stack/agents/rocko/work/queue-280/BUILD.md

Slim packet and full-evidence location

This packet keeps the build note, candidate manifest and patch, summaries, per-run counts/durations/exit statuses, mutant definitions and cleanup records. Raw TAP logs, per-attempt config/log trees, diagnostic byte dumps, runner scripts and transient TMPDIR notes remain only in the full packet. References below to those files resolve at the full evidence commit.

Full evidence is retained permanently at commit d6c924764d387ea320365c4bb160b4b57ed8d635 on origin/rocko/row280-da5d-20261022, under agents/rocko/work/queue-280/. Its 3,531-entry inventory SHA256 is 7d155092cb6edb547dbb7c8ba2fbabb1dd74f966c5c20965ef4fe6af2e7121b8. The full branch is retained; this slim packet does not replace its evidence. The inventory in this directory describes only this slim packet.

Sage-2541 requested this doc-only follow-up on b765f5cb8 after the green owner gate: bus 656/0/0, grant-executor 41/0/0, host-run 26/0/0 (#1785 c30431). No source or test byte changes and no additional test run.

Portability limit and carry notes

Duckworth N2: M2's demonstrated kill holds only while the host's ephemeral range has lo <= 32768 <= hi. On another range, the picker test still checks the outside-range property, but the old-picker mutant may not be killed by a fixed sample. The evidence here applies to this host's 32768-60999 range.

For the next row touching scratch-sshd.mjs, carry these non-blocking notes:

• N3: add one helper comment line naming MOSAIC_SSHD_EVIDENCE.
• N4: remove the double blank lines in both owning test files.

These are follow-ups, not changes to the tested candidate in this packet.

---

Row 280: scratch sshd owns its port

Design before code; Sage assignment sage-2530, mos-1270. Base da5d3651d75bff113b27d91abefc824c077dabbe. Claim rev 3148, rocko-280-start-r1. Reviewer Duckworth; gate owner Sage.

Proposed change

Both helpers currently return on listening(port) alone (grant-executor.test.mjs:86 and host-run.test.mjs:91). A foreign listener can satisfy that probe while our daemon fails its bind. Move only their common launch/retry/readiness loop and port selection into a shared test helper, packages/bus/tests/scratch-sshd.mjs; retain their distinct key, authorized-key and command-stub setup in their existing files.

For each of the existing five attempts, write a fresh, attempt-specific sshd log, start the child, and accept only after all three checks hold: a successful loopback connect, the exact Server listening on 127.0.0.1 port N. line from this attempt's log, and the child's exitCode/signalCode still null after the asynchronous connect. No previous attempt's log can prove a later attempt. Early exit or failed bind advances to a fresh pick; kill and await an unsuccessful child before retry. Exhaustion keeps the existing scratch sshd did not start error, never a skip. Register cleanup for the successful child as well.

Read and validate /proc/sys/net/ipv4/ip_local_port_range. Select uniformly from eligible ports 1024 through 65535 outside the inclusive range, refusing invalid input or an empty eligible set. No fixed 32768 assumption. Expose a first-attempt port override only to the regression, then use the normal picker.

In each owning file, a regression opens a plain TCP listener, supplies that occupied port for attempt one, and asserts the helper rejects it and returns a different port. The helper's log/liveness proof still governs that returned port. Register TCP listener cleanup before awaiting startup. Add a deterministic picker assertion using injected random samples spanning [0,1); every selected port must be unprivileged and outside the actual proc range. M2 restores the old picker. If the actual host range makes M2 escape this assertion, record it and ask Duckworth to adjudicate as the brief allows.

X5 closure

DEFERRED.md:311-321 binds the sleep 30 after the grant in G22/X5. Use the fixture's existing fake-command PATH: a sleep stub delegates every other argument to /usr/bin/sleep, but for 30 waits in short intervals only while its scratch directory exists. The existing sleep 30 argv, grant, sudo-log assertion and revoke assertions stay unchanged. Remote cleanup no longer leaves a 30-second child after the fixture directory is removed. Append a closing line to the DEFERRED entry; do not rewrite its history.

Evidence and slot request plan

No run before Sage CLEAR. First run the new occupied-port regressions red against the old acceptance, then green after the helper change. Run both whole files, M1 (old connect-only acceptance) and M2 (old random picker), with each killing test named. Do not classify a timeout or syntax error as an assertion kill. Save process-group timeout output and restore hashes.

After the whole-file durations are known, refine the repeat estimate. Provisional estimate: allow 60-90 minutes for both 30-run whole-file repeats under continuous CLI-suite load, with per-run counts and elapsed time saved. The load and repeats are intentional concurrency within one granted slot; all other commands stay sequential. Both files must complete all 30 without timeout, and the CLI load must remain green. Any unexpected red stops for Sage/Mos. Use a fresh short scratch TMPDIR, dead Docker socket, no live configuration, no Docker or browser, and kill owned process groups on timeout. Sweep owned node and sshd/stub processes and restore candidate hashes before returning the slot. Sage runs the whole bus suite in the owner gate.

Owned paths: the two existing test files, the shared test helper, docs/plans/DEFERRED.md, and this packet. No product change, no live action.

Phase 1 runner setup correction

The initial red-grant invocation at 07:22:02Z ran no test: packet runner parents[5] selected the scratch parent instead of the worktree. The invalid record and log stay unchanged. Sage-2534 approved parents[4], a git-root and test-file existence preflight, and a fresh CLEAR. No source or test byte changed for this correction; it is not a test red.

