceptance command 397/397 three times. Two engine failures remain when tests run concurrently, and they reproduce on clean HEAD without the #1512 files, so they are #1509's (entry below). Sage ruled that #1512 integrates on the serial evidence; it landed in af4203ca. Record: agents/darkwing/work/relaunch-activity/rerun-2026-09-26.md.

• Registration has no "set by" field. mosaic seat task records the task and updatedAt but not who set it, so a human session and the orchestrator look the same on the board. One-line record change; rides with the orchestrator assignment piece. (2026-09-12, #1504)

• Usage-limit notice was missed. Jason reports Rocko exhausted usage without Jason seeing the notice, and is now available again. Investigate where the notice appeared and what operator notification is missing as part of Claude console integration. User-reported, not independently reproduced; no root cause established. Keep outside #1512's relaunch-display scope. (2026-09-15)

• Claude Code seats register but get no board row. Rocko has no Pi session log, and rows come only from Pi logs. Needs a second row source or a Claude-side log reader. (2026-09-12, darkwing's #1504 report) 2026-09-15 #1511 live-test preflight reconfirmed no Rocko row: expected .pi/state/rocko/sessions discovery directory absent. Its existing repo registration names dead PID 185602, while the verified native lock owner is 3707667. No registration repair, discovery expansion or relaunch performed; test write refused before mutation. Evidence: agents/darkwing/work/task-attribution/backend-live-verification.json.

• Fleet seats (~/.mosaic) stay on the old launchers. No registration, no board reply, no seat task. Moving them is the stress test and comes after the WebUI and fleet launch work. (Jason, 2026-09-12)

• Comms skill has no rule for senders without a pane. The board trailer covers it today; if another pane-less sender appears, put the rule in skills/ms-communications instead of a second trailer. (2026-09-12, #1505)

• Board: multiple sessions per seat, stopping seats, auth beyond loopback. Out of scope for the MVP by the plan; listed so they are not forgotten. (plan page, Boundaries)

• MOSAIC-STACK-D-001 is Answered, not Completed. Mark --completed in jarvis-brain once Jason says the board answers "who is waiting on me". (2026-09-12)

• Uncommitted working tree. AGENTS.md autonomy section, agents/README.md Sage row, Dewey's work/wui docs and evidence, docs/plans/reviews/2026-09-08..10_*, skills/ms-{arena,blast-radius, board,executive-update,git-operations,technical-writing}. Jason's edits from before 2026-09-12; they ride along in the next commit that touches them unless staged on purpose. (2026-09-12)

• Fleet debt (orch-01, ~/.mosaic): sweep-commit.sh deny-list regex skips launch.env; needs the fix plus a regression test. (2026-09-12)

• Parked, not cancelled: Dewey D05 dashboard mockup work beyond design 3, registry increment 3 (headless identity-env leak), new seat directories. (plan page, 2026-09-12 parking note)

• Gitea helper response-file hardening. Predictable /tmp/gitea-api-response.$$ has no explicit 0600 mode; use mktemp with cleanup in a separately reviewed pass. Credential validation and later reread also have a race window. Other non-blocking ledger review notes remain in reviews/2026-09-12_ledger-verdict.md. No change beyond the reviewed GET cleanup fix in this piece. Filbert, LEDGER-1506-R1, 2026-09-12, #1506.

• One shared checkout for every seat and the coordinator. Any git add of a shared file (CURRENT.md, SESSIONS.md, the plan page) commits another seat's in-progress edit under the wrong commit; it happened at f80404f5 (dewey's CURRENT.md status note went in with the piece 5 brief, harmless but unowned). Fix candidates: per-seat worktrees, or shared files edited only by the seat named in CURRENT.md. (2026-09-12)

• Console mockup fields absent from the board API. Controller, generation, config fingerprint, turn count, goal/report and activity stream are omitted. Workspace paths are shown as board data, not invented registered workspace nodes. Launch, observe, stop, full transcript navigation, command palette and other screens are absent. Existing palette/appearance switches remain on the single page. Revisit only with a new brief. (2026-09-13 UTC, #1507)

• Board send can turn into a Pi slash command. tools/tmux send-message.sh pastes onto whatever is already in Pi's composer without clearing it. On Jason's 2026-09-26 20:10:57Z send, a leftover "/" landed in front of the agent-send header. Pi read it as plain text that time, but the same path could run a board reply as a slash command. Belongs to CHAT-03I/B3. No tools/tmux change until that piece. Found by Dewey in the CHAT-02 brief evidence. (2026-09-26, #1507)

• Discord wedge restarts have no cumulative stop. Since 6b R2, a wedged pi ends the connector with exit 1, and the unit restarts it. With turnTimeoutSeconds 600, one cycle takes at least 645 s, longer than the 600 s StartLimit window. So a pi that wedges on every prompt restarts once per prompt and never hits the limit. It only happens when someone sends a message, and that person gets an error reply. Sage accepted it for now. The fix is a separate policy (a wedge count kept across restarts). (2026-09-26, #1509, Rocko 6b R2 review)

• Connector does not journal the source it started from. The unit runs from the live checkout, so an automatic restart loads whatever Discord source is in the tree, even uncommitted source. Rocko recommends a startup journal line with HEAD, the dirty state of packages/discord and a digest of the runtime files. Until then the rule is that unreviewed Discord source stays uncommitted in the tree only as long as a review needs it. (2026-09-26, #1509)

• Index-export suite runs leave Docker networks behind. Each export directory becomes a compose project, and its <dir>_default network stays after the run. On 2026-09-26 the host ran out of address pools. The task and release suites then failed 31 and 3 tests with "all predefined address pools have been fully subnetted". Sage removed its own five stale networks. The dw-* ones are still there. Fix: the export recipe, or the suites, removes the project network on exit. (2026-09-26) 2026-09-27: it happened again on the Piece D candidate (task 31 and release 3 failures). Sage removed 12 leftover export networks from other seats, each checked for zero attached containers first, and both suites then passed. Still open.

