duckworth: row 234 early split and name map check (duckworth-0079) on Gizmoduck 2aa54a67a

agents/duckworth/work/row234/REVIEW-build-split.md

@@ -0,0 +1,76 @@
+# Row 234 early check: split and name map (duckworth-0079)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in gizmoduck-0095. Subject: `gizmoduck/row234` 2aa54a67a,
+`agents/gizmoduck/work/queue-234/BUILD.md` (71 lines). Checked against r6 f9039682e
+(`agents/gizmoduck/work/machine-grant/DESIGN.md`, "r6:" below) and #436b section 7 at fa5658941. No code
+yet, so this is a design-to-build check, not a verdict on the row.
+
+## Result: the split and the name map stand, with four items for the candidate
+
+The name map is complete. Every `grant.`/`host.` name in r6 is one of these:
+- The four renamed in the table (r6:257, :271, :394, :404).
+- Already under `grant.`: step, applied, failed, revoked, revoke.closed.
+- Not an event: `host.run`, `host.sudo`, and `host.grant` (r1's dropped action) and `grant.ask` (Q-S1, not
+  built).
+
+`decision` becoming `grantDecision` in every guarded body except the consume record follows section 7's
+spend rule (fa5658941 DESIGN.md:472-476). `grant.host.checked` and `grant.host.removed` carry no decision.
+
+The split matches r6 Q-S4 (r6:904-911) and the X/E sections. Row a has no path that makes a `host_grants`
+record outside a fixture, because the `host` method refuses `invalid-request` until row b. Items 1 to 8 match
+r6 S1, X1, E1 to E4 and X4's first and third bullets.
+
+## G21 fixture (question 1): acceptable, on these terms
+
+Row a can't produce `hostLineLeft`. An enrollment has no remote step, so its failures leave no line. A fixture
+is therefore the only way to test the check in row a.
+- F1. Write the fixture through row a's private grant writer, in the real shape: `action.allowed`, actor
+  (NULL, 'grant'), `body.action` 'grant.failed', `body.host`, `body.hostLineLeft`. Don't write it with raw
+  SQL around the trigger.
+- F2. Read `body.hostLineLeft` from any guarded body, not only `grant.failed`. Row b's
+  `grant.revoke.closed` carries it too (r6:715-717).
+- F3. r6's `grant.revoke.closed` body is `{tag, hostLineLeft}` (r6:716). It names no host. Either row b
+  adds `host` to that body, or the check maps the tag to a host through the recorded `grant.step` tags.
+  Fix which one in BUILD.md now, so row a's reader and row b's writer agree.
+- F4. "No later `sweep` cleared it" (r6:403) needs `grant.sweep`, which row b writes. Say in BUILD.md
+  that row b adds the sweep clear to `hosts.remove` with a G21 case. Row b's G8 or G13 should also show that
+  `hosts.remove` refuses after a real write, not only after the fixture.
+
+## Moves and gaps (question 2)
+
+- M1. G4 for the `host-enroll` block goes in row a. Row a renders that block (item 3, r6:240-242): the
+  fingerprints, the key lines and the sudo line. Row a should test that a question can't forge it and that
+  the 4096-character limit holds with it appended. G4 for the `host` block stays in row b.
+- M2. The tag function lands in row a, because E2 step 2 uses it for the installer tag (r6:265-266). Move
+  G24's first sentence (64-character names with `.` and `_` give distinct tags of the fixed length) and the
+  mutant "build the tag without the business" to row a. The `sweep` half of G24 stays in row b.
+- M3. The Approve record check (X4 first bullet, r6:593-596) is row a code, but no row a G-test covers it.
+  G22 is row b. Add a row a test on store fixtures that `host.run` refuses `host-not-granted` for each of:
+  - no record
+  - a record whose decision is unresolved
+  - a decision resolved by an arbiter, the tester or an agent, or not via cli
+  - a consume record with `operation: 'grant.host-enroll'` instead of `'grant.host'`
+  - an unspent decision
+
+  Also add a restart test that a `host_grants` fixture yields a `Credentials` reference (X4 third bullet).
+  The mutant "`host.run` reads the business file instead of the grant record" goes in row a.
+- M4. Item 8 lists status, the start reconcile and `openGrantDecisions`. Add `hosts.remove`'s
+  `hostLineLeft` reader (F2). The look-alike test should cover it: an `action.refused` or session-written
+  `hostLineLeft` doesn't block a remove.
+
+N1 (doesn't block). BUILD.md splits the G-tests but not r6's mutant list (r6:838-883), and r6 leaves the
+numbering to BUILD.md. A per-row list before the candidate saves a round. By my reading these are row a's:
+- drop the chief check
+- start on a mint with no `grant`
+- start on an arbiter resolve, or on `no`
+- skip the keyscan compare, or compare one key
+- the private key in an event body
+- drop the not-enrolled check
+- drop the `hosts` primary key
+- skip the start check for a resolved, unspent enrollment
+- `host.run` reads the business file
+- the tag without the business
+- the writer mutants (`from=`, a line outside the tag pattern, `O_NOFOLLOW`, a dropped group, the user
+  pattern, `privileged` without `users`, a sudo user not in `privileged`)
+- section 7's trigger mutants
+- one reader-filter mutant

docs/SESSIONS.md

@@ -1432,3 +1432,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T01:32Z | Duckworth (Opus 5.5) | REQ-CRED-4 title delta (duckworth-0076), Honker 46c8adaeb..c03d660e7 | approve, N1 title drops "only", 117-char wording offered |
 2026-10-21T01:34Z | Duckworth (Opus 5.5) | REQ-CRED-4 title follow-up 2884ee496 (duckworth-0077) | approve, N1 resolved, no notes |
 2026-10-21T01:59Z | Duckworth (Opus 5.5) | row 210 queue round 3 rebase check on Gizmoduck 0485384e9 (duckworth-0078) | approve, no findings |
+2026-10-21T03:01Z | Duckworth (Opus 5.5) | row 234 early check of BUILD.md split and name map on Gizmoduck 2aa54a67a (duckworth-0079) | split and map stand, G21 fixture ok on F1-F4, moves M1-M4, N1 mutant split |