Console granted-user sign-in, a user-cli transport per session, the per-request grant re-read, the owner-only gate and user page, the notice, the hub label and peer links, accessContextFor peers, and the bus boot access wiring (sage-3142). Tests G1-G8 and B1-B3 are written and not yet run; runs wait for Sage's CLEAR. Choices C1-C9 in agents/launchpad/work/queue-294/BUILD.md.