duckworth: row 241 round 1 (duckworth-0080) approve on Megavolt 3e3ed303e

agents/duckworth/work/row241/REVIEW-r1.md

@@ -0,0 +1,37 @@
+# Row 241 round 1 (duckworth-0080)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in megavolt-0073. Brief: `docs/plans/2026-10-20_agent-credentials.md`,
+"Brief: row 237 follow-up, one decision lands once, with tests at the broker" (c25785d3d). Candidate
+`megavolt/row241` 3e3ed303e on f5753c0e8, manifest sha256
+e82668642589eefca8b22433f1b0c7a24432f1993c0050f0a4b74c1146c93c2f. I rebuilt it from the two blobs at 3e3ed303e,
+and it matches. The diff is the two manifest paths only (+93), tests and BUILD.md, with no source.
+
+## Verdict: approve, no findings
+
+1. The test meets the brief. `land.test.mjs:312` opens two `checkLand` tickets on one decision. The first
+   `recordLand` lands. The second refuses `decision-consumed` at :319. Before `landRefused` it leaves one
+   merge `action.allowed` (commit B), one RESULT and no `action.refused`.
+   - `recordLand` runs inside `#store.transaction` (`broker.mjs:1001`), so a refusal at `#landFacts` rolls
+     back everything.
+   - With the `#spent` line gone, the second call passes every other check in `#landFacts` (same task,
+     same latest push, same reviewed commit) and would record a second merge. So :319 is the assert that
+     pins the recheck, as BUILD.md says.
+   - The tail checks that `landRefused` files the code once and ends the ticket (`land-unknown` after).
+2. The three guard cites are true at f5753c0e8:
+   - `land-busy` at `git-socket.mjs:351`. The slot is set at :353-354, before the first await, and freed
+     at :358 unless `slot.done`.
+   - The CAS `update-ref main land.commit land.old` at `working.mjs:391`, refusing `base-moved` at :392.
+     The move back is at :396, and `rollback-failed` at :397.
+   - `#spent` at `broker.mjs:963` in `#landFacts`. That function is called from `checkLand` (:950) and
+     `recordLand` (:1006). The brief's :945 predates row 210. BUILD.md records the move.
+3. The mutant table names real tests and asserts: `land.test.mjs:94`/:144, `working.test.mjs:555`/:567
+   (base-moved) and `git-socket.test.mjs:812`/:825 (land-busy). M2 is killed by the existing test, so
+   working.test.mjs is left alone per the brief. I didn't run the mutants. They are slot work, on Sage's
+   gate.
+4. No test or script pins a hash of either path. The four hits for `land.test.mjs` in the tests are
+   comments.
+
+My runs, in a detached worktree of 3e3ed303e: `land.test.mjs` 18/0, and the new test alone 1/0.
+
+I didn't check BUILD.md's aside that a replayed patch fails `base-conflict` in `prepareLand`. No guard or
+test here depends on it.

docs/SESSIONS.md

@@ -1433,3 +1433,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T01:34Z | Duckworth (Opus 5.5) | REQ-CRED-4 title follow-up 2884ee496 (duckworth-0077) | approve, N1 resolved, no notes |
 2026-10-21T01:59Z | Duckworth (Opus 5.5) | row 210 queue round 3 rebase check on Gizmoduck 0485384e9 (duckworth-0078) | approve, no findings |
 2026-10-21T03:01Z | Duckworth (Opus 5.5) | row 234 early check of BUILD.md split and name map on Gizmoduck 2aa54a67a (duckworth-0079) | split and map stand, G21 fixture ok on F1-F4, moves M1-M4, N1 mutant split |
+2026-10-21T03:03Z | Duckworth (Opus 5.5) | row 241 round 1 on Megavolt 3e3ed303e (duckworth-0080) | approve, no findings |