• Ledger T3 read: snapshot isolation has no test. readT3 runs every query in one read transaction, but no test proves a write landing during the read stays invisible. Filbert's note 4 on the Gate F build (e47ec6da). Notes 1 to 3 go to Darkwing's follow-up. (2026-09-26, #1506)

• A T3 sender role with spaces counts as human. The SetSpark lead's reply to Sage (21:41:24Z) used the role "main content-engine agent". The 6a rule requires a one-word role, so the ledger counts that message as human in Sage's row. Gate F reads only Filbert's row, so it is not affected. Filbert found it through the live diagnostic (14 went to 15). Sage asked the SetSpark lead to use a one-word role. The rule stays as it is. (2026-09-26, #1506)

• Queue tests: the cold-start failure came back (reopened). Row 33 closed this as not reproduced in 20 idle cold runs. On 2026-10-04 Sage's index export of the row 33 candidate ran the nine suites, then node --test packages/queue/tests/, and got 147 passed, 1 failed. Sage's recipe threw the output away, so again nobody knows which test failed. Ten more runs all passed 148/148: three reruns in the same export, four under parallel suite load, and three fresh exports run straight after test-queue.sh. It needs a first run on a fresh tree after a full suite pass, and even then it's rare. Darkwing's n2 on row 33 (the cold runs were idle) was right. Next time: Sage's export recipe keeps the node test output in a file, so the first failure has a name. Then fix it as its own row. (2026-10-04, #1508)

• Queue: add --issue N also sets closes to N. Follow-up rows under an umbrella issue, like rows 31 and 33 under #1508, would close the issue when they finish. Sage narrowed both by hand (revs 36 and 43). Either add takes --closes or the lead checks closes on every add. Not urgent while Sage adds the rows. (2026-10-04, #1508)

• Ledger metric call can orphan curl. The metric call in packages/ledger/src/ledger.mjs still relies on execFileSync's timeout, which kills the helper but can leave curl running. E's queue calls already use timeout -s KILL; the metric call should match. (2026-09-27, #1508)

• Ledger: a missing timeout command reads as a Gitea failure. With no timeout on PATH the queue issue calls report "credential or Gitea request failure". Optional test and clearer message. Filbert, E r2. (2026-09-27, #1508)

• review record doesn't check which issue the verdict comment is on. Row 5 round 1's request (26671) and Filbert's verdict (26683) are on #1507. Darkwing's verdict 26681 went to #1508, and review record accepted it, because only review resolve reads the comment back (checkComment in packages/queue/src/review.mjs). The receipt points at a real comment on the wrong issue. Sage posted a pointer on #1507 (comment 26685). Fix: have record check the comment's issue and author the way resolve does, or refuse a comment id it can't verify. Found by Filbert. (2026-10-04, #1508)

• Host seats launch Pi with --approve. A future .pi/SYSTEM.md or .pi/settings.json in the checkout would load in every host seat. This is latent, since neither file exists today. Fix in scripts/agent-host-dev.sh: pass --no-approve and an explicit system prompt. Filbert, meta-harness survey section 8.4. (2026-10-04)

• Workers can read provider keys. The worker container passes ZAI_API_KEY and ANTHROPIC_API_KEY in the environment, which Pi's bash inherits, and Pi's read can open the mounted auth.json. Slice 1 role tokens stay in the broker (lead decision 47). The workers' own exposure needs a separate piece. Filbert, survey section 8.6. (2026-10-04)

• CHAT-03 I1 round 2 follow-ups, for the I3 brief. Neither reviewer held any of these as blocking (Darkwing comment 26690, Filbert comment 26694 on #1507). Four of the five are closed by slice 1 S5 (see Done); this one stays open.

  • No test proves that the processes are listed only after the cgroup is frozen. The code waits for frozen 1 in cgroup.events, and both Filbert and Dewey confirmed it by reading it. Mutants r2-B5b and C4 survive. Proposed: a test-only hold after members, or a FUSE or privileged fixture. Filbert F1. (2026-10-04, #1507)

• CHAT-03 engine.envKeys accepts founder credential names. CREDENTIAL_NAME in packages/conversation/src/pi-pin.mjs matches any *_API_KEY or *_TOKEN, including GITEA_TOKEN and GH_TOKEN, which the S6 runner refuses as founder credentials (REQ-CRED-2). Nothing builds a Controller outside the tests yet. Whoever wires the entry point narrows the pattern to provider names or checks the founder list. Filbert N2 on #1522. (2026-10-10)

• test-task.sh makes a live Pi call without the Docker guard. The "user recall" block near line 478 runs run-task.sh with no availability check, so a run with Docker unavailable fails "user recall run succeeds" and "recalled user name" (26 pass, 2 fail). The other live groups skip. Rocko hit it during the S2 suites. Wrap the block in the same guard as the other live groups, so a seat without provider access gets clean skips. (2026-10-04, #1519)

• node --test <dir>/ fails on Node 24. Node 24 reads a directory argument as a module, so every package's test command in that form fails there, while Node 26 accepts it. The glob form (node --test 'packages/x/tests/*.test.mjs') works on both. Package READMEs, docs/TOOLS.md and Sage's suite recipe should use the glob form wherever Node 24 is a target. Darkwing, S1 packet. (2026-10-04, #1518)

• stack-upgrade.sh doesn't check $REPO. Nothing confirms the source checkout is root-owned or that its tree is clean before the upgrade builds from it. Filbert N2 on row 233 (29922, #1735). (2026-10-21)

• stack-upgrade.sh has no signal handling between A2 and A5. A HUP, INT or TERM in that stretch leaves the run failed closed, but recovery is by hand. A trap that writes the stop point and the recovery step to the log would make it a sheet step. Filbert N3 on row 233 (29922, #1735). (2026-10-21)

• checkCreative doesn't refuse credentials. Row 213's checkCreative (packages/business/src/role.mjs:143 at 2d2ad2760) limits a creative role's tools, authority and messaging, but a role file that gave companion or research a credential would still load. The business file could then map a credential to that instance (business.mjs:157). Nobody has traced whether a mapped credential reaches the run's environment. The decision paths stay closed (M6), but a creative role with web holding a live token is a wider channel than design 4 means. The fix: refuse any credentials in checkCreative, with a role.test.mjs case. It goes after row 213 lands, as a follow-up row or in the next row that edits role.mjs. Webby N1 on row 213 r3 (REVIEW-r3.md, 3ab3c010b), mos-1160. (2026-10-21)

• The boot host check orders only one business's bus. mosaic-hostcheck.service (row 240) has [email protected]. case2-unit.sh enables the bus as mosaic-bus@<business>.service, so on a host whose business id isn't mosaic-stack nothing orders the two. The bus can start before the boot stop runs, and after a boot-time drift role sessions can use bwrap until it does. The fix: After=mosaic-hostcheck.service in packages/cli/systemd/mosaic-bus.service.in, which orders every instance and does nothing where the unit isn't installed. It goes in before the first install whose business id isn't mosaic-stack. Filbert N1 on row 240 (29945, #1746). (2026-10-21)

• The run sheet writes the apt hook before the first --check. Section 4 installs 80mosaic-hostcheck, then runs hostcheck.sh --check. If that check fails, the next package run closes bwrap before anyone has read the failure. It fails closed, but it surprises an installer. The fix: run --check first, or say what a failure at that step means. Doc-only, for the next row that edits docs/guides/host-run-sheet.md. Filbert N2 on row 240 (29945, #1746). Filbert's N3, that a closed bwrap appends to DRIFT on every later apt run and boot, is by design; ops-01's STATE read should expect the repeats. (2026-10-21)

