stack/agents/darkwing/work/queue-190/BUILD.md

Row 190: several Mosaic Stack instances on one host

Brief: docs/plans/2026-10-20_multi-instance.md, blob 4e8f1e052894 (commit 48ebee0ff, rev 2259). Gitea #1688. Owner Darkwing, reviewer Filbert, gate owner Sage. Design: DESIGN.md in this directory, revision 3 (sha256 75b21f7561cb...), approved by Filbert. Row 191 (Rocko) merge-chains on this candidate.

Round 1 is the record below up to "Follow-ups". Filbert's round 1 verdict was CHANGES (Gitea comment 29634, queue rev 2362), and "Round 2" at the end replaces round 1's Candidate and gate sections.

Files

File	What
DESIGN.md	the approved design, revision 3
build.patch	the change, git diff da230ca48 over the 24 paths below, the two new files included
candidate-manifest.sha256	one line per path
ti8/	the T-I8 one-shot: the test file (not committed), its runner, record.txt and the run logs

Base: da230ca48. Changed (22) and new (2):

• Scripts: scripts/instance.sh (new), scripts/mosaic-config.mjs, scripts/bootstrap.sh, scripts/bus-service.sh, scripts/webui-service.sh, scripts/discord-service.sh, scripts/stack-copy.sh, scripts/stack-release.sh.
• Templates: packages/cli/systemd/mosaic-bus.service.in, packages/webui/systemd/mosaic-webui.service.in, packages/discord/systemd/[email protected]. Each gains one @CONFIG_ENV@ line, and the bus template's EnvironmentFile becomes @SESSION_ENV@.
• Guard: packages/conversation/src/guard.mjs.
• Tests: packages/cli/tests/stack-instances.test.mjs (new), packages/cli/tests/stack-release.test.mjs (T55 and the stand-in), and fixture changes in packages/cli/tests/host.test.mjs, packages/webui/tests/service.test.mjs, packages/webui/tests/pinned-copy.test.mjs, packages/discord/tests/copy-service.test.mjs and scripts/test-discord.sh.
• Docs: AGENTS.md (the two lines in Mos's wording, sage-1335), docs/TOOLS.md (the --instance section, which I wrote, per sage-1335), and the three package READMEs.

The worktree's node_modules symlink is not part of the candidate.

The tests

Design test	Where	Subtests
T-I1 bootstrap	stack-instances.test.mjs	7: alpha and beta created with modes; a second run changes no byte, mode or mtime; a non-empty unmarked root refuses, worktrees included; an empty root is claimed and a lost marker refuses; a dangling symlink at the config path is never written through, named or default; bad names exit 4; --instance dev writes what no flag writes
T-I2 selection	stack-instances.test.mjs	6: the four D1 rows, a named instance with no config, and the flag through an entry point
T-I3 render	T55 in stack-release.test.mjs	each instance's own MOSAIC_CONFIG, session env and Description, nothing of the other's
T-I4 ports	T55	port-claimed for the Console port and the tester port, the default on a named port, the reserved ports, the stack-release run and --plan
T-I5 side by side	stack-instances.test.mjs	two real bus hosts at once, each answering from its own socket; stopping alpha leaves beta up
T-I6 no cross-reach	T55	alpha's activate and rollback reach nothing of beta's, then swapped
T-I7 claims	stack-instances.test.mjs (4) and T55 (1)	the mismatch in every op, D1 row 2, a default config on alpha's root, and each bad marker shape; T55 runs D1 row 2 through stack-release.sh activate
T-I8 default unchanged	ti8/ one-shot, plus the existing suites	see below
T-I9 busy scoping	T55	another instance's bus refuses nothing; this one's does
T-I10 guard	stack-instances.test.mjs	every instance's config dir and roots, a corrupt config, mosaic.bak

T-I8

The one-shot copies the fixture repository, puts the da230ca48 blob of each of the 11 changed scripts, templates and guard into the copy, removes scripts/instance.sh from it, and asserts each of the 11 now differs from the candidate's. It then runs the same 15 commands from both trees on one seeded fixture:

• bus-service.sh render with and without --pm, webui-service.sh render with and without --tester-port, discord-service.sh render, and stack-copy.sh check with and without --business;
• stack-release.sh status, four activate ... --plan forms (C1, C1 with --tester-port, C with --migrate, and B, which refuses) and rollback --plan (which refuses);
• after a real activate C1, status and rollback --plan again.

