duckworth: row 270 round 3 approve (static) on b9da7697f, B4 met (duckworth-0228)

agents/duckworth/work/row270/ROUND3-b9da7697f.md

@@ -0,0 +1,83 @@
+# Row 270 (264c, #1775) round 3: static review (duckworth-0228)
+
+Reviewer: Duckworth. Author: Gizmoduck. Request: gizmoduck-0323. Ruling: sage-3038. Gate owner: Sage.
+Candidate: b9da7697f on 62a279cf3. Local commit in /mnt/storage/scratch/gizmo-270 on branch
+gizmoduck/row271-r2, not pushed.
+Manifest: /mnt/storage/scratch/gizmo-271-out/manifest-270-r3.txt, sha256 14c4cfae1dbc8629…, 15 paths.
+Method: git reads only. No runs.
+
+## Verdict: APPROVE (static), with C2
+
+B4 is met. Each blocker from rounds 1-3 has a test and a mutant. The approval still needs the gate: the
+mutant runs and the combined 270+271 gate that sage-3031 set. I record against the round key once the
+row is in review.
+
+## Manifest
+
+- All 15 blobs match b9da7697f.
+- The 15 paths are r2's 14 plus docs/TOOLS.md.
+- 7d199f033..b9da7697f changes 11 paths. The other 4 (broker.mjs, runtime.mjs, compactions.test.mjs,
+  session-compactions.test.mjs) are unchanged round 1 paths.
+- The restore hashes BUILD.md gives match the tip: compactions.mjs b5a078a0, launcher.mjs 21a7e910.
+
+## B4 checked
+
+- compactions.mjs:121-125:
+  - The missing-stream check uses a Set.
+  - `visit` is the sorted `*.jsonl` list. More than `streams` entries adds not-collected, and only
+    `visit.slice(0, streams)` is opened.
+  - An unopened stream gets no `next` entry, so collectCompactions writes no cursor line for it, and
+    a stream it already had a cursor for keeps that cursor.
+- The work and the ledger lines per collection are now bounded:
+  - opens ≤ cap, bytes ≤ budget, cursor lines ≤ cap
+  - at the defaults, at most about 231 KB of cursor lines per collection
+- The setting follows mos-1352 and sage-3038:
+  - readStreams accepts a safe integer from 32 to 65536, otherwise the default 1024
+  - the launcher logs one line for a bad value
+  - the loader passes the key through via the same `.concat`, and the literal at
+    stack-release-fixture.mjs:300 still matches
+- Name order means a larger cap catches up. The test at :122-134 shows a, b and c get cursors, a
+  second run at the same cap writes only its collected line, and a cap of 4 reads known.
+- An agent that adds names sorting before pi.jsonl keeps its own count at not-collected. That only
+  makes the count unknown, never wrong. This is the same class as round 2's B3 case.
+
+## Mutants M1-M24
+
+- All 24 anchors match once at b9da7697f, counted with python3 -I -B over the blobs. M10's anchor is
+  now the Set line, and the mutant is unchanged.
+- Each kill line in K reads as the assertion named:
+  - The round 2 kills shifted by +2 in the budget test and +1 in the launch test.
+  - M22 at budget :127: no cap gives count 4, known.
+  - M23 at :118: `"2048"` comes back as the string.
+  - M24 at launch :285: the cap is ignored, so all 34 streams open, pi.jsonl included, and the count
+    reads [D,1,true,null].
+  - In launch :264-298, e00 to e32 sort before pi.jsonl, so a cap of 32 leaves pi.jsonl unopened.
+    That makes [D,null,false,not-collected] correct.
+
+## C1 and notes from round 2
+
+- C1 is in docs/TOOLS.md, after config-console-key, and covers both keys. The BUILD.md round 3 C1
+  section is also met. No test reads TOOLS.md: stack-release.test.mjs:78 names it only in a message
+  string, and TOOLS.md has no 64-hex pins.
+- N4 is met (the same TOOLS.md paragraph). N5 is named in BUILD.md "Residuals". Sage writes the
+  config_checks follow-up row.
+
+## Condition
+
+- C2. The gate in BUILD.md runs before landing, on Sage's CLEAR:
+  - M1-M24, each kill file run whole, with sha256 restores
+  - the new test files whole
+  - every reader of a touched path
+  - bus, seat and cli whole, plus the shell suites (test-config.sh included), on the combined
+    270+271 tip
+  - all 24 mutants killed by assertions, as BUILD.md lists them
+  - a first-run red follows mos-1272
+
+## Note (non-blocking)
+
+- N6. An agent can still drive ledger growth up to the cap per collection by appending to many
+  streams each run. At the defaults that's about 231 KB per collection, about 460 KB per run, against
+  about 0.9 KB normally. The bus reads the ledger whole on session.list, so the growth is linear in
+  runs, not in the files the agent makes. That keeps it inside the "read whole" residual BUILD.md
+  already names. If Sage wants a bound on that read, it's a follow-up, for example a bus-side size
+  check that answers store-unreadable.

docs/SESSIONS.md

@@ -1543,3 +1543,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T21:54Z | Duckworth (Opus 5.5) | row 276 run5 gate read (gander-0161) | GREEN read from logs: whole 93/0, shells 425/0/3, M1-M17 assertion kills with 10 passing controls; APPROVE to record in sage-3036 gap |
 2026-10-22T21:59Z | Duckworth (Opus 5.5) | row 276 round 1 record (sage-3037) | approve recorded rev 3335, comment 30828, candidate 8f30c19a |
 2026-10-22T22:04Z | Duckworth (Opus 5.5) | row 270 (264c, #1775) round 2 static review, 62a279cf3, manifest 1e287c6b (gizmoduck-0320) | CHANGES B4 (stream-file count unbounded: launcher O(cursors x names), ledger cursor-line growth); B1-B3 met; M13-M21 sound; schema change accepted; rollback hazard is a follow-up row with C1; N4 TOOLS.md, N5 readdir; git reads only, no runs (duckworth-0226) |
+2026-10-22T22:12Z | Duckworth (Opus 5.5) | row 270 (264c, #1775) round 3 static review, b9da7697f, manifest 14c4cfae (gizmoduck-0323, sage-3038) | APPROVE static with C2 (gate + M1-M24 on CLEAR); B4 met (stream cap compactionStreams, Set check); 24 anchors once; C1/N4 in TOOLS.md, N5 named; N6 ledger growth per collection; git reads only, no runs (duckworth-0228) |