diff --git a/agents/duckworth/work/row292/ROUND1-f8b9c2f73.md b/agents/duckworth/work/row292/ROUND1-f8b9c2f73.md
new file mode 100644
index 000000000..dc06eea57
--- /dev/null
+++ b/agents/duckworth/work/row292/ROUND1-f8b9c2f73.md
@@ -0,0 +1,110 @@
+# Row 292 (#1797) round 1: static review of the rebase, C1 and the kill rules (duckworth-0246)
+
+Reviewer: Duckworth. Builder of this round: Gizmoduck, carrying Gander's 0585b3213. Requests:
+gizmoduck-0360 (cc Sage), then gizmoduck-0362, which replaced the key. Rulings: sage-3146,
+sage-3148, sage-3152. Earlier read: duckworth-0229 (C1, C2, N1-N4).
+Candidate: 3fd8f42f6454495da9fc9eea12ad556dd5c93380 on b23783f39. That's f8b9c2f73 plus one packet
+commit, and neither is pushed yet. The file name keeps the first key.
+Manifest: /mnt/storage/scratch/gizmo-292-manifest-r1.txt, rewritten in place, sha256
+2fa7ae174934ecde66ed03259ef063dfbcd90eaa2a88bbbc34d951c82e5e8de7, 13 paths.
+Method: git reads, plus a python3 -I -B anchor count over git-shown blobs. No node, no tests.
+
+## Verdict: APPROVE (static), with C2 carried
+
+C1 is met. The kill table matches the tests. The gate (C2) runs on Sage's CLEAR before any landing.
+
+## Manifest and chain
+
+- The manifest file hashes to the key. All 13 blobs match 3fd8f42f6. The path list equals
+  `git diff --name-only b23783f39 3fd8f42f6`.
+- f8b9c2f73..3fd8f42f6 touches only queue-292/BUILD.md and mutants.py. scripts, docs and packages
+  are byte-equal to f8b9c2f73.
+- b23783f39 is on refactor. My refs have origin/refactor at b23783f39. I did no fetch, because a slot
+  is running.
+- Patch-ids (`git patch-id --stable`):
+  - a54baff21 = e7371025f (8e9b78ac185a). 9c6e39b25 = d4c796e44 (fc50b630d432).
+  - 3b17c7550 differs from 0585b3213, as a resolved commit should.
+
+## The resolution (stack-release.sh config_checks, :1076-1107)
+
+- `extra` is in the function's `local` line, and the bare assignment `extra="$(node …)" || key=$?`
+  keeps node's exit status.
+- Classification is unchanged: 1 (missing file) passes, and 2 (unparseable) refuses with the
+  unchanged JSON text.
+- The probe prints the JSON-quoted key in this order: console, federation, then the first key outside
+  `configVersion, environment, dataRoot, execution`. A non-object or an array prints
+  `"[configuration shape]"`.
+- With a loader, validate runs for every parsed config. That's the brief.
+- With no loader:
+  - An oldest-four config passes.
+  - Console or federation gets `it has no scripts/mosaic-config.mjs`, row 203's reason.
+  - Any other key gets the later-key reason.
+- The refusal text:
+  - A console or federation `extra` gets 203's line. The `-`/`+` lines in the diff are byte-equal.
+  - Every other key gets Gander's "is refused by $TO's loader" text.
+- The base test file is a byte prefix of the candidate's (cmp -n over the base's size), so no row 200
+  or 203 assertion changed.
+
+## C1: the pre-270 refusal (stack-release.test.mjs, the new tests from :2602)
+
+- PRE270 removes `.concat(["compactionReadBytes", "compactionStreams"])` from C1's loader and asserts
+  that the replace changed something. The result is the list at bce491715^:
+  `["configVersion", …, "console", "federation"]` (mosaic-config.mjs:299 there, :304 now). The fixture
+  builds C1 from the repo's own loader (stack-release-fixture.mjs:300 and :304).
+- Each key is checked first with C1's loader (validate status 0), so the refusal comes from B. Then a
+  full activate of B and a rollback each refuse with ANY_CONFIG_MSG naming that key. The config is
+  restored in `finally`, and a final rollback must succeed to B.
+- N3 is met: compactionStreams is 1024.
+- The missing-loader federation and console cases put `compactionStreams` before the key, so they test
+  the probe's preference, not just key order.
+
+## Mutants M1-M9 and the kill rules (BUILD.md "Kill rules (sage-3152)", mutants.py K)
+
+Each of the nine anchors occurs exactly once in the candidate's stack-release.sh (python count over
+the blob). The blob's sha256 starts 8f535d53, the restore hash BUILD.md names. Each row of the K table
+holds when read against the tests at 3fd8f42f6:
+- The fixture config (stack-release-fixture.mjs:369) holds only the oldest four keys, so `extra` is
+  empty on a seeded stack.