Exit code, stdout and stderr match on all 15 (ti8/record.txt holds each sha256). The one normalization replaces the base tree's path with the candidate's in the output, since each script names its own repository. discord-service.sh render runs without --copy: a copy render needs packages/discord/src/cli.mjs, which the fixture copy lacks (run 2 failed on that, ti8/run-2.log; run 3 passed, ti8/run-3.log). The checkout render goes through the same template fill. The test file is ti8/zz-ti8-oneshot.test.mjs.txt (sha256 e888e55e140a...). It is not in the candidate, because it reads da230ca48 from git and stops meaning anything once that base is old.

The default renders are also pinned by the existing fixtures: service.test.mjs and copy-service.test.mjs compare a full render with the template, now with the @CONFIG_ENV@ line deleted.

Deviations and readings

1. Names alpha and beta, not the design's a and b. The D1 rule ^[a-z][a-z0-9]{1,15}$ needs two characters or more, so a is invalid.
2. The new test file is stack-instances.test.mjs, not instances.test.mjs. It names what it tests the way stack-release.test.mjs does.
3. Existing tests changed only to keep the instance selection off ~/.config/mosaic-dev:
   • host.test.mjs: the two bus-service tests pass a scratch MOSAIC_CONFIG that does not exist, so the default names are selected as before.
   • scripts/test-discord.sh: the service-unit block exports the same kind of scratch MOSAIC_CONFIG and puts the caller's value back after it.
   • pinned-copy.test.mjs: "copy writes nothing when an archived path is missing" removed scripts/mosaic-config.mjs. The entry point now runs that file to select the instance before it copies, so the test removes packages/webui/README.md instead, a path only the copy reads.
   • service.test.mjs and copy-service.test.mjs: the expected render deletes the @CONFIG_ENV@ line.
4. T-I4: the design says a named instance with no --port, and one on 7332, refuse port-claimed. They exit 4, with needs --port and port-reserved (7330, 7332 and 7333). Both are usage errors that need no unit on disk, so I read them as exit 4 like the name errors. A port another installed Console holds is port-claimed: exit 1 from webui-service.sh, exit 3 from stack-release.sh.
5. stack-release.sh --plan now runs ports_unclaimed, so the plan lists a port-claimed refusal with the others. With no claimed port the plan text is unchanged (T-I8).
6. T-I5 checks the writer-lock pid against the broker process under the host, not the host itself. The host spawns the broker, and the broker holds bus/writer.lock.
7. The systemctl stand-in now reads drop-ins in systemd's full order: service.d, then the unit name cut after each hyphen (mosaic-.service.d, mosaic-bus-.service.d), then the template's and the unit's own .d. Before, it read only the last two. T-I6 needs the prefix directories to exist and be read.
8. The webui template still says "The unit sets no MOSAIC_*" (mosaic-webui.service.in:15). A named unit now sets MOSAIC_CONFIG. I left the comment as it is so the default render stays byte-identical; correcting it changes every default unit's bytes. Follow-up for Sage to rule on. Round 2: Sage ruled (sage-1474), see round 2's N3.
9. M11 had no killer in the first mutant list. I added the T-I1 subtest "a dangling symlink at the config path is never written through, named or default": with w instead of wx, bootstrap creates the link's target.

R3: bare default literals left in code

grep -nE 'mosaic-dev|mosaic-bus@|mosaic-webui\.service|mosaic-discord@|\$BIN/mosaic\b' over the eight changed scripts, comment lines dropped. Every hit, with the reason it stays:

