stack/docs/plans/DEFERRED.md

Deferred list

One line per item, written from evidence, never from inertia. Add a line when a gap is found and not fixed in the current piece; strike it (move to Done at the bottom with the commit) when a piece closes it. Nothing here starts on its own; a line becomes a piece only when Jason calls it. Check it at every gate. Started 2026-09-12 during the control board MVP.

Open

• Inherited Discord engine test intermittency during #1512 review. Frozen serialized run recorded a tool-turn engine assertion failure and then timed out at 120s. A later full TAP run with a 15s test deadline passed 351/351. Rocko isolated the busy/settled-event test race and missing failure cleanup; Darkwing independently reproduced the event-split assertion. Rocko also reported a timeout-log test race and a separate engine followUp-after-timeout defect. No live incident established. Row21 owner orch-01 notified; no Discord source takeover. Not assumed identical to earlier concurrent hangs. Integration held pending owner disposition; logs and scope in agents/darkwing/work/relaunch-activity/r1-review.md. (2026-09-15) Outcome 2026-09-26: 1685deb4 fixed the busy/settled race and the engine no longer sends a follow-up (held prompts). A re-run of the frozen candidate against 21e3e908 passed the serial acceptance command 397/397 three times. Two engine failures remain when tests run concurrently, and they reproduce on clean HEAD without the #1512 files, so they are #1509's (entry below). Sage ruled that #1512 integrates on the serial evidence; it landed in af4203ca. Record: agents/darkwing/work/relaunch-activity/rerun-2026-09-26.md.

• Registration has no "set by" field. mosaic seat task records the task and updatedAt but not who set it, so a human session and the orchestrator look the same on the board. One-line record change; rides with the orchestrator assignment piece. (2026-09-12, #1504)

• Usage-limit notice was missed. Jason reports Rocko exhausted usage without Jason seeing the notice, and is now available again. Investigate where the notice appeared and what operator notification is missing as part of Claude console integration. User-reported, not independently reproduced; no root cause established. Keep outside #1512's relaunch-display scope. (2026-09-15)

• Claude Code seats register but get no board row. Rocko has no Pi session log, and rows come only from Pi logs. Needs a second row source or a Claude-side log reader. (2026-09-12, darkwing's #1504 report) 2026-09-15 #1511 live-test preflight reconfirmed no Rocko row: expected .pi/state/rocko/sessions discovery directory absent. Its existing repo registration names dead PID 185602, while the verified native lock owner is 3707667. No registration repair, discovery expansion or relaunch performed; test write refused before mutation. Evidence: agents/darkwing/work/task-attribution/backend-live-verification.json.

• Fleet seats (~/.mosaic) stay on the old launchers. No registration, no board reply, no seat task. Moving them is the stress test and comes after the WebUI and fleet launch work. (Jason, 2026-09-12)

• Comms skill has no rule for senders without a pane. The board trailer covers it today; if another pane-less sender appears, put the rule in skills/ms-communications instead of a second trailer. (2026-09-12, #1505)

• Board: multiple sessions per seat, stopping seats, auth beyond loopback. Out of scope for the MVP by the plan; listed so they are not forgotten. (plan page, Boundaries)

• MOSAIC-STACK-D-001 is Answered, not Completed. Mark --completed in jarvis-brain once Jason says the board answers "who is waiting on me". (2026-09-12)

• Uncommitted working tree. AGENTS.md autonomy section, agents/README.md Sage row, Dewey's work/wui docs and evidence, docs/plans/reviews/2026-09-08..10_*, skills/ms-{arena,blast-radius, board,executive-update,git-operations,technical-writing}. Jason's edits from before 2026-09-12; they ride along in the next commit that touches them unless staged on purpose. (2026-09-12)

• Fleet debt (orch-01, ~/.mosaic): sweep-commit.sh deny-list regex skips launch.env; needs the fix plus a regression test. (2026-09-12)

• Parked, not cancelled: Dewey D05 dashboard mockup work beyond design 3, registry increment 3 (headless identity-env leak), new seat directories. (plan page, 2026-09-12 parking note)

• Gitea helper response-file hardening. Predictable /tmp/gitea-api-response.$$ has no explicit 0600 mode; use mktemp with cleanup in a separately reviewed pass. Credential validation and later reread also have a race window. Other non-blocking ledger review notes remain in reviews/2026-09-12_ledger-verdict.md. No change beyond the reviewed GET cleanup fix in this piece. Filbert, LEDGER-1506-R1, 2026-09-12, #1506.

