duckworth: rows 300/301 round 1 approve (static) on 6a1d53066 (62023a00) and 04a179740 (def28197), conditions and notes (duckworth-0263)

agents/duckworth/work/row300/ROUND1-6a1d53066.md

@@ -0,0 +1,53 @@
+# Row 300 (R6-N1, #1807) round 1: manifest review (duckworth-0263)
+
+Reviewer: Duckworth. Builder: Launchpad. Request: launchpad-0098.
+Brief: docs/plans/2026-10-23_r6-followup-rows.md, "Brief: R6-N1". Source: my row 294 round 1 N1.
+Candidate: launchpad/row300 at 6a1d53066 on c13c337e1. Manifest digest
+62023a00ef6e39f137e60f91ff16214ccb844871f95e5bb1fcf5ddc1eb8ebfb4, one path.
+Method: git reads only. No node, no tests.
+
+## Verdict: APPROVE, with C1
+
+- Tests only. `git diff --stat c13c337e1 6a1d53066` adds packages/webui/tests/user-option-swap.test.mjs
+  and the queue-300 packet. No product file, existing test or fixture changes.
+- MANIFEST.sha256 has one line, e023bb9f…704f, equal to the blob at 6a1d53066. The file hashes to the
+  stated digest. c13c337e1 is an ancestor of origin/refactor a863015a5.
+
+Brief items:
+- **Gate stubbed open, product unchanged.** The load hook acts only on the URL `serve.mjs?gate=open`
+  and inserts `return true;` after `export function userRoute(path, method) {`. That line occurs
+  exactly once in serve.mjs at the base (:49), and the hook throws if it doesn't. serve.mjs:687
+  calls the module-local userRoute, so the copy's gate is the one stubbed. Relative imports inside
+  the copy resolve to the real modules, because URL resolution drops the query. :139 checks that
+  the stub took. :149 checks that no answer says owner-only.
+- **No option reaches the owner transport.** Every owner option is a recording stub: bus, send, the
+  writers, processing, reads and chat. The owner transport records `['transport', verb, args]`.
+  After every route, :151 allows only `['transport','plugins',{}]`, the read mos-1394 allowed. The
+  routes cover each name in the serve.mjs:689 destructure (bus, send, settingsWrite, the three
+  project-file options, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite,
+  processing). They also cover `reads`, which :690 nulls.
+- **Positive control.** :144 shows the owner's session reaches the `send` stub on the same route, so
+  the count can see a kept owner option.
+- **M12 kill.** M12 drops `send` from :689 (run1/mutants.py, anchor exactly once). alice's
+  POST /api/bus/message then calls the owner stub and records `['option','send']`. That fails
+  :151, and :153 too. The killer, "R6-N1", is the test's name. The driver counts a timeout (124 or
+  137) as not killed.
+- **Why a new file.** BUILD.md gives the reason: putting the gate-open copy into
+  granted-user.test.mjs would change its fixture, and a fixture change goes to Mos. Agreed.
+- No test pins a hash of a webui test file. The webui suite runs each file in its own process
+  (`node --test tests/`), so the in-thread hook can't leak into other files.
+
+## Condition
+
+- **C1.** On Sage's CLEAR, run1/gate.sh runs the new file whole, then the webui suite whole, and M12
+  is killed. This is the brief's Gate.
+
+## Notes (non-blocking)
+
+- **N1.** `upstream` (the board proxy, nulled at :690) has no recorder. The board is
+  http://127.0.0.1:9, so a kept upstream would fail to connect, not record an owner call. A mutant
+  that keeps upstream would survive this test. The brief asks only about bus options, so this is
+  out of scope. If a later row wants it covered, a recording stub at `board` would do.
+- **N2.** setup() and ROUTES are copies of granted-user.test.mjs, and the comments at :53 and :120
+  name the source. If G4's route list grows, this one doesn't follow. That's acceptable for a
+  tests-only row.

