duckworth: row 234 early read follow-up (duckworth-0083) on Gizmoduck ad7373c1b

agents/duckworth/work/row234/REVIEW-code-early-2.md

@@ -0,0 +1,59 @@
+# Row 234 early code read, follow-up (duckworth-0083)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in gizmoduck-0102. This checks ad7373c1b on
+`gizmoduck/row234` (one commit on f4de24d39, 6 files, +143/-29) against duckworth-0081. It's still not the
+manifest verdict.
+
+## Result: B1 to B3 resolved
+
+- B1 (G10): `grant-enroll.test.mjs:269`.
+  - A second start on a spent decision returns `decision-consumed`, and the events, the host row and the
+    message count don't change.
+  - An open raise returns `not-authorized`. So does one resolved yes by the chief.
+  - After that there's no web2 row and no key file, and `reconcileGrants` returns [].
+  - The new public `runEnrollment` (`broker.mjs:745`) only wraps `#runEnrollment`. No verb, server
+    route or runtime op reaches it. The only other call is the resolve hook at :2445. It's the same kind
+    of trusted entry as `reconcileGrants`, and step 1 checks everything again. I accept it.
+  - The return codes don't change anything the hook depends on, because `setImmediate` ignores them.
+- B2 (G18):
+  - The host half is at `host-run.test.mjs:297`. `hg.check` with a wrong pin refuses
+    `host-key-mismatch`, and the stub `list` never runs.
+  - The broker half is at `grant-enroll.test.mjs:401`. The host stays `pending-install` with
+    `checked_at` null, and there's no `grant.host.checked`.
+- B3:
+  - G6 is at :251. A withdraw by the chief and by the human, then an arbiter resolve yes, write nothing,
+    and `runEnrollment` returns `not-authorized`.
+  - G20 is at :390. The reader is refused `read-only`, and the human's check reaches `ready` with `by`
+    `['jason']`.
+- N2 is fixed. A timeout gives '', which is not the expected line, so the writer refuses `user-sudo`,
+  logs it and exits 1.
+- N3 is fixed in the comment.
+- N4 stands as Gizmoduck says. r6:578 lists the tag only for the start reconcile's `interrupted`.
+- N5 is in the run sheet.
+
+## Notes (no block)
+
+- N8. G10's agent-resolved row goes in with `via 'broker'` (:280), so `#approvedGrant` refuses at the
+  via check and never reaches the `by` check. A second row with `via 'cli'` and `by 'chief'` would pin
+  `by == human` too. The A1 to A23 run will show whether a mutant on the `by` check survives. If one
+  does, this is the test to add.
+- N9. G18's control (:310) calls `runHost` with the fixture's entry, not `hg.check` with the right pin.
+  So it shows the stub works, but not that `hg.check` passes the record's keys through when they're
+  right. E4's broker tests use a fake check, so nothing runs `hg.check` end to end with a good pin. That
+  could be a small follow-up, or the #433 VM covers it.
+
+## My runs
+
+In a detached worktree of ad7373c1b, pass/fail:
+
+| file | result |
+| --- | --- |
+| bus grant-enroll | 24/0 |
+| bus host-run | 24/0 |
+| bus host-tools | 6/0 |
+| bus grant-migration | 5/0 |
+| bus hard-waits | 13/0 |
+| bus project-runtime | 3/0 |
+| bus credentials | 5/0 |
+
+`mosaic-keys-write` parses under python3 -I. I ran no suite and no mutant.

docs/SESSIONS.md

@@ -1436,3 +1436,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T03:03Z | Duckworth (Opus 5.5) | row 241 round 1 on Megavolt 3e3ed303e (duckworth-0080) | approve, no findings |
 2026-10-21T03:44Z | Duckworth (Opus 5.5) | row 234 early code read on Gizmoduck f4de24d39 (duckworth-0081) | changes: B1 G10, B2 G18, B3 G6 withdraw/arbiter and G20 human leg untested, N1-N7 |
 2026-10-21T03:46Z | Duckworth (Opus 5.5) | row 242 round 1 on Megavolt 635c10924 (duckworth-0082) | approve, N1-N4 |
+2026-10-21T03:51Z | Duckworth (Opus 5.5) | row 234 early read follow-up on Gizmoduck ad7373c1b (duckworth-0083) | B1-B3 resolved, N8-N9 |