• The sso-config first-step hint has no business. When the target copy has no console.sso, stack-release.sh (:938) refuses with "activate $TO without --sso first, then ... activate $TO --sso". The usage line is activate ID BUSINESS (:47), so pasting either command as printed gives a usage error, not the first step. It fails safe, since the usage error changes nothing. The fix: add $BUSINESS (set at :2138) to both commands, and the business (acme) to the three expected strings in stack-release.test.mjs (:1538, :1689, :1691). For a later row that edits stack-release.sh. Webby N1 on row 238 r1 (REVIEW-r1.md, 433a95292, #1744). (2026-10-21)

• Lane image prep inspects a base that BuildKit never tagged. (N7 of the row 197 proof.) After the Compose build, scripts/testing/lane-image.mjs:41 (prepareImage) runs docker image inspect node:24-bookworm-slim to put the base digest in the receipt. BuildKit resolves the base from the registry without tagging it in the local store, so on a host without the tag the inspect throws "No such image" after a good build. That happened in Sage's proof try 1 (2026-10-21 09:03Z, run cf48efccf083). The throw fails closed: the run's terminal record is unclean, both lanes quarantine, and gate-lane.sh recover clears them. Pulling the base first fixes it, and the receipt digest then matches what the build used (91acba91 both ways). The fix: before the build, inspect the base and refuse with a named reason if it's missing, or pull it. After the build, refuse if the base digest changed. Add a test with a fake Docker that has no base tag. Kept out of row 197 r6 by Sage (sage-1883). Mos asked for this record in mos-1162. (2026-10-21)

• Case 1 acceptance script: root parses with the node it's checking, and the header says less than root does. (Duckworth N1-N3 on the row 195 manifest, REVIEW-m1 6afcee2a5.) N1: F9 runs $ROOT$NODE as root (scripts/case1-accept.sh:298) before F10 checks that --node is the /opt/mosaic-stack/node-<pin> path (:303-304). On a host installed as designed, case2-unit.sh:128-133 refused a non-root-owned --node and the args file is root's, so no escalation path exists today. Run F9's parse through AS_USER, or apply F10's path check first. N2: the header (:10) and the TOOLS.md entry say root only reads, but root also runs curl (F2), sudo -l (P1, P3), the jarvis probe (P9), hostcheck.sh --check and systemctl. Doc-only. N3: F6's prefix match (:261) accepts a --claude with .. after claude-<pin>/. That claude runs only as mosaic, and F10 uses equality. Darkwing has a follow-up on darkwing/row195-n1 1e3c4767c, not yet run; it gets its own row now that 195 has landed (b65014647), Duckworth reviews. (2026-10-21)

• Morgana's row 213 mutation set: the B3 pattern no longer matches bundle.mjs. (Webby N3 on row 221 round 1, REVIEW-r1 a0a00630e.) Row 221's candidate changes packages/harness/src/bundle.mjs, and the B3 anchor at Morgana's 213 mutants.py:48 stops matching on that base. This matters only if someone reruns that set. Fix the anchor in that tooling before any rerun, and check that a stale anchor refuses instead of skipping the mutant (sage-1941). (2026-10-21)

• Grant executor test X5 starts a sleep 30 that can outlive its test. (Webby N1 on row 248 r1, webby-0080; deferred by Duckworth in the row 249 review, REVIEW-r1 28174fe08, #1751 comment 30070.) The test at packages/bus/tests/grant-executor.test.mjs:989 (:934 before row 249) runs sleep 30 on the sshd side, where an abort doesn't reach it. Fix it with a stub that exits once its test dir is gone, as row 248 did for the hold stubs, or with a shorter sleep. This binds the next row that touches that test file. Until then, a lane cleanup that runs after this file waits 30 s before it calls a lone sleep 30 a leak. The row 197 lanes scan only at lane end, about 15 minutes after pkg-bus, so they can't see it (mos-1169). (2026-10-21) Closing note, row 280 (2026-10-22): both scratch sshd fixtures install a bounded 30/60-second sleep stub that exits when its test directory is gone; other sleep arguments exec /usr/bin/sleep unchanged. Evidence is recorded in agents/rocko/work/queue-280/BUILD.md.

• Row 66 live checks: the unslop notice on a live managed session, both harnesses. (mos-1186, Vikunja #454.) Row 66's gate asked for one landing session per harness with a prompt that draws a known tell. Mos changed that gate. The Claude Code session ran before landing on a scratch root from the candidate tree (run r4ab24630d323, landed 2c38325ec). Pi ran launch only there (run r1dd94171bede): this host has no credential pi reads until P19 #383 settles. Two live checks remain. Claude Code: in the first re-pin whose tree includes row 66, backup first (Q173). Pi: one full session with a tell after #383. Each attaches the operator note on the RESULT, the next-turn correction and the unslop.jsonl counts. (2026-10-21)

• Console tester listener: testerNoSignIn is a dead parameter. (Duckworth N2 on the row 196 manifest, REVIEW-m1; carried as C1 in REVIEW-m2 cdbf7b64e, #1694 comment 30156.) Row 196 landed 7247d80c7 with the parameter and its comment still at serve.mjs:472-475 and passed from webui/src/cli.mjs:109 and sso.test.mjs:392. Nothing in serve.mjs reads it after the destructure. Remove it, or wire it with a test. This binds the next row that touches packages/webui/src/serve.mjs. (2026-10-21)

• Console library routes: the tester listener and library.sync. (Duckworth N5 on row 196 round 2, REVIEW-m2 cdbf7b64e.) At 7247d80c7 startServer (serve.mjs:475) takes none of libraryFile, libraryStatus or librarySync, so the callbacks cli.mjs passes do nothing yet. The row that adds the Console library routes decides whether the tester listener gets library.sync. Duckworth's view is that it shouldn't, because sync is a human write. (2026-10-21)

• Console library routes: four library codes still map to 502. (Dewey N2 on the row 254 manifest, #1759 comment 30173.) Row 254 gave six library codes a STATUS entry in packages/webui/src/bus.mjs. library-mapping-invalid, library-remote-invalid, library-state-invalid and library-git still fall through busStatus to 502. The row that adds the Console library routes decides their statuses and gives its humanCall for library.sync a timeout over 130 seconds. (2026-10-21)

