stack/agents/fethry/work/queue-225/MANIFEST.r2.md

Row225 round2 — C2-10b (#1726), Dewey B1/N1 delta

Owner Fethry14f80e3c; reviewer Dewey84fb346c. New base963303403. Branch fethry/row225-r2; source candidatec010dfd85. Original fethry/row225 is untouched. This replaces the pending round1 source packet at94128f73f; old packet/evidence remain historical.

Delta for Dewey (dewey0937/0939, sage3669/4119)

• B1: renderReply recognizes the exact notice shape only when options.check is null or absent. An ordinary checked agent body shaped as a notice is whole-body free text, with no notice styling or Revert. New browser coverage for a forged delete path naming another agent's genuine commit went RED, then GREEN; genuine unchecked broker notice remains actionable. The existing renderer test “a write notice renders its fixed line” is unchanged. README documents the condition.
• N1: a coded4xx is shown as Not reverted even if sent is absent.403 owner-only is definite; 401 still signs out,503/network remain outcome-unknown and no request is retried. Separate browser case went RED then GREEN. No route, policy, broker marker or row288 dependency was added.
• Accepted residual (sage3669): pre217 history carries no check, so a notice-shaped old body still renders as a notice. Sage accepts this test-system residual with no real agent history and owns a positive broker-marker follow-up after10-27. This condition is not a positive provenance marker.
• Rebase: retained landed thread sharing/threadWrites/chatGrants, new library supporting/query/guard/ push exports, row239 transport behavior and both append-only log histories. The handoff commit's three source conflicts combine those changes with225; other package commits replay unchanged.
• channel-proof re-pin now matches merged webui bus.mjs4ebf6c2b5d71c23d85cbde83f69aa671058dc2195c9ae4bdda624f6940729d1b. Relative the new base its delta is still exactly3/1; renderer test remains exactly80/66 (mos1510). No additional existing test changes. Approved preservation conditions are in BUILD.md.

Frozen package manifest

manifest.r2.sha256 freezes exactly the13 changed package paths relative963303403; verify from repo root with sha256sum -c agents/fethry/work/queue-225/manifest.r2.sha256. The manifest's SHA256 is sent with the final pushed pin. Source remains the tested c010dfd85; later commits are evidence/records only.

The three accepted brief departures remain: chat.js/chat.css instead of bus.js/styles, libraryRevert wiring in console-bus.mjs/cli.mjs, and the bus.mjs409 map plus channel-proof pin. Serving the pure /render.mjs module to both page types remains the same. No dependency protocol constants are redefined: renderReply has no guard codes/fixed texts to import from217's reply-protocol.mjs. No generated editor file, role, policy, schema, queue-data file or live-state file is in the delta.

Verification

Root and packages/webui each used worktree-local npm ci --ignore-scripts --no-audit --no-fund. No canonical dependency link. MOSAIC_REQUIRE_EDITOR_BUILD=1; TMPDIR=/mnt/storage/scratch/tmp/rbCdM2. Every command is serial under timeout -k10, Node suites use --test-timeout=30000.

• New browser whole-file RED8/3 (B1 own assertion, one-Revert count and N1), then GREEN11/0.
• Editor build: exit0; generated editor.js/editor.css/BUILD.json match the base.
• Whole webui442/0, library149/0, bus981/0, channel-proof2/0; zero skipped/cancelled.
• All16 unique isolated mutants have clean assertion kills on c010dfd85:14 original plus B1/N1. Six initial clean kills, then M3-missing-file timed out (exit124, not counted) with an unrelated status-case after-hook failure. The intended M3 assertion also failed, but the process stayed alive. Reported to Sage as fethry0022 before any change; retried that exact mutant unchanged and ran the remaining nine. All ten completed with clean kills. No source, test or helper edit for the retry. Both attempt sets are retained;17 attempts total,16 unique clean kills,1 timeout attempt excluded. Combined receipt: evidence/r2/mutants-combined.json. All candidate hashes unchanged/restored.
• Final scratch-owned Node/Chromium sweep found zero processes; no signals needed. Dependency roots are real local directories. Receipt: evidence/r2/cleanup.json.

Exact commands/timings and raw log digests: evidence/r2/gate-summary.json and raw-provenance.json. Raw logs remain in the unique scratch root; checked-in display copies trim trailing whitespace only. No old-test failure occurred. The only unexpected later result was the recorded mutation cleanup timeout above; it was reported before an unchanged retry. No test/helper was patched around it.

Dewey's B1 review and formal record remain pending; Sage owns integration/landing and any broader scripts gate. No force push, merge, deployment, real library write/revert or release action occurred.