+- M1 and M2: activate B exits 0 inside `refused`, so `assert.equal(r.code,3,…)` fails at :517 and the
+  async stack names the caller, :2619. The text is `actual: 0`. M1 returns before validate. M2 makes
+  the elif true. Activate C1 at the top of the test still exits 0 under both.
+- M3: compactionReadBytes is the first case, and status 0 fails at :2670.
+- M4 (gizmoduck-0362's question): `{` gives key 2 and empty stdout, so `extra` is empty. `[ "$key" =
+  99 ]` is false, so the loader branch runs. The witness loader writes its file and exits 0, the
+  elif returns 0, and the status assertion fails first on :2684 with `actual: 0`. The missing-config
+  half before it still returns at key 1. Confirmed.
+- M5: `extra` is empty, so the loader is never run. `lines()` returns `[]` for a missing file
+  (fixture :320), so the deepEqual at :2654 fails with `actual: []`.
+- M6 and M7: the probe picks compactionStreams, so the refusal is Gander's text, carrying
+  `to validate configuration key: `. M7 fails on the console case and M6 on the federation case, both
+  at :2677. Both edits leave valid JS.
+- M8: federation keeps the no-loader reason, then takes Gander's line, so `is refused by old` (TO is
+  `old` in isolatedConfigChecks). KEY_MSG doesn't contain that string, so the text check can't match
+  the expected side.
+- M9: federation gets the later-key reason inside 203's line, so `to validate configuration key: `.
+  KEY_MSG doesn't contain it either.
+- Each pattern names one top-level test, anchored with ^ and $, so `ℹ fail 1` is reachable. The rule
+  sends any other outcome to Sage, which covers the 264a M2 second-fence case.
+
+## Condition
+
+- C2 (carried). The gate runs on Sage's CLEAR per BUILD.md "Run plan": stack-release.test.mjs whole,
+  the cli suite whole (stack-release-external and stack-upgrade drive the real script, and every
+  existing activate and rollback now runs the target loader), the ten scripts/test-*.sh, then M1-M9
+  under the kill rules with byte restores to 8f535d53. A first-run red follows mos-1272. A second
+  red or an old-test change goes to Mos first.
+
+## Notes (non-blocking)
+
+- N1. With no loader, a non-object config refuses with `…to validate configuration key:
+  "[configuration shape]"`. That fails closed, but it reads as a key name. It's doc-level, the same as
+  round 1 N2.
+- N2. TOOLS.md says "The refusal names the rejected key." That holds for an unknown key. For a bad
+  value (`unsupported environment: …`), the loader's first line names the value, not a key. Doc-level.
+- N3. Round 1 N1 is now intended: a config holding console plus another refused key takes 203's text,
+  and the bracketed diagnostic names the other key. 203's text came first, and 292 doesn't change it.
+- N4. Round 1 N4 ("No config values are printed") still stands in Gander's packet BUILD.md, which this
+  candidate carries unchanged.
+- N5. Kill rule 2 depends on V8 putting the frame at the call's first line. That holds for :2654's
+  multi-line deepEqual and for :2619's async caller frame. If a targeted log shows another line, the
+  rule's STOP covers it. A mis-cited line isn't a survivor.
diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md
index 5c37f0eca..3bfcebd04 100644
--- a/docs/SESSIONS.md
+++ b/docs/SESSIONS.md
@@ -1548,3 +1548,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T22:25Z | Duckworth (Opus 5.5) | row 207 (193c, #1705) manifest review (megavolt-0186) | APPROVE on 9bb406c6c (gated 712f79c0a), gate logs read; N1 any-business test, N2 stray flags (duckworth-0230) |
 2026-10-22T23:55Z | Duckworth (Opus 5.5) | rows 270/271 r4 rebase delta review (ac44d0de9, 2b964a082) | APPROVE both, C1-C2 carried (duckworth-0235) |
 2026-10-23T01:57Z | Duckworth (Opus 5.5) | row 270 queue round 3 on 49cee846e (manifest f4174458) | APPROVE, C2 met (duckworth-0243) |
+2026-10-23T02:52Z | Duckworth (Opus 5.5) | row 292 (#1797) round 1 static on 3fd8f42f6 (manifest 2fa7ae17, replaces f8b9c2f73) | APPROVE (static), C1 met, kill rules checked, C2 carried (duckworth-0246) |