• T27 sweep test leaves two sleep 60 children running. (Darkwing row 251 slot, darkwing-0113 and darkwing-0117; Dewey on r2, comment 30168.) The sweep test spawns two detached shells, planted at host-run.test.mjs:528 and decoy at :536, each running sleep 60; : with the run dir as $0. sweepRunDir kills the planted shell by pid (host-run.mjs:238), and t.after kills only the decoy shell. Neither kill reaches the sleep child, so each one lives for up to 60 s after the test and trips any busy check that follows. The fix is to kill the process group in both t.after hooks: process.kill(-pid, 'SIGKILL'). Each shell is spawned detached, so it leads its own group. exec sleep 60 doesn't work. The sweep matches the run dir in /proc/<pid>/cmdline (host-run.mjs:236), and exec drops the $0 that carries it, so the planted process would survive and the "planted process killed" assert would fail. This binds the next row that touches packages/bus/tests/host-run.test.mjs. (2026-10-21)

• Real-model suite cases run outside the gate. Row 244 moved test-task.sh fork recall (M11) and user recall (M16) behind MOSAIC_LIVE_PROVIDER=1, and test-release.sh activations to the mock adapter. Before any re-pin whose tree changes packages/harness or the session fork code (scripts/mosaic-task.mjs session and sessionForkFrom handling, the pi adapter), an operator runs MOSAIC_LIVE_PROVIDER=1 bash scripts/test-task.sh with the real pi credential and a real release.sh activate, and records both results on the re-pin row. Morgana's wording (row 244 BUILD.md), Webby N2 on row 244 r1 (#1757). (2026-10-21)

• Creative instances: the human can't delete one. (Sage's ruling sage-2164 on the row 194 b4 rebase, #1692.) Row 213 put the creative definitions in END_PROTECTED, and row 194's deleteRefusal (instance-settings.mjs) refuses END_PROTECTED for every actor, so the human can't delete a companion instance and fire refuses one too. The Agents page hides Delete on the listing's endProtected. The fix threads the actor through deleteRefusal and the launcher's delete pass, so the human may delete one and the tester may not (creativeHumanOnly). Until then, the human can delist (instances.set launch: false) but neither fire nor delete removes a creative entry (sage-2166). The row covers fire and delete together; Sage files it. (2026-10-21) Closed for delete by row 256 (#1761, REQ-COS-3): deleteRefusal takes the actor, so the human deletes a creative instance and any other actor is refused organization-creative-human-only, and the listing's endProtected is the same check for its reader. Fire still refuses every END_PROTECTED instance, by the row 256 brief's ruling, not by a code change. (2026-10-22)

• A fire stuck between step A and step B has no human escape. (Webby N4 on row 194 b5, webby-0094; Sage's ruling sage-2241, #1692.) The broker's chief fire records fire.stopped at step A, and #firing refuses every launch and take of the instance until a fire.done. The events are in the store, so a bus restart doesn't clear them. Row 194 b6 runs the writer's checks against the file before step A (instance.fireCheck), so a keep the bus hasn't loaded no longer strands an instance. A step B that keeps refusing still does: a credential revoke that fails every time, or a file a human changed between the check and the write. Each repeat fire runs step A again and refuses at B. The fix is a human verb, never an agent one, that records the end of the firing (a fire.done, or a new fire.abandoned that #firing also counts) with a reason. Its test: a fire whose step B refuses leaves the instance instance-firing, the verb as the chief or the tester refuses, and the verb as the human clears it so the instance launches again. (2026-10-21)

• A fire's done with more than 64 stops refuses, and nothing flags a run left alive. (Webby N2 on row 194 b8 r2, webby-0100; Sage's ruling sage-2290, #1692.) lifecycleDone caps stops at 64 and refuses invalid-request above it (broker.mjs). The launcher's fireStop has already signalled every run through stopRun by then, so the killed runs are dead. But the refused done writes no lifecycle.end.killed or lifecycle.end.alive event and no lifecycle.done, and the end request stays taken. A run the stop left alive, or couldn't confirm (unknown), gets no Console flag. The fire itself is unaffected, because fire.stopped and fire.done are written at the verb. No MVP instance comes near 64 runs. The follow-up row either raises the cap or splits the done. Its test: a fire's done over the cap refuses, and the runs it left alive still get the alive flag. (2026-10-22)

• The runs suite doesn't gate a change to scripts/mosaic-task.mjs. (Dewey N7 on row 191, repeated on the Vikunja 502 review.) packages/runs/tests/task-cli.test.mjs spawns scripts/mosaic-task.mjs, but row 191's gate didn't run the runs suite. test-task.sh covers the same list and show paths, so nothing is known broken. Binds the next row that changes scripts/mosaic-task.mjs: its gate runs the runs suite whole. (2026-10-22)

• Row 277's M8 is killed by a rethrown error, not an assertion. (Duckworth N1 on the row 277 manifest round, duckworth-0127.) M8 makes the thread.claims catch in packages/cli/src/cli.mjs rethrow. The stubbed processing-halted error then escapes main and fails packages/cli/tests/tester.test.mjs:149. That counts as a kill, but no test pins that main resolves on that path. Binds the next row that changes packages/cli/tests/tester.test.mjs: add the resolve pin so M8 dies on an assertion. (2026-10-22)

• Row 274's user reply check is scoped to the thread, not the session. (Row 264a r6, sage-2591.) In packages/bus/src/broker.mjs, the check that a run answers a user only in reply to that user's message in its thread joins message_threads by thread. That holds while a user's thread has only its default session: a user can't call session.create, and #thread refuses anyone but the owner. Binds row 272 (264e, #1777), or any row that lets a user add sessions: make the check session-scoped and test it with two sessions. (2026-10-22)

• Row 281's refusal texts point the wrong way. (Dewey N1 and N2 on the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage sage-2653.) N1: when a host decision is still open and the host is removed, step G's fire or delete job refuses host-unknown, and the inbox hint names a verb that can't help. The way out is to decline or withdraw the decision (packages/bus/src/broker.mjs, the closed check near :1684 and decision.withdraw near :5015). T14 now pins that path. N2: the chief's fire tool text in packages/harness/src/tools.mjs (near :186) doesn't say the fire's job can come back for an answer. Neither changes behaviour. Binds the next row that changes the step G hint text in broker.mjs or the fire tool text in tools.mjs: fix both wording gaps and pin the hint in a test. (2026-10-22)

• Row 264a's refusal check in sessions.test doesn't pin the actor. (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.) refusedOnce in packages/bus/tests/sessions.test.mjs checks that each refused call adds one action.refused event with code not-holder, but not that the event's actor_run is the refused run. Binds row 269 (264b, #1774), or the next row that changes sessions.test.mjs: pin actor_run in refusedOnce. (2026-10-22) Closed by row 269 (264b, #1774): refusedOnce selects actor_run and expects the refused run's name (mos-1292). (2026-10-22)

• editor-provenance skips its rebuild check on esbuild 0.28.1. (Duckworth N2 on the row 264a manifest round, duckworth-0146.) The webui test "rebuilding from the source gives the same bytes" needs esbuild 0.28.2, the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file is at base and was not in 264a's manifest. Binds the next gate that touches the webui build: install the pinned esbuild in the gate checkout so the check runs, or record why it can't. (2026-10-22)