Line	Literal	Why
scripts/webui-service.sh:77	mosaic-webui.service.in	the template file's path, which every instance renders from
scripts/discord-service.sh:24	[email protected]	same, for Discord
scripts/discord-service.sh:162	.../mosaic-dev/config.json	status reads the default's config only when no suffix is set; the next line takes MOSAIC_INSTANCE_CONFIG for a named instance. The base's line, kept so the default's status is unchanged
scripts/instance.sh:87	the default bus drop-in globs	the default instance's own scope, set in the one place every script reads
scripts/instance.sh:88	the default SESSION_ENV	the default's EnvironmentFile path, the base template's literal (T-I8 pins it)
scripts/instance.sh:119	the port holder's Console scan	it scans every Console unit, default and named, to find a port another instance holds
scripts/stack-copy.sh:72	file="$BIN/mosaic"	the default wrapper's path only; a named instance returns earlier through wrapper_instance
scripts/stack-copy.sh:106	mosaic-bus@*|mosaic-bus-*@*	the unit_root case matches both the default's and a named instance's bus units
scripts/stack-release.sh:1446	LIVE_CFG default	the rehearsal reads MOSAIC_CONFIG first, and instance_select exports it for a named instance (instance.sh:99), so the default path is reached only by the default instance (F9)
scripts/mosaic-config.mjs:307	DEFAULT_CONFIG root ~/.mosaic-dev	the default instance's config; a named bootstrap writes ~/.mosaic-NAME

The unit names themselves come from scripts/instance.sh:80-85, built from $MOSAIC_UNIT_SUFFIX, so they don't match the grep.

Run environment

• Every run is in the git worktree /mnt/storage/scratch/darkwing-r190 (da230ca48 plus the candidate).
• TMPDIR is /mnt/storage/scratch/tmp/dw190, 30 bytes, within the cli suite's limit (row 177).
• T-I5's longest socket path is TMPDIR + /si-XXXXXX/h/.mosaic-alpha/bus/broker.sock, 72 bytes, under the kernel's 107.
• No test reads or writes ~/.mosaic-dev, ~/.config/mosaic-dev, a live unit or a slot file. HOME is a scratch directory in every new test.

Results

Builder gate

~/darkwing-scratch/r190/gate.sh, 2026-10-20T20:07:11Z-20:17:52Z, after busy.sh was clear on two checks 20 s apart. 17 steps, each passing, counts summed by awk over the gate log:

Step	Pass	Fail
packages/cli node --test tests/*.test.mjs	501	0
packages/conversation	182	0
packages/control-board	124	0
packages/discord	183	0
packages/plugins harness.test.mjs	9	0
packages/webui service.test.mjs	31	0
packages/webui pinned-copy.test.mjs	10	0
scripts/test-auth.sh	15	0
scripts/test-conductor.sh	17	0
scripts/test-config.sh	24	0
scripts/test-discord.sh	78	0
scripts/test-extension-package.sh	18	0
scripts/test-foundation.sh	44	0
scripts/test-land-work.sh	86	0
scripts/test-queue.sh	156 node tests, 28 suite checks	0
scripts/test-release.sh	14	0
scripts/test-task.sh	98	0

The node tests total 1196 and the selftests 422. test-task's compose ran as project darkwing-r190, and the EXIT trap removed its network with no containers on it.

An earlier gate run (20:01:24Z) overlapped Launchpad's row 200 mutants, because busy.sh didn't match their directory. I killed it and threw away its results. busy.sh now matches every scratch/<seat>-r<N>/ directory.

Mutants

~/darkwing-scratch/r190/mutants.sh, 2026-10-20T20:17:53Z-20:27:16Z, after the gate in the same slot. First three controls with no change, each passing: SI (stack-instances.test.mjs), T55 (--test-name-pattern='^T55 ' on stack-release.test.mjs) and FIX (webui service.test.mjs, then discord copy-service.test.mjs).

Each mutant does the following, and the script stops at the first step that fails:

• back up the file and check the backup's sha256;
• make one exact replacement (count 1);
• run a syntax check;
• run its killers;
• put the file back and check its sha256.

Every restore matched.

