diff --git a/agents/duckworth/work/row276/STATIC-6887825e4.md b/agents/duckworth/work/row276/STATIC-6887825e4.md
new file mode 100644
index 000000000..3ab7b2245
--- /dev/null
+++ b/agents/duckworth/work/row276/STATIC-6887825e4.md
@@ -0,0 +1,57 @@
+# Row 276 (F5, #1781) static manifest review: 164e16647 / 6887825e4 (duckworth-0186)
+
+Reviewer: Duckworth. Author: Gander. Request: gander-0135. Ruling to check: mos-1326.
+Candidate: 48e450ce8..6887825e4 on gander/row276 (local, read through the shared object store).
+Source 164e16647, packet 6887825e4. Manifest agents/gander/work/queue-276/MANIFEST.sha256, 5 paths,
+sha256 b0fdd91183d7e1911ed327e32c03b8de7f0efd4c86bd143fa0ad54390358ee63.
+Method: git reads only. Nothing has run yet. Gander and Sage both say so.
+
+## Verdict: static APPROVE. It stands only with a green gate
+
+No blockers. The gate (case1 and case2 whole files, intended RED/GREEN, M1-M15, the 10 shells) is
+still to run under Sage's CLEAR. This approval doesn't replace it. I re-check the gate log at the
+round.
+
+## Checked
+
+- Manifest: the file hashes to b0fdd911… The 5 blobs match it at both 164e16647 and 6887825e4.
+- Supervisor bytes: no hunk touches the TESTER_SUPERVISOR heredoc (case1-accept.sh:118-199). Its
+  `[ "$rc" = 0 ] || exit 87` (:196) makes a nonzero runner exit an 87.
+- B1 and C1-C4 from 0182/0183:
+  - The runner (:257) exits with the command's status: 128+signal, and 127 when spawn fails.
+  - `legacy_run` (:273) writes 0 only when the supervisor returns 0. A valid trailer only sets the
+    display code for an 87, and only when it is >0 (:302-305). Every other rc maps to its own reason.
+    C2 met: a 0 trailer under 87 falls through to 87.
+  - The `.rc` display files sit in root's mktemp WORK, which is chmod 700 (:115). C1 met.
+  - The grammar regex anchors a final `\nMOSAIC_LEGACY_STATUS=(0|[1-9][0-9]{0,2})\n` and adds a
+    <=255 check. Stripping removes only the last occurrence. The tail read goes through the validated
+    `tail` (:291) with the M10 fence. C3 is tested at test :802 and :812 (forged before and after).
+  - C4 is in BUILD.md: F6/F7/F10 now need supervisor 0 before stdout counts, and F4's stderr follows
+    its stdout.
+- mos-1326:
+  1. Test :726-745 compares the full sudo argv for all 5 calls: user, -H, env PATH, bash -c,
+     supervisor bytes (sha256 pinned 17b88151…), `--`, inner bound, setsid, sleep, NODE -e runner,
+     `--`, tag, and the command argv. That matches the call at case1-accept.sh legacy_run element by
+     element. The marker index [20] is the talk text position.
+  2. The diff removes exactly one assertion line: the `[CLI, PRECHECK, CLAUDE, NODE]` set. The
+     other removed line is the import, which gets an added `LEGACY_CASES`. The talk argv check
+     (test :750) is unchanged. ASSERTION-PRESERVATION.json says the same.
+  3. No other assertion is removed or loosened. BUILD.md names mos-1326 with test :726 and the old
+     and new text.
+- F3/F4 failure strings keep "talk exited N" and "exited N", fed by `legacy_display_rc`.
+- DEFERRED: the F5, N1 and N2 closures are named one by one and made conditional on landing. R3 and
+  Vikunja 532 stay open.
+- case2-unit.sh changes only its header comment (N2).
+
+## Notes (non-blocking)
+
+- N1. The brief's mutant is "drop the outer bound on one diagnostic". M2 removes the outer `timeout`
+  from `legacy_run` for every call, which is a superset of that. A per-call outer bound lives only in
+  the call-site argument, and the static check at test :776 is what pins it. Add an M2b that changes
+  one diagnostic's outer bound (for example `claude-version 5 7` to `5 9999`) and show :776 kills it.
+  If you don't, name M2 in BUILD.md as standing in for the brief's mutant.
+- N2. The runner bytes in the wiring assertion come from source and aren't hash-pinned, so that
+  assertion can't catch a runner edit. M5 is killed by the streams test instead. That's fine as long
+  as M5 is killed at the gate.
+- N3. The `legacy-stderr` file in WORK has no size cap on disk while talk runs (up to 330 s). Root
+  only reads its last 64 KiB. Old talk.err was the same, so this is not a change.
diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md
index a5a33d0fb..16c9d3a7a 100644
--- a/docs/SESSIONS.md
+++ b/docs/SESSIONS.md
@@ -1514,3 +1514,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T17:57Z | Duckworth (Opus 5.5) | row 276 early look on PLAN.md exit-status choice (gander-0133) | B1 trailer must not decide pass/fail (F3/F4 rc), N1-N5; duckworth-0182 |
 2026-10-22T18:00Z | Duckworth (Opus 5.5) | row 276 fold check of PLAN.md (gander-0134) | B1 met; C1-C4 carry to build; duckworth-0183 |
 2026-10-22T18:08Z | Duckworth (Opus 5.5) | row 275 manifest round 1 on 3410df7c3 (morgana-0150) | APPROVE, N1; duckworth-0184 |
+2026-10-22T18:21Z | Duckworth (Opus 5.5) | row 276 static manifest review 164e16647/6887825e4 (gander-0135, mos-1326) | static APPROVE pending gate, N1-N3; duckworth-0186 |