• The case supervisor reports a fast child as an inner-session failure. (Row 253 N1, mos-1297 item 5.) A child that exits before the supervisor verifies its session is reaped first, so the supervisor exits 85 (inner-session) instead of the child's own code. Mos measured rc85 in 39 of 40 fast-child bash runs. It fails closed, so it is not a 10-27 defect; row 253 fixed only its own fixture (PYTHON_STUB execs python3). The product fix is Vikunja 532, after 10-27. (2026-10-22)

• boardSend /api/seen returns 400 for a scan failure after writeMark. (Webby N2 on row 198, ruled sage-2867.) The mark is written, then the rescan fails, and the client gets 400 as if its request were bad. Webby suggests 500. It does not hold the 198 gate; binds the next row that touches serve.mjs. (2026-10-22)

• Stale "row 203" text in the access command. (Quackerjack, row 203 BUILD.md follow-up.) packages/cli/src/access.mjs lines 26-27, its help string at line 36 and line 44, and packages/cli/README.md line 1107 say peer homes stay unread "until row 203" adds the federation key. Row 203 changes only scripts/mosaic-config.mjs and test-config.sh, so once it lands those lines point at a row that did not do the work. Binds the next row that edits access.mjs. (2026-10-22)

• A remote outage can make the first library lookup outlast the tool timeout. (Row 224 residual, sage-2819.) In each 60 s window the first lookup still runs an inline fetch, and that fetch can take longer than the 60 s tool timeout. Bound the inline fetch in a later row. (2026-10-22)

• A sharee's session.list stays refused. (Row 206, sage-2818, Q7.) Whichever of row 193's session wiring or the share wiring lands second wires it. (2026-10-22)

Queue

Moved to docs/plans/QUEUE.md on 2026-09-13. This file holds only gaps.

Done

• Ledger (piece 3, #1506): shipped cd0aa5fb, Gate D written 2026-09-12 (18.9 human messages per closed issue).
• Relaunched seat shows the old last message (darkwing, Step 3 log, 2026-09-12): closed by #1512 relaunch activity, af4203ca. Filbert authored it; Darkwing and Dewey reviewed. The live board restart and Gate F remain separate.
• Sage launcher hook uncommitted (2026-09-12): closed by the agents/sage launch files commit, Dewey review R1 revise, R2 approve (agents/dewey/work/sage-launch-review-2026-09-26.md), launcher test now covers sage.
• Ledger counts T3 agent messages as human (2026-09-26, #1506): fixed in ef0020ad (Darkwing 6a, Filbert reviewed). messageKind now counts a T3 header as agent and the control-board sender as board. It changes no current count, because no source the ledger reads has a T3 header yet. That waits for the T3 thread source (Gate F).
• Control board checked the bind address but not Host or Origin (2026-09-26, #1507, found by Dewey): closed by the board guard commit. foreignRequest refuses a non-loopback Host, a wrong port, userinfo or a path in Host, and any foreign Origin on every route. Dewey authored it, and Rocko approved it (agents/rocko/work/board-guard-review-2026-09-26.md, 5a12f08e). Rocko's one low finding: URL normalization accepts a root slash, empty userinfo and an empty query in Host, so the notes' wording overstates what the raw-syntax check refuses. No bypass was found.
• Discord engine: leaked fake pi and the timeout gap in busy (2026-09-26, #1509): fixed in 3edb15eb (Darkwing 6b R2, Rocko approved, review ed5510a0). Tests stop the engine in finally. A turn pi never started now stops pi with exit 1 instead of guessing, and the unit restarts it. Known limit: see the open entry on wedge restarts.
• Combined concurrent test hangs (2026-09-14, #1509): closed on evidence from 3edb15eb. At default concurrency the union passed 406/406 three times on the R2 snapshot and 408/408 on the commit's index, where clean HEAD had hung four runs out of four. The inherited-intermittency entry from 2026-09-15 stays open until a later run shows it is the same cause.
• A nested node --test passes even when its tests fail (2026-09-26, #1508): closed. Queue A1 (34a72af9) clears NODE_TEST_CONTEXT on its own path. N13 fixes test-foundation.sh and test-discord.sh, each with a check that fails the suite if the clearing is lost. Darkwing wrote it (n13.patch 00868b2f) and Filbert approved it (e464be6c). Sage's grep on 2026-09-27 finds no other nested node --test: in scripts, only the two suites, test-queue.sh and queue-commit.sh, and in JS, only the queue test that covers the fix.
• SetSpark service accepted any string as a decision approver (2026-09-26, #1509): closed. Fixed in shared-signals cc74d92 (Rocko approved R2, lead decision 24). The operations seat (T3 12fe8cda) deployed it to VM 1022 at 00:23Z on 2026-09-27. The running service.py hash matches cc74d92, and /healthz returns 200 inside the network and through the public tunnel. The read-only README survey found one row breaking the rule (DEC-009, Proposed, version 1), one open request that isn't ready (DEC-009's), and no Accepted decision with more than 16 approvers. No rows changed. DEC-009 stays as stored (lead decisions 21 and 28). The service now refuses approvals on it, so nothing can go wrong silently. Side effect: up -d also recreated caddy, about 20 s of edge downtime for all hosts. That is for the shared-signals deploy procedure to fix, not Mosaic.
• Queue suite failed its live checks outside the canonical checkout (2026-09-27, #1508): closed by Piece D, f539466f. test-queue.sh now skips verify and render --check with a printed reason when the toplevel isn't the recorded canonicalRoot. An index export passed 27/0, and the canonical checkout 29/0.
• Queue: an owner listed as a reviewer blocked the row (2026-09-27, #1508): closed by row 31, bb2fa970. add, set reviewers and assign now refuse the owner as a reviewer with exit 2 and write nothing. Rocko built it in the Gate G run, and Filbert approved round 1 (#1508 comment 26629, 8 of 8 mutants caught).
• Queue follow-ups from rows 12, 13 and 31 (2026-10-04, #1508): closed by row 33, 6fb50cc0. Filbert built it, and Darkwing approved round 1 (#1508 comment 26651).
  • genesis refuses a map row whose owner is one of its reviewers (exit 2, nothing written). The check is on the map, not in replay, so a log from before the rule still loads.
  • The assign refusal now reads "can't assign row N to SEAT: SEAT is one of its reviewers".
  • queue-commit.sh compares HEAD with H before each canary and again if the clean run fails. A moved HEAD exits 2 with "HEAD moved since H was recorded"; the guard message is kept for a real guard failure.
  • Every time and date the validator accepts must format back to itself, so month 13, day 32, 2026-02-30, 2027-02-29 and 24:00 are refused. The live log at rev 45 still replays.
  • The cold-start failure (2026-09-27): not reproduced in 20 cold runs. Each ran node --test packages/queue/tests/ in a fresh tree, 10 shared clones and 10 exports, one after another. All 20 passed 148/148 (2960 of 2960). The 300 ms deadline test is unchanged. Counts: agents/filbert/work/queue-33/cold-runs.txt.
• CHAT-03 I1 round 2 follow-ups (2026-10-04, #1507): four of five closed by slice 1 S5 (row 40, #1522; Dewey authored, Darkwing and Filbert reviewing). The commit is named in the row's review record when it lands.
  • Engine command and preArgs: engine takes only extraArgs, cwd and envKeys. The controller always launches the pinned Pi and checks that at construction and at bind. The fake engine comes in through a symbol key that JSON config can't carry (N24b).
  • Engine environment: an explicit list (ENGINE_ENV in pi-pin.mjs) plus *_API_KEY and *_TOKEN names from engine.envKeys. Nothing else is inherited. HOME passes, so Pi reads ~/.pi/agent unless PI_CODING_AGENT_DIR is set (Darkwing F3).
  • escalating is cleared when the force-stop fence throws (Darkwing F2, races.test.mjs).
  • Takeover then Enter in one chunk: input after Ctrl-T or Ctrl-O waits for that action, in the same chunk or a later one, and also while an earlier action is still pending, so it is judged as if typed one key at a time (Filbert F2; Darkwing and Filbert T1 on #1522; flows.test.mjs). The frozen-cgroup test (Filbert F1) stays open above.
• Gate runs mount the host's pi auth file (Webby N4 on the row 197 proof driver, 059577886): closed by row 244 (#1757), landing e69260a3c. The suites and the lane's cleanEnv export a 0600 fixture PI_AUTH_FILE, guardDocker refuses a Compose run without one, and packages/cli/tests/gate-lane-auth.test.mjs proves no gate step mounts the host default. The real-model cases this moved off the gate are open above.
• A fired or deleted instance kept its grants (2026-10-22, Dewey on the row 236 rebase look, mos-1271): closed by row 281 (#1786), landing e479521d3. A fire or a delete now runs a step G job that revokes every host and Gitea grant the instance holds, fail closed, and tells the human in the inbox when it can't. Megavolt built it; Dewey approved the design (d6) and the manifest (c30614). The text gaps it left are open above.

