row 245: the N1-N3 notes move to the row 245 packet; DESIGN.md:336-338 recorded as superseded by gosalyn-0087, unedited (sage-1877, #1693)

agents/darkwing/work/queue-195/BUILD.md

@@ -157,5 +157,5 @@ TMPDIR. This file's results are a doc-only commit on top of the build, so nothin
 Deviation 6 says the node F9 runs is root's own. At 37171f65b the script didn't check that. F9 ran
 `--node` as root before F10's path check, so the header's "root itself only reads" was false
 (Duckworth's N1, `agents/duckworth/work/row195/REVIEW-m1.md` at 6afcee2a5). A host installed as designed
-was safe, because `case2-unit.sh` refused a non-root-owned `--node`. The fix and its tests are in
-`FOLLOWUP.md` next to this file.
+was safe, because `case2-unit.sh` refused a non-root-owned `--node`. Row 245 carries the fix and its
+tests: `agents/darkwing/work/queue-245/BUILD.md`.

agents/darkwing/work/queue-245/BUILD.md

@@ -1,8 +1,13 @@
-# Row 195 follow-up: Duckworth's N1-N3 on `scripts/case1-accept.sh`
+# Row 245 build: Duckworth's N1-N3 on `scripts/case1-accept.sh` (row 195 follow-up)
 
 Duckworth approved row 195's manifest round 1 (duckworth-0088, `agents/duckworth/work/row195/REVIEW-m1.md`
-at 6afcee2a5) with three notes that don't block. Sage asked for this follow-up in sage-1876 and opens the
-row after 195 lands. The branch is `darkwing/row195-n1`, on 37171f65b.
+at 6afcee2a5) with three notes that don't block. Row 195's code landed as b65014647, and the notes are in
+`docs/plans/DEFERRED.md` (d6cff0cdd). Row 245 carries them: brief `docs/plans/2026-10-20_hub-own-uid.md` §
+"Row 195 follow-up" at 62ddc96cc, owner Darkwing, reviewer Duckworth, gate owner Sage (sage-1923).
+
+The branch is `darkwing/row245`, on 62ddc96cc. Its first commit is a cherry-pick of `darkwing/row195-n1`
+1e3c4767c, which was written on 37171f65b and never run. The script, test and TOOLS.md blobs are the same
+as in 1e3c4767c, and none of those paths changed between 37171f65b and 62ddc96cc.
 
 ## What changes
 
@@ -16,8 +21,10 @@ took the path check, plus one more:
   evidence.
 
 I didn't run the parse through `AS_USER`. That would hand a check about a root file to the stack's user,
-and a process running as `mosaic` could change what that node prints. Rechecking ownership costs one
-loop and doesn't depend on how the host was installed.
+and a process running as `mosaic` shares that node's uid. Whether it could change what node prints then
+turns on the host's ptrace setting, and the root-only check doesn't depend on that. Sage agreed in
+sage-1877. Rechecking ownership costs one loop and doesn't depend on
+how the host was installed.
 
 N2. The header (:9-15) and the `docs/TOOLS.md` entry now list what root runs: `systemctl show` and
 `is-enabled` (F1, P11), `curl` on the loopback healthz (F2), `sudo -l` (P1, P3), `sudo -u jarvis bwrap
@@ -27,9 +34,9 @@ N3. F6 matched `--claude` by prefix, so `/opt/mosaic-stack/claude-<pin>/../claud
 path check. F6 now fails on any `..` segment, before it runs `--version`. F10 compares for equality, so
 it needed no change.
 
-BUILD.md gets a correction entry for deviation 6. DESIGN.md is unchanged. Gosalyn's Q4 answer makes the
-"either works" wording at `DESIGN.md:336-338` stale, but an approved design changes only with Sage's
-authorization, so it's left for Sage to rule on.
+Row 195's BUILD.md gets a correction entry for deviation 6. Row 195's DESIGN.md is unchanged. Its "either
+works" wording at `DESIGN.md:336-338` is superseded by gosalyn-0087 (root writes `dev.args` at W10), and
+it stays in place: an approved design isn't edited (sage-1877).
 
 ## Tests
 
@@ -57,8 +64,10 @@ The twelve from row 195 still apply, unchanged. These four are new, each one exa
 | 15 | `not_root_only` checks only the file, not the directories above it | F9 won't run (writable `bin/`) |
 | 16 | F6 accepts a `..` segment | F6 stub, path and `..` |
 
+The brief's gate asks for a mutant for each of N1 and N3. Mutants 13-15 are N1's, and 16 is N3's.
+
 ## Slot plan
 
-Same shape as row 195's steps, on the follow-up's tip: the single test file, then the sixteen mutants,
-then the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained
-with `&&`. The scripts are ready in `/mnt/storage/scratch/darkwing-195n-out/`.
+Same shape as row 195's steps, on this row's tip: the single test file, then the sixteen mutants, then
+the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained with
+`&&`. The scripts are in `/mnt/storage/scratch/darkwing-245-out/`. None has run.