#	File	Replacement	Killers run	Fail	Failing tests
M1	instance.sh	local s=""	T55	7	T-I3, T-I4, both T-I6, T-I7, T-I9
M2	instance.sh	the port holder's match line becomes :	T55	2	T-I4
M3	mosaic-config.mjs	return; at the top of checkClaim	SI, T55	7 + 2	five T-I1 and T-I7 subtests in SI; T-I7 in T55
M4	bus-service.sh	adds -e '/Environment=MOSAIC_CONFIG=/d' to the render	T55	5	T-I3, both T-I6, T-I9
M5	instance.sh	a named SESSION_ENV set to the default's path	T55	2	T-I3
M6	instance.sh	a named BUS_GLOB='mosaic-bus*@*.service'	T55	6	T-I9, and T-I3, T-I4 and both T-I6 through their seeds
M7	instance.sh	/^@CONFIG_ENV@$/d becomes s/^@CONFIG_ENV@$//	FIX	6	six webui service.test.mjs tests that compare the default render byte for byte
M8	stack-release.sh	capture copies $BIN/mosaic	T55	3	both T-I6
M9	mosaic-config.mjs	if (false) { for the mismatch	SI	3	T-I2 row 4 and the entry-point subtest
M10	mosaic-config.mjs	the name pattern allows -	SI	4	T-I1 bad names, T-I2 entry point
M11	mosaic-config.mjs	"w" instead of "wx"	SI	2	T-I1 dangling symlink
M12	guard.mjs	for (const name of [])	SI	1	T-I10
M13	mosaic-config.mjs	the no-flag branch's checkClaim dropped	SI, T55	3 + 2	T-I7's two D1 row 2 subtests and the default-on-alpha's-marker one; T-I7 in T55
M14	stack-release.sh	the capture loop adds mosaic-bus-.service.d	T55	3	both T-I6
M15	guard.mjs	the unconditional ~/.mosaic-NAME push dropped	SI	1	T-I10 (.mosaic-alpha/x under a corrupt config)

The fail counts are the runner's ℹ fail lines and include each failing test's parent. Under M4, each T-I6 subtest runs about 122 s before it fails, because without MOSAIC_CONFIG the stand-in bus waits for a host that never comes up. FIX stops at the webui file under M7, so the discord file didn't run there.

Candidate

• build.patch: sha256 6389af4fe8fb7a49ac561adb586474e8328cc401d95ae985c385ca73484bd5e4, 2611 lines. It is git diff da230ca48 over the 24 paths, with the two new files added as intent-to-add for the diff only.
• candidate-manifest.sha256: sha256 068828bcb5c75033aa441037bf3e9b84de0ac0f8a624aa0d0bc5a32fb9198901, 24 lines.
• The patch applies on da230ca48 in a fresh detached worktree, and sha256sum -c of the manifest passes there. I built both after the mutant run had ended and its restores had matched. A first build during the run held M4's bus-service.sh; I deleted it unread.
• The review candidate is commit 8862feccc9c6c96088ce934d984e00731da0b425 on local branch darkwing/row190, parent da230ca48. It is not pushed. The queue refused the manifest as a candidate, because PATH_RE (packages/queue/src/queue.mjs:37) has no @ and packages/discord/systemd/[email protected] is one of the 24 paths. Each path's blob in the commit hashes to its manifest line, with zero diff lines.

For Sage's gate

• Run the cli suite and every scripts/test-*.sh from a git worktree of 8862feccc, with TMPDIR at 30 bytes or less.
• No test pins a changed file by sha256 (grep of packages/*/tests and scripts/test-*.sh for each changed path and a 64-hex string found none).

Follow-ups

• The Console and Discord uninstall and status scans read only their own instance's drop-ins; a scan of the shared prefix directories is out of this row.
• The webui template comment (deviation 8).

Round 2

Filbert's round 1 (comment 29634): B1 blocking, N1-N7 not blocking. Sage's sage-1474 ruled N3 and left the rest to me.

B1: rebase

Row 189 (ace27dc5e) landed after da230ca48 on scripts/stack-release.sh, stack-release.test.mjs and docs/TOOLS.md. I rebased onto refactor 088087ac9 on a new local branch, darkwing/row190-r2, because #426(a) refuses a force-push to darkwing/row190. The rebased commit is ceaf93837.

• scripts/stack-release.sh: one conflict in plan(). Row 189 added echo "$SEND_PLAN" before the Console line, and row 190 added $flags to the Console and CLI lines. The resolution keeps both. $flags is set four lines above, from INSTANCE_FLAGS.
• stack-release.test.mjs merged with no conflict, but both rows had named a test T55. Row 190's is now T56 (T56 row 190: named instances side by side ...). The comment in stack-instances.test.mjs and the mutant script's killer pattern now say T56. Round 1's tables above keep the name T55, the name it had when they ran.
• docs/TOOLS.md merged with no conflict.