Row253 F5: legacy Case AS_USER supervision

Tracked as row 276, Gitea #1781 (sage-2331), owner Gander, reviewer Duckworth, after row253. Brief: docs/plans/2026-10-22_case-sudo-legacy-followup.md, “Brief: supervised legacy AS_USER calls”.

case1-accept.sh's legacy timeout330 around AS_USER talk and its AS_USER precheck, Claude version, PM launches and Node version diagnostics predate the new socket metadata/probe helpers. sudo's pty monitor can move them to a separate session; the old outer timeout does not prove their descendants are killed. The C4 repair in row253 covers only its new config query and peer probe. These legacy paths need the reviewed supervisor or a header explicitly explaining why each remains unsupervised. The follow-up must preserve the 300-second talk/reply contract, concurrent F5 scan, diagnostics and secret-output refusals, with fake-only session-hop tests and Sage's slot. No host or live unit change is authorized.

Row 276 / #1781 also owns the case1 root-side capture/tools mutant counterparts (duckworth-0112 N1) and documenting the setuid-member cleanup refusal in the headers (N2). A member that changes uid and cannot be killed causes inner-cleanup refusal, never successful observation. N4 is addressed in row253 by allowing SID confirmation until the existing inner watchdog expires, instead of a separate 200 ms scheduling margin.

Row276 candidate closure of Row253 F5

Effective when row276 / #1781 lands after Duckworth review and Sage's gate: all five legacy Case1 calls (F3 talk, F4 precheck, F6 Claude version, F7 PM launches, F10 Node version) use row253's byte-identical after-uid supervisor and their own independent outer bound. No named AS_USER exception remains. Talk retains --wait300 and concurrent F5 observation; stdout and stderr remain separate, with root retaining only stderr's last65536bytes. A trailer can choose only a failure display number, never success. Supervisor0 alone permits pass.

Row253 N1 closure: row276's M10 checks case1's root-owned/non-writable tool fence through both capture and legacy paths; M11 checks case1's root-side capture byte limit. Each must be killed in the accepted gate. Row253 N2 closure: both case-script headers explicitly state that a uid-changing member which cannot be killed causes inner-cleanup refusal, never successful observation.

The hostile same-uid setsid-away or killed/stalled-supervisor residual remains as row253 R3. This closes none of that boundary. Instant command exit before SID confirmation remains the fail-closed residual tracked as Vikunja532 (mos-1297); row276 does not change the pinned payload.

Row276 mos-1337 A5: Case1 cmdline redirection ordering

Open follow-up: scripts/case1-accept.sh:413 (at candidate3c4c463da) uses tr < "$ROOT/proc/$c/cmdline" 2>/dev/null outside the supervisor. A vanished entry can print an open diagnostic before stderr is redirected. mos-1337 explicitly excludes this path from row276; it remains unchanged. The row276 supervisor repair closes only row253 N5 inside stat_fields.

Row276 mos-1345 R3 residual remains open: a same-uid process that escapes the session, or a stalled supervisor in that session, can retain descriptors to the private stdout/stderr spool after root unlinks it and keep growing the unlinked file. The outer bound releases the caller because no residual holds its capture pipe. Row276 adds no disk cap and no cross-session kill; this is not a cleanup or closure claim.

Row207 N1: "refuses at any business" has no test

Open follow-up (duckworth-0230 N1, sage-3043). Row 207 (#1705) lands on 9bb406c6c without a test that mosaic access user remove refuses while the user holds a grant at any business, not only the named one. A mutant adding && g.business === business survives T4: checkAccess still refuses at exit 3, so nothing is written, but the reason and exit code are wrong. The next row that touches packages/cli/tests/access.test.mjs adds one T4 case with the grant at a second business and a mutant that the case kills. N2 (parse ignores stray flags) is pre-existing in grant and revoke and stays out of scope.

Row270 N6: ledger growth and the whole-file read on session.list

Open follow-up (duckworth-0228 N6), bound to row 272 (264e, #1777). Row 270 caps what the bus reads per compaction collection (compactionReadBytes, default 64 MiB) but an agent can still grow a session's compaction ledger by about 231 KB per collection, and session.list reads the whole file. Row 272 bounds the ledger or the read on session.list, with a test and a mutant, or records why the cap is enough.

