duckworth: row 195 DESIGN r6 diff check (duckworth-0055) approve on Darkwing b7239bb66

agents/duckworth/work/row195/REVIEW-r5.md

@@ -0,0 +1,60 @@
+# Diff check: Darkwing row 195 DESIGN r6, for duckworth-0054 (duckworth-0055)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per Darkwing's request:
+- b7239bb66 on `darkwing/row195`, one commit on r5 0b6d29e90. The diff touches DESIGN.md only
+  (+87 -20).
+- `agents/darkwing/work/queue-195/DESIGN.md`, blob 46bbcf2b135e, sha256 d0375e8f…6766 (checked).
+- I read the whole diff. It changes only B1's and B2's lines, the notes, and their section 7 cases
+  and mutants, as the header says.
+
+The `stack-release.sh` cites (:58, :169, :415-416, :1004-1005, :1493) are the ones I checked in
+REVIEW-r4. `scripts/` is unchanged.
+
+## Verdict: approve
+
+- B1 is met. `confirm` sets OP, FROM, TO and ACT from the open activation's `started` line. It sets
+  BACKUP from a `BACKUP` file that A3 writes after `backup_store` returns. So A5's `ok` line and R4's
+  line read `op activate` or `op rollback`, which `from_log` (:169) accepts.
+  - Sequence 7 covers the example from my review. After two re-pins, `--to C1` passes and `--to C0`
+    refuses.
+  - After a confirmed rollback to C1, `from_log previous` names C2. That's right: the newest ok line
+    whose `to` isn't C1 is the activate to C2.
+  - The op case and the mutant hold it.
+- B2 is met. `MIGRATING` and TAKEN are set after `backup_store` and before `migrate-schema.mjs`, the
+  same point as :1004-1005. Sequence 8's fake migrate writes to the store and exits 1. It checks
+  `FAILED` and `MIGRATING`, a byte-identical restore and R4's line. The mutant records after the
+  migrate.
+- N1 is taken. The marker step makes `$RS` with the exclusive `mkdir`, and an existing `$RS` refuses
+  `marker-failed`. Capture under `--units external` makes no directory.
+- N2 is taken. `gate` requires `--since T`, root's own clock, read before the A2f start. Root still
+  parses nothing `mosaic` wrote, and a case and a mutant hold the `usage` refusal.
+- N3 is taken. The 21:51:46Z reads give the baseline. Item 3 now requires the word grep to list
+  exactly the installed file, and `-w` also catches `/{usr/,}bin/bwrap`.
+- N4 is taken. Item 4 runs 2a''s `systemd-run` line with `NoNewPrivileges=yes`, with an argv case and
+  a mutant.
+- N5 is taken. `--expect-from OLD` refuses `pointer-differs` in A1's plan, for activate and for
+  `rollback --to`.
+
+## Notes (do not block)
+
+N1. With `--since`, an A2 stop timeout now ends at exit 2. The diff says a unit that never stopped
+keeps its old `ActiveEnterTimestamp` and fails `stale-start`. So when A2's wait times out with the bus
+still active, root stops UNITS and exits 2. In r5 that path would have exited 1 with OLD still
+running. Nothing of `mosaic`'s changed in A2f, so this turns a no-op failure into an outage that Jason
+or Mos has to settle.
+- That's fail-closed, and a unit that won't stop is a fair reason to stop. Keep it if that's the
+  intent.
+- Then say so in the run sheet's A2f line.
+- Point the case1-repin test's "exits 1 with OLD's gate passing" case at an A3 exit 3, where the units
+  did stop and restart. With a `systemctl` that never reports inactive, a real `gate --since` can't
+  pass.
+
+N2. The claude path (gosalyn-0058, with Sage) is outside this round. A move under `/opt/mosaic-stack`
+changes these:
+- section 1's `--claude` value and the managed-settings reasoning
+- F6
+- the run sheet's install step for claude, which then runs as root
+
+It gets its own round, as the header says.
+
+The manifest round reviews the built scripts and tests against sections 4 and 7.

docs/SESSIONS.md

@@ -1409,3 +1409,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T21:33Z | Duckworth (Opus 5.5) | row 210 round 2 diff check (duckworth-0053) on Gizmoduck 455964f23 | approve, B1 met (missing sshd fails 13, skipped 0), N1-N3 taken; 17 singles 137/0/0 skipped
 2026-10-20T21:45Z | Duckworth (Opus 5.5) | row 210 queue record on comment 29702, candidate 455964f23 | approve recorded, rev 2466 (duckworth-r210-record-1); rev left uncommitted for Sage's queue-commit
 2026-10-20T21:50Z | Duckworth (Opus 5.5) | row 195 DESIGN r5 review (duckworth-0054), Darkwing 0b6d29e90 blob 9395e56d1775 | changes B1 (confirm result line lacks op/from/to/backup, from_log misses .53 activations) B2 (migration record after migrate, partial migrate never restored); r4 B1 B2 N1-N4 met; port squat checked, 732 fix fits
+2026-10-20T21:55Z | Duckworth (Opus 5.5) | row 195 DESIGN r6 diff check (duckworth-0055), Darkwing b7239bb66 blob 46bbcf2b135e | approve; B1 B2 N1-N5 met; N1 A2f stop timeout now exits 2 (state in run sheet, fix test wording), N2 claude path round separate