• One shared checkout for every seat and the coordinator. Any git add of a shared file (CURRENT.md, SESSIONS.md, the plan page) commits another seat's in-progress edit under the wrong commit; it happened at f80404f5 (dewey's CURRENT.md status note went in with the piece 5 brief, harmless but unowned). Fix candidates: per-seat worktrees, or shared files edited only by the seat named in CURRENT.md. (2026-09-12)

• Console mockup fields absent from the board API. Controller, generation, config fingerprint, turn count, goal/report and activity stream are omitted. Workspace paths are shown as board data, not invented registered workspace nodes. Launch, observe, stop, full transcript navigation, command palette and other screens are absent. Existing palette/appearance switches remain on the single page. Revisit only with a new brief. (2026-09-13 UTC, #1507)

• Board send can turn into a Pi slash command. tools/tmux send-message.sh pastes onto whatever is already in Pi's composer without clearing it. On Jason's 2026-09-26 20:10:57Z send, a leftover "/" landed in front of the agent-send header. Pi read it as plain text that time, but the same path could run a board reply as a slash command. Belongs to CHAT-03I/B3. No tools/tmux change until that piece. Found by Dewey in the CHAT-02 brief evidence. (2026-09-26, #1507)

• Discord wedge restarts have no cumulative stop. Since 6b R2, a wedged pi ends the connector with exit 1, and the unit restarts it. With turnTimeoutSeconds 600, one cycle takes at least 645 s, longer than the 600 s StartLimit window. So a pi that wedges on every prompt restarts once per prompt and never hits the limit. It only happens when someone sends a message, and that person gets an error reply. Sage accepted it for now. The fix is a separate policy (a wedge count kept across restarts). (2026-09-26, #1509, Rocko 6b R2 review)

• Connector does not journal the source it started from. The unit runs from the live checkout, so an automatic restart loads whatever Discord source is in the tree, even uncommitted source. Rocko recommends a startup journal line with HEAD, the dirty state of packages/discord and a digest of the runtime files. Until then the rule is that unreviewed Discord source stays uncommitted in the tree only as long as a review needs it. (2026-09-26, #1509)

• SetSpark service accepts any string as a decision approver. Create checks only that required_approvers are distinct non-empty strings, and approval checks discord:<author id> against them. So a decision stored with names (DEC-009) can never be approved, and nothing says so until an approval is tried. Mosaic's connector now writes only discord:<id> (20ea5a0b), but the service should refuse other shapes. This belongs to shared-signals, not Mosaic. Reported to Jason. (2026-09-26, #1509) 2026-09-26, before 21:41Z: at Jason's word, Sage sent it to the SetSpark lead (T3 thread ac03938d). The message covers validating approvers on create and update, what to do with DEC-009 and its open request 1, and a notice before any change to the approver contract. The SetSpark lead replied: they do not own it. setspark-api is built from shared-signals stack/api and runs on VM 1022, and their rules keep them out of both. Their read-only pointers: setspark_api/service.py 353 (the create and update check, using evidence() at 152) is where the discord: plus 17 to 20 digits rule and the 1 to 16 bound go, with a 422 invalid_record. add_approval compares at 645, and _discord_ids at 567 strips the prefix for the view. Stored rows such as DEC-009 need a check too. They passed the owner question and DEC-009 to Jason. No owner yet. 2026-09-26 23:13Z: Jason gave the owner choice to Sage. A Sage subagent is writing the fix, Rocko reviews it, and Sage commits it to shared-signals. The rule keeps the sanctioned pending: markers. The reasons and the DEC-009 disposition are in lead decisions item 21. Deploying to VM 1022 is still a gated host action.

