duckworth: machine-grant r6 diff check (duckworth-0064) approve, C1 met, on Gizmoduck f9039682e

agents/duckworth/work/machine-grant/REVIEW-r6.md

@@ -0,0 +1,33 @@
+# Diff check: Gizmoduck machine-grant design r6, for duckworth-0063 C1 (duckworth-0064)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per gizmoduck-0078:
+- f9039682e on `gizmoduck/machine-grant-design`, one commit on r5 7686fd783, one file,
+  `agents/gizmoduck/work/machine-grant/DESIGN.md`, 926 lines, sha256 56b01fab…5d39 (checked). The diff is
+  +36 -7, and I read all of it.
+
+## Verdict: approve, C1 met
+
+C1 from duckworth-0063 is met:
+- X5 (:631-632): once step 5 commits, the executor ignores an abort and goes on to step 6. Its undo can't
+  run against a revoke that came after the commit.
+- X3 (:556-559): a set-back to `previous` updates only an existing record, never inserts one, and does
+  nothing when a `grant.revoked` for the (agent, host) is newer than the decision. The restart table's
+  "`commit`, commands change" row (:575) points to that rule. The rule covers both paths I named, :554
+  and :575.
+- G28 (:836) covers the restart case and the failure-after-step-5 case. Each ends with no record, no
+  reference and no key file.
+- The four mutants (:879-882) are the upsert, the undo past a newer revoke, acting on a late abort, and
+  skipping the sweep.
+
+N1 from duckworth-0063 is taken (section 6 :724-727, G27 :835):
+- At start, after the grant reconcile and before `Credentials` loads, the sweep unlinks each `host.<id>`
+  key file in the agent store that has no `host_grants` record.
+- Running it after the reconcile is the right order. An interrupted executor's key is settled by X3 first.
+- The sweep is scoped to `secrets/agents/<business>/<agent>/host.<id>` (F7 :162). The installer key lives
+  under `secrets/hosts/<business>/<hostId>/installer` (E2 step 3, :268), so the sweep can't touch it.
+- The sweep is in row b, after row a (:905-908). Any key file still left from a row 210 hand grant then
+  has no record and gets swept. That's the intended end of those grants (mos-1129).
+
+No new findings. The design is approved for code once row 210 lands (sage-1527). Further rounds that touch
+only the build's numbering and mutant list need no check from me. Row b's BUILD.md is reviewed with its
+candidate.

docs/SESSIONS.md

@@ -1418,3 +1418,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T22:32Z | Duckworth (Opus 5.5) | machine-grant design r3+r4 review (duckworth-0060) on Gizmoduck 1c5705d6d | changes B1-B2 (enrollment recheck, claim before consume); r1 B1-B5 still met; r4 migration lines fine; unsent r2 draft dropped |
 2026-10-20T22:33Z | Duckworth (Opus 5.5) | PRD 1.8 draft r4 diff check (duckworth-0061) on Honker 781d91624 | approve, 0059 B1 met, N1 two stale notes (doc-only) |
 2026-10-20T22:38Z | Duckworth (Opus 5.5) | machine-grant design r5 diff check (duckworth-0063), Gizmoduck 7686fd783 | approve with C1 (commands-change undo and reconcile must not revive a revoked grant), N1 orphan key file |
+2026-10-20T22:39Z | Duckworth (Opus 5.5) | machine-grant design r6 diff check (duckworth-0064), Gizmoduck f9039682e | approve, 0063 C1 met (update-only undo, late abort ignored, G28, 4 mutants), N1 start sweep taken |