agents/duckworth/work/row301/ROUND1-04a179740.md

@@ -0,0 +1,43 @@
+# Row 301 (R6-N4, #1808) round 1: manifest review (duckworth-0263)
+
+Reviewer: Duckworth. Builder: Launchpad. Request: launchpad-0098.
+Brief: docs/plans/2026-10-23_r6-followup-rows.md, "Brief: R6-N4". Source: my row 294 round 1 N4.
+Candidate: launchpad/row301 at 04a179740 (fd4b8c36e, 04a179740) on e551cd846. Manifest digest
+def28197cc28fdd63caf673bf671b7b20852b9d9ec4d8fb9c53371c6d932ee0c, five paths. DELETED.txt names
+packages/webui/src/user-bus.mjs.
+Method: git reads only. No node, no tests.
+
+## Verdict: APPROVE, with C1 and C2
+
+- All five manifest hashes equal the blobs at 04a179740, and the file hashes to the stated digest.
+  user-bus.mjs is gone at 04a179740, as DELETED.txt says.
+- **The fold is a move.** `git diff -U0 e551cd846 04a179740 -- packages/webui/src/bus.mjs` removes no
+  lines. It adds `import { fileURLToPath } from 'node:url'` at :13, plus 57 lines after busReader.
+  Compared with the old user-bus.mjs, the only differences are these:
+  - The header comment is rewritten. "Kept apart from bus.mjs" goes, and "moved here" comes in.
+  - The four imports bus.mjs already had are dropped: spawn, randomBytes, readHostState and
+    BusReadError.
+  - One trailing blank line is added.
+  USER_CLI, userCall, busBusiness and userCaller are unchanged. humanCall and busCaller are
+  untouched.
+- **Imports.** cli.mjs and granted-user.test.mjs:22 now take the same names from bus.mjs. Launchpad
+  reports that Mos ruled the test edit an import update, not an old-test change. No assertion
+  changes. console-bus.mjs changes one comment word. No file in packages/ or scripts/ still imports
+  user-bus.mjs. The only other hit is the agent-watch "user-bus" stub, which is the systemd user bus
+  and unrelated. No copy or runner list names user-bus.mjs.
+- **The pin.** channel-proof.test.mjs:29 changes from 15e8123f…3313, which equals bus.mjs at
+  e551cd846, to 39fcb27c…ad6c, which equals bus.mjs at 04a179740. It adds one comment line. No other
+  test pins a hash of bus.mjs, cli.mjs, console-bus.mjs or the two test files. The re-pin is an
+  old-test change. It rests on mos-1449 under mos-1272, as Launchpad reports it. I haven't seen
+  mos-1449 myself.
+- Behavior is unchanged. The 294 user-transport tests in granted-user.test.mjs keep their bodies,
+  and only the import line moves.
+
+## Conditions
+
+- **C1. The rebase.** Sage lands 305 first and names a new tip. If the rebase changes any manifest
+  blob, or the base bus.mjs no longer hashes to 15e8123f, send the new manifest. A digest-only
+  change needs a git-read check from me before the gate.
+- **C2. The gate.** On Sage's CLEAR: channel-proof.test, the webui suite and granted-user.test run
+  whole. The brief puts this in the same window as the next channel-proof re-pin. Sage owns the
+  timing.

docs/SESSIONS.md

@@ -1555,3 +1555,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T06:12Z | Duckworth (Opus 5.5) | row 294 (FED R6, #1800) round 4 static check on manifest a1ff5d67 (8616b9a4f) | APPROVE (static), diff exactly mos-1419 A and B, no assertion looser, C1-C2 carried (duckworth-0256) |
 2026-10-23T06:36Z | Duckworth (Opus 5.5) | row 294 C1 check on run 4 record (24b745447, launchpad-0087) | C1 met: M1 red only G4 at :241 (502 access-refused), G5 ok 5 same run; round 1 403 status corrected to 502; C2 met by run 4 (duckworth-0258) |
 2026-10-23T07:13Z | Duckworth (Opus 5.5) | row 303 round 1 diff review (88ffecaf7, digest 3c3be5d3, launchpad-0089) | approve: one added R9 guard line, matches brief and mos-1422 pt 2, nothing else changed; C1 whole-file gate (duckworth-0260) |
+2026-10-23T11:49Z | Duckworth (Opus 5.5) | rows 300/301 round 1 manifest reviews (6a1d53066 62023a00, 04a179740 def28197, launchpad-0098) | 300 approve C1 gate+M12, N1 upstream unrecorded; 301 approve C1 rebase recheck C2 gate, fold is a pure move, pin 15e8123f->39fcb27c (duckworth-0263) |