stack/agents/launchpad/work/queue-300/BUILD.md

Row 300 build notes (Launchpad): R6-N1, an HTTP-level test of the user-session option swap (#1807)

Brief: docs/plans/2026-10-23_r6-followup-rows.md § Brief: R6-N1. Reviewer Duckworth, gate owner Sage. Base c13c337e1 (refactor, after row 294 landed at d3059c2c3). Branch launchpad/row300.

Change

Tests only. One new file, packages/webui/tests/user-option-swap.test.mjs. No product change and no existing assertion or fixture touched.

• Gate stubbed open. The file registers an in-thread load hook (registerHooks, as thread-claims.test and library-cli.test do through --import) keyed on the one URL serve.mjs?gate=open. On that URL alone it prepends return true; to userRoute's body, then imports startServer from it. Every other import of serve.mjs, and every relative import inside the copy, is the real module. If the gate's signature line is not in serve.mjs exactly once, the hook throws. A renamed gate then fails loudly, instead of quietly testing the closed gate. The test also asserts that the copy's userRoute answers true for POST /api/bus/message.
• Setup. This is granted-user.test.mjs's setup, cut to what the test needs: the fake OP, the in-process broker for demo, createSso with the access hook, and userOptionsFor over alice's transport. Every owner option is a stub that records its own name. The owner transport records ['transport', verb, args]. One list, owner, holds both kinds of owner call.
• Positive control. The owner signs in and posts /api/bus/message. Exactly ['option', 'send'] must be recorded, so the route reaches send and the count works.
• The check. Alice signs in and walks G4's owner routes, copied, plus two chat reads. No answer may say owner-only, so the gate really is open. After each route, every owner record must be ['transport', 'plugins', {}], the read mos-1394 allowed. The message route must reach the user transport (message.send), and every transport opened is alice's.

Why a new file: granted-user.test.mjs's setup imports startServer statically. Passing the gate-open copy into it would change that fixture, and a fixture change goes to Mos. The route list and setup are copied, with a comment naming their source.

Mutant

M12: serve.mjs:689 drops send from the user-session destructure, so a user session keeps the owner's send. Killed when "R6-N1" reports not ok. Expected failure: on POST /api/bus/message, the owner record holds ['option', 'send']. run1/mutants.py applies it (anchor exactly once), runs the new file alone, restores with git checkout and checks the tree is clean.

Gate

Duckworth approves the manifest. On Sage's CLEAR: run1/gate.sh does npm ci (root and webui), the new file whole, the webui suite whole, then M12. Logs go to /mnt/storage/scratch/launchpad-r300/run1, outside the tree. Not run yet.

MANIFEST.sha256 lists the one new path.

Run 1 (sage-3408 CLEAR, 12:05Z)

npm ci root and webui were green. The new file was red on its first run (mos-1272, placed by me): TypeError: Cannot read properties of undefined (reading 'set-cookie') in signIn. When I cut down granted-user.test.mjs's call, I dropped headers: res.headers from what it resolves, so the sign-in found no cookies. The fix puts headers back, the same as granted-user.test.mjs:40. No assertion changed. The new file then passed alone (1/0). The fix is a new commit, and the manifest is re-hashed. The gate resumes at new-file on the new head.

Run 1 resumed (TAG -r2) on db5122920, manifest db8be52ce895603e687985acfae29e53e3e8782ae945c3cded6cca36141bfa3b:

• new file whole: 1 pass, 0 fail.
• webui suite whole: 375 pass, 0 fail, 0 skipped, 0 cancelled, 58.2 s (limit 600).
• M12 killed. "R6-N1" reports not ok at :151: POST /api/bus/message: ["option","send"], where ["transport","plugins",{}] is expected. The restore left the tree clean.

Duckworth N1 (duckworth-0263, non-blocking): the setup passes no upstream, so the swap's upstream = null has no recorder here. The test proves the swap for the options it stubs. It proves nothing about upstream.