Accepted design conditions and first test stop

Sage-2533 and duckworth-0120 approved the design. C1 samples are [0, 0.25, 0.5, 0.6384, 0.75, 0.999999]; M2 uses rand(), never Math.random(). C2 checks attempt-zero's config names the occupied port and its log has no listening proof for that port. C3's 30/60-second stub delegates other arguments to absolute /usr/bin/sleep, so hold-add/remove's 0.05 sleeps do not recurse. The same stub covers host-run's remote long sleeps (N1). Attempt logs are sshd-N.log; exhaustion names the final log (N2).

After sage-2534's runner correction, both old-acceptance regression runs failed exactly on returned port equaling the occupied listener port. The first green regression then failed: no accepted sshd after five attempts (07:22:56Z–07:23:09Z, 12.193 s), while the picker assertion passed. The exact log comparison may be rejecting line framing, but this is only a hypothesis: fixture cleanup removed the raw attempt logs. Stopped without retry and requested diagnostic CLEAR to capture the logs before cleanup. No later whole-file run or mutant was executed. Slot returned 07:23:34Z; own cwd node/sshd sweep is empty. This evidence is not a passing gate.

Confirmed log framing and correction

Sage-2535 granted a diagnostic rerun and the conditional CR-only correction. The saved diagnostic TAP and diagnostic-bytes.json prove the occupied-port bind refusal, then four listening lines with trailing hex 0d before newline. Only the comparison changed: the exact expected line, optionally followed by one CR, is accepted. No trim or substring match is used. The temporary dump is removed. Both focused files pass 2/2 after this correction. The earlier diagnostic red is retained as build evidence, not hidden.

Phase 1 complete

Whole grant-executor: 41/41 in 20.673 s; whole host-run: 26/26 in 14.367 s. Focused regressions: 2/2 in each file. No skips or timeouts. M1 and M2 are each assertion-killed by the named regression in both files (4/4 executions, two distinct mutant sites). M2 deterministically hits 32768 at injected sample 0.6384. Source restored. Post-run pgrep finds no process naming the fixture TMPDIR; cwd node/sshd sweep is empty, proving the long-sleep stub cleanup requested in C3. Logs retain the prior invalid runner invocation and the diagnosed CRLF build failure separately.

Repeat preparation (sage-2536)

Before the repeat commit, the shared helper adds optional fixture evidence output via MOSAIC_SSHD_EVIDENCE. It saves each attempted config/log before accepting or abandoning that attempt, so test cleanup cannot erase the startup evidence. The repeat runner assigns a packet directory per run. No acceptance, picker, stub or existing assertion changes for this capture. The repeated full files verify this final committed helper.

Repeat source commit: b765f5cb81. Four-path manifest SHA256: 27806c0579c76d0999d2e6be4180c3867570df0268af9d7e0d7b971af799e6f5. All four blobs are rechecked before and after each run. No candidate bytes may change after this point.

Final committed-byte evidence

Sage-2536 granted the repeat on committed bytes, with no changes carried through the run. Source commit b765f5cb812e60789e4129ed2ab8009f5439a5be; manifest 27806c0579c76d0999d2e6be4180c3867570df0268af9d7e0d7b971af799e6f5. Repeat window: 2026-10-22T07:29:03Z to 07:48:38Z. Both whole files ran sequentially under continuous CLI-suite load, with full output, exit status, counts and durations retained per run in repeat-results.json/repeat-logs/. Each run checks HEAD and all four hashes before and after. The load is the actual complete CLI glob, not a substitute stress loop. Sage received the required 15-minute report at 07:44:01Z.

Repeat file	Whole runs	Pass	Fail	Skip	Timeout
grant-executor.test.mjs	30	1230	0	0	0
host-run.test.mjs	30	780	0	0	0
CLI load, two whole cycles	2	1588	0	0	0

Repeat assertions total 2010/2010; load assertions 1588/1588. The in-progress second CLI load was allowed to finish whole before stopping. No skips. Each repeat has a 180 s process-group timeout; each load a 900 s timeout. Neither bound fired. Attempt config/log evidence was saved before cleanup under attempt-logs///; these are generated fixture paths only.

grant-executor: seconds min 20.611, median 20.811, max 26.419.

host-run: seconds min 14.207, median 14.408, max 14.609.

cli-load: seconds min 587.109, median 587.409, max 587.709.

Sage-2537 granted final M1/M2 replays after the complete CLI load exited, because the optional attempt-log capture was added before the repeat commit. 07:48:56Z–07:48:57Z: four focused executions, all assertion kills:

Mutant	Named killer, in both owning files	Result
M1: connect-only acceptance	row 280: an occupied TCP port is attempted, refused, and retried with our sshd	Both fail returned-port inequality
M2: 20000 + Math.floor(rand() * 20000)	row 280: every injected picker sample is unprivileged and outside the ephemeral range	Both fail at sample 0.6384, port 32768

No timeout or syntax failure is counted as a kill. Phase-1 runner, table and logs remain separately recorded; final replays use the exact b765 helper. Restored-hashes.json records 4/4 with no drift. Final-sweep.json records no node, chromium or sshd under owned cwd paths and no process naming either owned TMPDIR. This also supplies C3's post-test long-sleep cleanup evidence. Slot returned at 07:49:17Z. No source byte changed during the repeat; the final mutations were restored under sage-2537. No live file, unit or config was touched. The whole bus suite remains Sage's owner gate.

Existing assertions/refusals remain unchanged (289 grant lines, 125 host lines); assertion-preservation.json records the static check. The reader search found only the intended shared-helper imports and no outside reader of either owning file. Duckworth also confirmed no owning-file hash pin. The two extra blank-line pairs are acknowledged style nits, left unchanged after the committed repeat (sage-2537).