duckworth: row 234 round 1 content (duckworth-0084) approve on Gizmoduck 861182fa6

agents/duckworth/work/row234/REVIEW-r1.md

@@ -0,0 +1,61 @@
+# Row 234 round 1, content (duckworth-0084)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in sage-1711. Request #1740 comment 29903, revs 2645-2646.
+Candidate `gizmoduck/row234` 861182fa6 on 8fede5fc6, manifest sha256
+2114a09d5a1963279f3cb37bd46bbad4d092b48499d867740b64129a928daf71 (39 lines, Gizmoduck's in-review move,
+rev 2642). Brief: `docs/plans/2026-10-20_host-credentials.md` "Machine grant row a" (blob 64451be5). Design
+r6 f9039682e, section 7 fa5658941.
+
+I rebuilt the manifest from the queue text and it has that digest. Each of the 39 digests matches its blob
+at 861182fa6, and the path set equals `git diff --name-only 8fede5fc6 861182fa6`.
+
+Per sage-1711, this note reviews content on 861182fa6. Two manifest paths have drifted on refactor since
+the base: `packages/bus/src/runtime.mjs` (row 242) and `packages/cli/README.md` (row 232). Gizmoduck
+rebases as `gizmoduck/row234-r2`. I'll check those two merges on round 2 and record the verdict there.
+
+## Verdict on content: approve
+
+My reading of the code is in duckworth-0081 (REVIEW-code-early.md, 88402c25e) and duckworth-0083
+(REVIEW-code-early-2.md, 947d9ce69). Since then:
+
+1. ad7373c1b..861182fa6 changes three files: BUILD.md, the G10 web3 row (A3b's killer, at
+   `grant-enroll.test.mjs:282-285`), and the "A22b, sage-1703" test in `grant-migration.test.mjs`.
+   - The A22b test writes two session rows at 3i, then migrates them: a `grant.host.removed` with
+     `hostLineLeft`, and a `grant.host-enroll` consume look-alike for decision d1. After the step both
+     rows are still there. `reconcileGrants` ends nothing, and `hosts.remove` still removes web1.
+   - With the actor filter gone from `GRANT_EVIDENCE`, the first row would refuse `host-line-left`, and
+     the second would make d1 look spent and unfinished. So the test pins the filter that the trigger
+     can't stand in for on pre-3j rows.
+2. The section 10 row a tests are all present. G1, G5, G6, G10, G11 (enroll), G14 to G18, G20, G21 and
+   G25 are there, along with the migration, trigger and reader-filter tests and M1 to M4. None is
+   missing.
+3. The business and cli diffs, which I hadn't read before:
+   - `business.mjs` refuses `hosts` at the top level and in a role with one message that says where the
+     key went (S1). It no longer builds `host.<id>` kinds from the file (X4).
+   - `hosts.mjs` keeps `checkAddress`, `USER`, `HOST_KEY` and `checkCommands` as exports, which the
+     enrollment raise and row b use, and drops the registry and grant parsers.
+   - `cli/src/hosts.mjs` exits 4 on usage and 2 on a bus refusal, and reads no key.
+   - `scripts/mosaic` sends `hosts` to packages/cli. That's covered at `cli/tests/hosts.test.mjs:67`.
+4. Mutants, 25/25 on Sage's slot. I read the table and the results (BUILD.md:102-131, 246-262). I didn't
+   run them.
+   - On A9, I don't want a behaviour-level mutant. Without the `hosts` primary key, `host_grants`' FK has
+     no parent key, so a store like that can't open. The behaviour the key backs is the second-enrollment
+     refusal, and A8 (`#hostRecord` in step 1) kills that by assertion in the S1 test. The A9 test
+     (`grant-enroll.test.mjs:314-323`) asserts the constraint by message, so it would also kill a variant
+     that drops the FK too. A9 is a backstop behind A8.
+5. Hash pins: `packages/*/tests/*` and `scripts/test-*.sh` have no 64-hex pin on any of the new or
+   changed grant, host or tools paths. The positive control from duckworth-0081 still holds.
+
+## Notes (no block)
+
+- N10. `cli/src/hosts.mjs` checks the verb with `shape[verb]` on a plain object. So
+  `mosaic hosts constructor web1` passes the usage check and calls `hosts.constructor`. The bus refuses an
+  unknown verb, so the result is exit 2 with the bus's code instead of exit 4 with the usage. Nothing is
+  reached, so `Object.hasOwn(shape, verb)` can wait for a later cli row.
+- N9 (from duckworth-0083) stays as BUILD.md's follow-up for the #433 VM run.
+
+## My runs
+
+At 861182fa6, singly, pass/fail: bus grant-enroll 24/0, grant-migration 6/0, host-run 24/0. My earlier
+singles at ad7373c1b (0083) and f4de24d39 (0081) cover the files that haven't changed since. I ran no
+suite and no mutant.

docs/SESSIONS.md

@@ -1437,3 +1437,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T03:44Z | Duckworth (Opus 5.5) | row 234 early code read on Gizmoduck f4de24d39 (duckworth-0081) | changes: B1 G10, B2 G18, B3 G6 withdraw/arbiter and G20 human leg untested, N1-N7 |
 2026-10-21T03:46Z | Duckworth (Opus 5.5) | row 242 round 1 on Megavolt 635c10924 (duckworth-0082) | approve, N1-N4 |
 2026-10-21T03:51Z | Duckworth (Opus 5.5) | row 234 early read follow-up on Gizmoduck ad7373c1b (duckworth-0083) | B1-B3 resolved, N8-N9 |
+2026-10-21T04:53Z | Duckworth (Opus 5.5) | row 234 r1 content review (duckworth-0084) on Gizmoduck 861182fa6, manifest 2114a09d | approve on content, N10 hosts verb check by plain-object key, A9 needs no behaviour mutant, record waits on r2 merge check |