After the rebase, T55 (row 189, 7 subtests) and T56 (row 190, 6 subtests) passed together, 15 tests and 0 failures, before any round 2 edit.

Notes

• N1, TOOLS.md. The bus-service block and the discord-service line now show [--instance NAME]. webui-service.sh --instance NAME copy used to drop the flag without a word, while stack-copy.sh copy --instance exits 4. Now both refuse it with exit 4, because every instance shares the copies. The webui usage puts [--instance NAME] on the verbs that take it, and TOOLS.md says both copy verbs refuse it. New T-I2 subtest in stack-instances.test.mjs: "copy takes no --instance in either script". Mutant M17 below.
• N2, T-I8. Deviation 10 below.
• N3, Sage's ruling (sage-1474): the named-only sed rewrites the Console comment "The unit sets no MOSAIC_, CLAUDE, CODEX* or PI_* variable." to "The unit sets MOSAIC_CONFIG and no other MOSAIC_, CLAUDE, CODEX* or PI_* variable." The default keeps the line byte for byte. T56's T-I3 pins both. It checks the named Console render for the new line and for no "sets no MOSAIC_", and the default render for the template's line and for no MOSAIC_CONFIG. Mutants M16 and M19.
• N4, instance_port_holder reads only the unit file's ExecStart=, so a drop-in that overrides ExecStart is missed. Moot on this host (no Console drop-in sets one), so it's a follow-up.
• N5, TOOLS.md said the config directory is 0700. Bootstrap creates either directory 0700, and one that already exists keeps its mode. TOOLS.md now says that. The code is unchanged: changing the mode of a directory the user already made isn't bootstrap's job.
• N6, stack-copy.sh check --instance NAME now also needs the wrapper's line 4 to be export MOSAIC_CONFIG='<NAME's config>', as wrapper_instance writes it. If it isn't, the CLI line reads <copy> (MOSAIC_CONFIG mismatch), the same form as unit_root's (ExecStart mismatch), and check exits
  1. The new test in packages/cli/tests/stack-copy.test.mjs, "row 190 N6", covers a good wrapper, one with another instance's config and one with no config line. With the check line disabled, the test failed (exit 1); restored, it passed. Mutant M18.
• N7, discord-service.sh status for the default reads ~/.config/mosaic-dev/config.json and not MOSAIC_CONFIG. That's base behavior (R3 table, discord-service.sh:162), and D1 row 2 says MOSAIC_CONFIG alone selects that config. Follow-up for Sage, not changed here, so the default's status stays as it is.

Deviations, round 2

10. T-I8 is a one-shot, not a committed test (Filbert N2). It ran once against da230ca48 (ti8/), and no committed test compares the full default bus render with the base's. Committed tests pin the default Console and Discord renders byte for byte against their templates (service.test.mjs, copy-service.test.mjs), plus the default bus render's lines that host.test.mjs checks. I didn't rerun T-I8 on 088087ac9. Row 189 changed none of the 11 files it compares except stack-release.sh, and that change is the send: line, which shows on both sides.
11. packages/cli/tests/stack-copy.test.mjs joins the manifest for N6, so there are 25 paths.
12. Round 2 adds four mutants, M16-M19, on top of the design's M1-M15. Each one guards one of the round 2 changes.

Gate and mutants, round 2

Sage's slot sage-grant-190-r2 (sage-1478). ~/darkwing-scratch/r190/run-all.sh waited for busy.sh to be clear on two checks 20 s apart, then ran the gate and the mutants on 537a02392 in the r190 worktree.