• Index-export suite runs leave Docker networks behind. Each export directory becomes a compose project, and its <dir>_default network stays after the run. On 2026-09-26 the host ran out of address pools. The task and release suites then failed 31 and 3 tests with "all predefined address pools have been fully subnetted". Sage removed its own five stale networks. The dw-* ones are still there. Fix: the export recipe, or the suites, removes the project network on exit. (2026-09-26)

• Ledger T3 read: snapshot isolation has no test. readT3 runs every query in one read transaction, but no test proves a write landing during the read stays invisible. Filbert's note 4 on the Gate F build (e47ec6da). Notes 1 to 3 go to Darkwing's follow-up. (2026-09-26, #1506)

• A T3 sender role with spaces counts as human. The SetSpark lead's reply to Sage (21:41:24Z) used the role "main content-engine agent". The 6a rule requires a one-word role, so the ledger counts that message as human in Sage's row. Gate F reads only Filbert's row, so it is not affected. Filbert found it through the live diagnostic (14 went to 15). Sage asked the SetSpark lead to use a one-word role. The rule stays as it is. (2026-09-26, #1506)

• A nested node --test passes even when its tests fail. A child node --test inherits NODE_TEST_CONTEXT from its parent and exits 0 whatever its results. Darkwing found it building queue A1 and fixed that path with env -u NODE_TEST_CONTEXT, plus a test. Other suites that start node --test from inside a test run have not been checked, so they may be hiding failures. (2026-09-26, #1508)

Queue

Moved to docs/plans/QUEUE.md on 2026-09-13. This file holds only gaps.

Done

• Ledger (piece 3, #1506): shipped cd0aa5fb, Gate D written 2026-09-12 (18.9 human messages per closed issue).
• Relaunched seat shows the old last message (darkwing, Step 3 log, 2026-09-12): closed by #1512 relaunch activity, af4203ca. Filbert authored it; Darkwing and Dewey reviewed. The live board restart and Gate F remain separate.
• Sage launcher hook uncommitted (2026-09-12): closed by the agents/sage launch files commit, Dewey review R1 revise, R2 approve (agents/dewey/work/sage-launch-review-2026-09-26.md), launcher test now covers sage.
• Ledger counts T3 agent messages as human (2026-09-26, #1506): fixed in ef0020ad (Darkwing 6a, Filbert reviewed). messageKind now counts a T3 header as agent and the control-board sender as board. It changes no current count, because no source the ledger reads has a T3 header yet. That waits for the T3 thread source (Gate F).
• Control board checked the bind address but not Host or Origin (2026-09-26, #1507, found by Dewey): closed by the board guard commit. foreignRequest refuses a non-loopback Host, a wrong port, userinfo or a path in Host, and any foreign Origin on every route. Dewey authored it, and Rocko approved it (agents/rocko/work/board-guard-review-2026-09-26.md, 5a12f08e). Rocko's one low finding: URL normalization accepts a root slash, empty userinfo and an empty query in Host, so the notes' wording overstates what the raw-syntax check refuses. No bypass was found.
• Discord engine: leaked fake pi and the timeout gap in busy (2026-09-26, #1509): fixed in 3edb15eb (Darkwing 6b R2, Rocko approved, review ed5510a0). Tests stop the engine in finally. A turn pi never started now stops pi with exit 1 instead of guessing, and the unit restarts it. Known limit: see the open entry on wedge restarts.
• Combined concurrent test hangs (2026-09-14, #1509): closed on evidence from 3edb15eb. At default concurrency the union passed 406/406 three times on the R2 snapshot and 408/408 on the commit's index, where clean HEAD had hung four runs out of four. The inherited-intermittency entry from 2026-09-15 stays open until a later run shows it is the same cause.