Row219 N1: the thread list and header don't show the persona label (U6)

Open follow-up (dewey-0913 N1). Row 219 (#1720, C2-09a) lands on 5fdfd7275 with UI items U1-U5. The Create picker labels each instance with its persona name and instance key. U6 is deferred: the thread list and the thread header still show only the instance key (agents/rocko/work/queue-219/BUILD.md:81). The next row that touches the Console thread list (packages/webui/src/public/chat.js) shows the persona label there and in the header, with a chat-browser test and a mutant that the test kills.

Row295 N1: a revoked run's late bus call exits 22, not stopped

Open follow-up (morgana-0167, sage-3318, sage-3360), to become a row. Row 295 (#1801) lands on 2efd127ce. Revocation ends a user's thread claim in one transaction, and the launcher then sends SIGTERM. A run that calls the bus between the claim end and the SIGTERM gets not-holder and exits 22, so its record reads error rather than stopped. Row 302's launcher-released answer covers only threadIdle and landRelease. The row gives a revoked claim the same shape: calls that need the claim answer thread-revoked until the run ends, and the runner maps that answer to stopped. It needs a forcing test that holds the window open and a mutant the test kills. Brief: docs/plans/2026-10-23_gate-env-rows.md; owner Morgana, reviewer Dewey, after row 272.

Row272 N1: users can't reach session verbs

Open follow-up (Huey's BUILD.md, sage-3357), to become a row. Row 272 (#1777) lands the session CLI and the Console chooser for owners. USER_VERBS still leaves out the session verbs, and no transport carries a user's session operation. A granted user's Console therefore falls back to the thread default when session.list answers access-refused on a route with no session named. A session link with an explicit session still refuses, and the session controls stay hidden. The row that adds user session grants (193/T5) adds the verbs to USER_VERBS under a grant check, and adds a test that a granted user lists, opens and clears only sessions on threads the grant covers. It removes the fallback once the grant exists.

Row270 N6 rebound: the ledger and the session.list read are still unbounded after 272

Row 272 (#1777) lands without bounding the compaction ledger or the whole-file read on session.list, and it records no reason the 64 MiB collection cap is enough. N6 above stays open. It moves to the row after 307 (#1814, Vikunja 598), because 307 reshapes the compaction reading in packages/seat/src/compactions.mjs and both rows would edit readLedger. That row bounds the ledger or the read, with a test and a mutant, or records why the cap is enough.

Row307 N1: row 270's store-unreadable doesn't stick

Duckworth, row 307 build round 1 (duckworth-0285, note d43690d0b). When a collection finds an unreadable session store header, it writes store-unreadable. The cursor then moves past the bad header, so the next collection never checks it again and the count reads as known with 0. The row 307 ledger test pins this behavior as it stands, so the move didn't change it. Bound to a follow-up row on row 270's store-unreadable path. The fix keeps the unreadable state until the header reads clean, or re-checks the header on every collection. Either way it's an old-test change and goes to Mos.

Row306 N1: the revoke Set doesn't survive a broker restart

Morgana, row 306 BUILD.md (#1813, landed 2d0318a44; Dewey agrees, dewey-0918). #accessRevoked lives in memory. After a broker restart, recover() rebinds an earlier host's run, and if that run makes a bus call before the launcher's SIGTERM, it answers not-holder and the run exits 22, as every revoked run did before 306. Seeding the Set at a rebind needs a mark only #revokeLost writes; reason and by on the ended claim aren't one (design D1's alternative). Bound to the next row that changes the broker's recover() path.

Row306 N2: a pending limit stop answers before the revoke

Morgana, row 306 BUILD.md (#1813, landed 2d0318a44). A revoked run that also has a pending limit stop gets #limitStop's not-holder on message.receive and state, because that check runs before #agent. It's rare and the run still stops. Bound to the next row that changes #limitStop or the order of those checks.

Row226 N1: the install id regex is narrower than ID_PATTERN

Webby, row 226 round 1 (webby-0225, #1727, landed 661890e90). case2-install.sh:56 refuses a business id with . or _, which ID_PATTERN (vocabulary.mjs:199) and case2-precheck.sh:67 accept. Gosalyn confirmed it isn't deliberate (gosalyn-0208). It fails closed, so a real id with either character is refused, not mishandled. Bound to the next row that changes case2-install.sh: take the ID_PATTERN set, and add a test.

Row226 N2: a first-run validate refusal leaves personas and the slot dir

Webby, row 226 round 1 (webby-0225). After a validate refusal on a first run, the staged personas and the empty token slot dir stay behind, and a re-run counts them as present. Bound to the same follow-up as N1: remove what this run created, as the business file path already does (install.sh:198/:202/:218).

Row226 N3: the run sheet doesn't pin the clone to the copy's sha

Webby, row 226 round 1 (webby-0225). install.sh:217 validates with the checkout's scripts/mosaic, not the copy's, and host-run-sheet.md:237 never says the clone must be at <sha>. Bound to the same follow-up: a HEAD check in the install or one clause on the run sheet.

Row226 N4: --library-status refuses after a 5 s lock wait

Webby, row 226 round 1 (webby-0225). If the bus holds the library lock for more than 5 s, case2-precheck.sh --library-status refuses with ERROR library-sync-busy. A re-run clears it. Recorded as a known operator step, no fix bound.

Row283 N1: SURVEY-RUN.md shows the scopes line without supporting

Webby, row 283 round 1 (webby-0267, #1788, review note queue-283/REVIEW-manifest-b2a1f4092.md on webby/reviews c6ea27aab). docs/case2/SURVEY-RUN.md:96 documents the --mapping line as scopes canon .., playground .., unmapped ..; indexed .., which predates the supporting scope 283 adds. Nothing reads the file (decision 137). Bound to the next docs commit that touches SURVEY-RUN.md: add the supporting count to that line.

ops-0275 O2 and O3: triage, no row

Sage, for Mos's mos-1549 (433 factory on 1013, ops-0275). Neither is a defect, so neither gets a row.

O2, bus status shows writer.lock pid 4174 while the unit's host pid is 4078. By design. scripts/mosaic execs node (scripts/mosaic:44), so the unit's MainPID is the bus host. The host forks the broker (packages/cli/src/host.mjs:1, :215), and the broker's Store writes its own process.pid into <dataRoot>/bus/writer.lock (packages/bus/src/store.mjs). The lock holder is the host's child. The status line's liveness check (packages/cli/src/cli.mjs:612) reported it running, so it isn't stale. If an operator note is wanted, the next row that edits bus status output can name the broker pid as the host's child; nothing binds it now.