Gate, 2026-10-20T20:56:42Z-21:07:41Z. 17 steps, each rc=0. Counts are awk sums over the gate logs:

Step	Pass	Fail
packages/cli node --test tests/*.test.mjs	511	0
packages/conversation	182	0
packages/control-board	124	0
packages/discord	183	0
packages/plugins harness.test.mjs	9	0
packages/webui service.test.mjs	31	0
packages/webui pinned-copy.test.mjs	10	0
scripts/test-auth.sh	15	0
scripts/test-conductor.sh	17	0
scripts/test-config.sh	24	0
scripts/test-discord.sh	78	0
scripts/test-extension-package.sh	18	0
scripts/test-foundation.sh	44	0
scripts/test-land-work.sh	86	0
scripts/test-queue.sh	156 node tests, 28 suite checks	0
scripts/test-release.sh	14	0
scripts/test-task.sh	98	0

The node tests total 1206 and the selftests 422. pkg-cli has 10 more than round 1: row 189's T55 (7) and round 2's N1 and N6 subtests. test-task's compose ran as project darkwing-r190, and the EXIT trap removed its network.

Mutants, 2026-10-20T21:07:42Z-21:18:02Z, with the same steps as round 1. Four controls with no change, each exit 0: SI, T56 (--test-name-pattern='^T56 ' on stack-release.test.mjs), SC (--test-name-pattern='^row 190 N6' on stack-copy.test.mjs) and FIX. Every restore matched. 19 run, 19 killed, 0 survived:

#	Killers run	Fail	Failing tests
M1	T56	7	T-I3, T-I4, both T-I6, T-I7, T-I9
M2	T56	2	T-I4
M3	SI, T56	9	T-I1 and T-I7 subtests in SI, T-I7 in T56
M4	T56	5	T-I3, both T-I6, T-I9
M5	T56	2	T-I3
M6	T56	6	T-I3, T-I4, both T-I6, T-I9
M7	FIX	6	the webui service.test.mjs tests that compare the default render byte for byte
M8	T56	3	both T-I6
M9	SI	3	T-I2 row 4 and the entry-point subtest
M10	SI	4	T-I1 bad names, T-I2 entry point
M11	SI	2	T-I1 dangling symlink
M12	SI	1	T-I10
M13	SI, T56	5	T-I7's D1 row 2 subtests, T-I7 in T56
M14	T56	3	both T-I6
M15	SI	1	T-I10
M16	T56	2	T-I3 (the named Console comment kept)
M17	SI	2	T-I2 "copy takes no --instance in either script"
M18	SC	1	row 190 N6
M19	T56	2	T-I3 (the default Console comment rewritten)

M16 drops the named sed line for the comment, M17 makes webui-service.sh copy accept --instance, M18 skips the wrapper config check in stack-copy.sh check, and M19 adds the comment rewrite to the default's sed. Fail counts are the runner's ℹ fail lines, parents included. The M3 count is 9 here against 7 + 2 in round 1 because this table sums both killers.

Candidate, round 2

• The review candidate is commit 537a02392bf5eeecf3f55dbfec5162565b786456 on darkwing/row190-r2 (pushed), parent ceaf93837, which is round 1's change rebased onto refactor 088087ac9. It's a commit, not the manifest, because PATH_RE still refuses the @ path.
• build-r2.patch: sha256 0ba1aa3ec6b466055754893c33c8934eb1323627cb4ef32b163d18b489421f8b, 2707 lines, git diff 088087ac9 537a02392 over the 25 paths.
• candidate-manifest-r2.sha256: sha256 2296e9cb130eafdd79515aec364393e1493dad81e10a2e57e4ac4ba96f024e0f, 25 lines.
• The patch applies with git apply --index on 088087ac9 in a fresh detached worktree, sha256sum -c of the manifest passes there, and each path's blob there equals its blob in 537a02392. I built both after the mutant run ended and its restores matched.
• Round 1's build.patch and candidate-manifest.sha256 stay as round 1's record.
• No test pins a changed file by sha256. The only test with a 64-hex string that names a changed file is packages/webui/tests/service.test.mjs, and its string is a fake UID (:21).

For Sage's gate: run the cli suite and every scripts/test-*.sh from a git worktree of 537a02392, with TMPDIR at 30 bytes or less.

Follow-ups, round 2

• N4: instance_port_holder and a drop-in ExecStart override.
• N7: the default discord-service.sh status and MOSAIC_CONFIG (D1 row 2).
• PATH_RE and @ paths (reported to Sage in round 1).
• Round 1's first follow-up (drop-in scans) stands. The webui template comment is settled by N3.

Round 3

Filbert's round 2 (comment 29685) had one blocking item, B1. Row 192 (4429a104f, Q175 phase 1 SSO) landed at 2026-10-20T21:21:29Z, after round 2's candidate and gate. Row 192 touches four of the 25 paths: scripts/mosaic-config.mjs, scripts/webui-service.sh, packages/webui/tests/service.test.mjs and packages/webui/README.md. Round 2's own changes needed nothing more.

B1: rebase

I rebased onto refactor 176a6bf4b on a new local branch, darkwing/row190-r3, because #426(a) refuses a force-push. The commits:

• ab1d2ee9e: round 1's change, rebased.
• cdac7ba92: round 2's change, rebased.
• df65a3d4c: round 3's only new code, the T-I3 assertion below.

I didn't run npm ci in the worktree. Its node_modules is a symlink to the canonical checkout's, which already has row 192's oauth4webapi 3.8.8. The webui suite's SSO tests passed on it in the gate.

Filbert's merge hazards, each checked on df65a3d4c:

• Row 192 makes validate and load async. Every call to load in mosaic-config.mjs is awaited: in bootstrapDefault (:350, :356, :359), bootstrapNamed (:368, :394, :398), selected (:415, :420) and loadSelected (:442). Those four functions are async now, and the command switch awaits each one (:457-483). checkClaim stays sync, and every caller passes it a dataRoot from an awaited load, so it never gets a Promise.
• The top-level try { switch ... } catch (:487-490) awaits everything inside it, so a Failure thrown from row 192's validateConsole still exits with its own code. scripts/test-config.sh proves it for the default: five bad console bodies through validate each exit 2 and name the key path. That suite has 31 checks now, up from 24 in round 2, and the 7 new ones are row 192's. No test sends a bad console through a named instance. That path is the same loadSelected to load to validate chain with instance set.
• webui-service.sh keeps row 192's --sso comment (:52), flag (:143), refusals (:221-227) and unit flag (:260), plus row 190's instance block (:86-91). USAGE has one FLAGS line: [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]]. In service.test.mjs, row 192's tests merged with round 1's @CONFIG_ENV@ line removal in the expected render, with no conflict.
• Filbert note 4. A named unit's Environment=MOSAIC_CONFIG= gives each instance its own console.sso (read through loadSystem) and its own slots (business.mjs configDir()). T56's T-I3 now renders alpha's Console with --sso and checks that the unit carries both --sso on ExecStart and alpha's MOSAIC_CONFIG line. That's 6 lines in stack-release.test.mjs. Mutant M20 below drops --sso from the named render.

Deviations, round 3

13. Filbert asked for the 19 mutants on the new base. I ran 20: M1-M19 unchanged, plus M20 for note 4's assertion.

Gate and mutants, round 3

Sage's slot (sage-1512). ~/darkwing-scratch/r190/run-all.sh waited for busy.sh to be clear on two checks 20 s apart, then ran the gate and the mutants on df65a3d4c in the r190 worktree.

Gate, 2026-10-20T21:47:27Z-21:59:13Z. 17 steps, each rc=0. Counts are awk sums over gate-r3.txt:

Step	Pass	Fail
packages/cli node --test tests/*.test.mjs	511	0
packages/conversation	182	0
packages/control-board	124	0
packages/discord	183	0
packages/business	149	0
packages/webui (whole suite)	299, 1 skipped	0
packages/plugins harness.test.mjs	9	0
scripts/test-auth.sh	15	0
scripts/test-conductor.sh	17	0
scripts/test-config.sh	31	0
scripts/test-discord.sh	78	0
scripts/test-extension-package.sh	18	0
scripts/test-foundation.sh	44	0
scripts/test-land-work.sh	86	0
scripts/test-queue.sh	156 node tests, 28 suite checks	0
scripts/test-release.sh	14	0
scripts/test-task.sh	98	0

That's 2042 passed: 1613 node tests and 429 selftests. Round 2 had 1206 and 422. This gate adds packages/business (149) and runs the whole webui suite (299) instead of its two service files (41). Those two changes account for the 407 extra node tests. The 7 extra selftests are row 192's test-config.sh checks. pkg-cli is still 511, and that includes T56's new T-I3 assertion, which sits inside an existing subtest. test-task's compose ran as project darkwing-r190, and the EXIT trap removed its network.