O3, the copy's npm step warns that @google/genai, esbuild and protobufjs have install scripts outside allowScripts. scripts/stack-copy.sh:74 runs npm ci --no-audit --no-fund. On npm 12.0.2 (dragon-lin) dependency install scripts are blocked by default: npm skips any dependency script with no allowScripts entry and lists the skipped packages at the end (npm help install-scripts). So the copy skips all three. The 433 factory passed on that copy, and the landing gates (webui included) pass with the same skip. Recommendation: refuse, not allow. An explicit false entry for each in package.json allowScripts makes the tested behavior the written policy and drops the warning (npm help config, strict-allow-scripts: explicit denials are always skipped silently). That edits package.json, so it waits for the next reviewed row that touches package.json; bound there.

ops-0282 B2-2: the run sheet doesn't state the Console proof file format

Sage, for Mos's mos-1557 (433 Run B P1 at 3569bf54f). docs/guides/host-run-sheet.md:321, the .54 library table, gives the Console proof file's mode (0600 or 0400) and owner but not its format. The Console reads one base64url line of at least 32 characters, [A-Za-z0-9_-] only (packages/webui/src/serve.mjs:264), and exits 2 at start otherwise (:267). case2-unit.sh doesn't open the file, so a short or malformed proof fails only at Console start. That's what stopped Run B P1 (B2-1, ops-01's 24-byte fixture). Fix: add the format to the File cell of that row. Doc only, no test reads it; bound to the next doc row that edits the run sheet.

Row 323: revoke-window hides a socket-path refusal as a 20-second "no RESULT"

Sage, for Mos's mos-1560/mos-1561. packages/cli/tests/revoke-window.test.mjs failed on every commit in Goldie's environment (base dd6cb5872 included) and passed in Sage's. The cause is TMPDIR length, not Codex. The test's root is $TMPDIR/mosaic-revoke-window-XXXXXX, and a run's tools.sock sits at <root>/data/launches/acme/r<12 hex>/tools.sock. newRun refuses past 107 bytes (packages/seat/src/session.mjs:278). Measured lengths: .../tmp/sageXXXXXX (35 bytes) gives 107 and passes, .../tmp/goldieXXXXXX (37 bytes) gives 109 and fails. Sage reproduced it with a 37-byte TMPDIR: 0/1 after 20235 ms, the same "no RESULT". The test passes log: () => {} to the launcher, so the refusal never shows. The guard is right. The test is the weak part: its prefix leaves no margin, and a launch refusal reads as a timeout. Fix: shorten the prefix and fail on a launch-failed log line instead of waiting 20 s. That's an old-test change, so it needs Mos's go (mos-1272). Bound to the next row that edits revoke-window.test.mjs. Until then, docs/plans/BRIEF-TEMPLATE.md's Gate section sets TMPDIR to mktemp -d /mnt/storage/scratch/tmp/XXXXXX.

ops-0282 B2-2 closed by row 326

Sage. Row 326 (#1822) landed in f58049de0 (33f49f7d5). docs/guides/host-run-sheet.md now gives the Console proof file format in the .54 library table, so the B2-2 entry above is closed. Row226 N1-N4 stay open.

Row 208 N1: user.js re-renders every 5 seconds

Sage, for Duckworth's N1 on row 208 (c31496, landed f58049de0). packages/webui/src/public/user.js:16 re-renders the user view on a 5 s timer while the tab is visible, whether or not anything changed. That's a steady client and server load per open tab, not a correctness or guard issue. Fix: render on change, or poll the bus only for a change marker. Bound to the next row that edits user.js.

Row 329 N2: mosaic proxy fetch has no agent or human guard

Sage, for Dewey's round 1 N2 on row 329 (c31639, landing deferral per c31643). mosaic proxy fetch downloads the pinned CLIProxyAPI archive from GitHub and writes <dataRoot>/opt/cliproxyapi/ for any caller that has the instance config. P1's brief didn't ask for a guard. The fetch is pinned and sha256-checked against packages/model-proxy/PIN, so the risk is an unasked network fetch and a disk write, not a wrong binary. Bound to row 331 (P2): P2 decides whether fetch needs the human or agent guard its key verbs get, and records the choice in its BUILD.md. If P2 leaves it, P7 decides before cutover.

Row 329 R2-N1: the management-key rule lives in three places

Sage, for Dewey's round 2 R2-N1 on row 329 (c31643). Round 2 tightened the key rule to /^[\x21-\x7e]{1,4096}$/ in packages/model-proxy/src/common.mjs:33, which initializeProxy enforces, but packages/bus/src/broker.mjs:4827 and packages/cli/src/model-proxy.mjs:57 still use the round 1 predicate. A Latin-1 or edge-space key gets past both and is refused at init with proxy-key-invalid, before any write, but only after both prompts and a bus round trip. Fix: export one predicate from the model-proxy package and use it in all three places, with a test at each caller. Bound to row 331 (P2), which edits the broker's proxy verbs.

Row 329 N1: the 127.0.0.1 bind isn't observed on the real binary

Sage, for Dewey's round 1 N1 on row 329 (c31639). The acceptance netns had only lo, so P1 writes server.host: 127.0.0.1 and management.allow-remote: false but never saw the real binary refuse a non-loopback client. Bound to P7: at cutover, with Jason present, confirm the listener is on 127.0.0.1 only (ss -ltnp), and record it in P7's receipt.

Row 284 N1: library.get lists the whole served tree per read

Sage, for Webby's round 1 N1 on row 284 (c31654 carries it forward). Each library get runs listTree (git ls-tree -r -l) over the whole served tree to find one blob oid. On a large library that is one full tree listing per read. git rev-parse <commit>:<path>, or a per-commit cache, would avoid it. Not a correctness issue. Bound to the next row that edits the library read path; that row measures a get on a library of realistic size and records the choice in its BUILD.md.

Row 284 N1: Vikunja task

Sage, for mos-1647 item 3 (Q109). The row 284 N1 entry above is tracked as Vikunja 634. No open task covered the library read path.

Row 332 finding: CLIProxyAPI startup version refreshes reach outside the host

Sage, for Fethry's row 332 isolated runs (2026-10-24, pinned 8.0.42, unshare -rn with only lo). At startup the binary tried https://registry.npmjs.org/@xai-official/grok/latest (xai_version.go:96, blocked by the namespace) and then started a 3-hour Grok CLI version refresh and a 3-hour antigravity version refresh. The proxy kept serving with its fallback version. Evidence: origin/fethry/row332-p1 agents/fethry/work/queue-332/BUILD.md:251-252 and evidence/offline.txt. Bound to P7: before or at cutover, find a config switch that turns these off and set it in P1's initial config with a test, or decide on purpose to allow or block that egress and record it in P7's receipt. Tracked as Vikunja 633 (umbrella 237).

Row 331: human-only per-agent model rotation override — P7

Sage ruling sage-4388 (2026-10-24) limits P2 to the 30-day model-key rotation default, with no setter and no proxy.rotate --agent --rotate-by verb. A human-only per-agent rotation override is bound to P7, with Jason's cutover/settings review. It must preserve D20/Q222: no agent or tester can change the period. Row 331 ships only the default and the approved proxy.json grace/first-output settings.