Row 192's re-pin activate (W5) ran at 22:02:09Z, after the gate and during the mutants. Nothing in the gate or the mutants uses the live units. M4's two T-I6 cases ran across 22:02. Each one timed out at about 122 s, against 4 s in the control. Rounds 1 and 2 show the same 122 s timeouts under M4 (mut-r1/, mut-r2/), so the mutant causes them, not the activate.

Mutants, 2026-10-20T21:59:14Z-22:09:37Z, with the same steps as round 2. The four controls (SI, T56, SC, FIX) each exited 0. Every restore matched, and the worktree ended at df65a3d4c with no changes. 20 run, 20 killed, 0 survived:

#	Killers run	Fail	Failing tests
M1	T56	7	T-I3, T-I4, both T-I6, T-I7, T-I9
M2	T56	2	T-I4
M3	SI, T56	9	T-I1 and T-I7 subtests in SI, T-I7 in T56
M4	T56	5	T-I3, both T-I6, T-I9
M5	T56	2	T-I3
M6	T56	6	T-I3, T-I4, both T-I6, T-I9
M7	FIX	6	the webui service.test.mjs tests that compare the default render byte for byte
M8	T56	3	both T-I6
M9	SI	3	T-I2 row 4 and the entry-point subtest
M10	SI	4	T-I1 bad names, T-I2 entry point
M11	SI	2	T-I1 dangling symlink
M12	SI	1	T-I10
M13	SI, T56	5	T-I7's D1 row 2 subtests, T-I7 in T56
M14	T56	3	both T-I6
M15	SI	1	T-I10
M16	T56	2	T-I3 (the named Console comment kept)
M17	SI	2	T-I2 "copy takes no --instance in either script"
M18	SC	1	row 190 N6
M19	T56	2	T-I3 (the default Console comment rewritten)
M20	T56	2	T-I3 (the named --sso render)

M1-M19 fail the same tests, with the same counts, as round 2. M20 replaces [ "$SSO" = 0 ] || flags="$flags --sso" in webui-service.sh with :, so a named --sso render loses --sso. Fail counts are the runner's ℹ fail lines, parents included.

Candidate, round 3

• The review candidate is commit df65a3d4c8fec64ba3aba20a481c244f9d73a84d on darkwing/row190-r3 (pushed), base refactor 176a6bf4b. It's a commit, not the manifest, because PATH_RE still refuses the @ path.
• build-r3.patch: sha256 efe898c2ce2de5c98cf0354746aa3b7ba8c61467499ccf67d62a9fa33a59ad04, 2713 lines, git diff 176a6bf4b df65a3d4c over the 25 paths, the same path set as round 2.
• candidate-manifest-r3.sha256: sha256 cc0ea9e8f352a4805f8cda6dae8c2401880bed32fc10f25fee4ae7091c7970af, 25 lines.
• I built both from git objects, not from the worktree the mutants edit. The patch applies with git apply --index on 176a6bf4b in a fresh detached worktree, sha256sum -c of the manifest passes there, and that tree equals df65a3d4c's.
• No test pins a changed file by sha256. Two test files with a 64-hex string name a changed path. In packages/webui/tests/service.test.mjs the string is the fake UID (:21), and in packages/queue/tests/fixtures/queue-marked.md it's an old manifest digest in history text (:119).

For Sage's gate: run the cli suite and every scripts/test-*.sh from a git worktree of df65a3d4c, with node_modules linked and TMPDIR at 30 bytes or less.

Follow-ups, round 3

Unchanged from round 2: N4 (instance_port_holder and a drop-in ExecStart), N7 (the default discord-service.sh status and MOSAIC_CONFIG), and PATH_RE with @ paths. Row 230 (C2-13a) leaves out row 190's @CONFIG_ENV@ and @SESSION_ENV@ tokens (gosalyn-0058 item 4). Whichever of the two rows lands second adds them.

Filbert approved round 3 (Gitea 29713, queue rev 2504, 2026-10-20T22:15:59Z). One more follow-up came from that review, not blocking: no test sends a bad console body through a named instance's validate.