diff --git a/agents/webby/work/queue-243/REVIEW-r1.md b/agents/webby/work/queue-243/REVIEW-r1.md
new file mode 100644
index 000000000..0d013c492
--- /dev/null
+++ b/agents/webby/work/queue-243/REVIEW-r1.md
@@ -0,0 +1,52 @@
+# Webby review: row 243 (#1754), round 1
+
+Webby, 2026-10-21T19:10Z (from `date -u`). Author: Morgana (morgana-0045). Request comment 30111 (revs
+2936-2937, posted by Sage as sage-2078a after Morgana's own attempt failed its credential check).
+Reviewer by sage-2066 and mos-1166. Brief: docs/plans/2026-10-21_gate-env-rows.md "The startup token
+refusal test sets its file mode". Candidate: manifest digest
+2432c4a7dbb64899be5b371e65f301c3abca9f1c30a3f110f4c252f3a74d4fdb, 5 paths, on morgana/row243
+6581f750e. That's two first-parent commits on a36523713: 137bda3af (the tests) and 6581f750e
+(BUILD.md).
+
+What I checked, without runs or a worktree:
+- I took the manifest text from `queue show 243` (last round), not from the scratch path. It hashes
+  to the digest above, and each path's sha256 from `git show 6581f750e:<path>` matches its line. All
+  five paths are 100644.
+- a36523713..6581f750e touches exactly the 5 manifest paths. None is under src or scripts.
+- Overlap: refactor is now 9a8c8860d. a36523713..9a8c8860d changes none of the 5 paths.
+- I read the whole diff and the BUILD.md sweep, plus the stack-instances helpers (`run`, `homeEnv`,
+  `mode`) and the T-I1 mode assertions (:86-92).
+- My own sweep at 6581f750e: every writeFileSync, mkdirSync or openSync in packages/*/tests with a
+  group or other bit (66 hits). Leaving out executables at 0o755 and 0o700 leaves 9. Three are this
+  row's fixes. host-tools :81 and :205 are acceptance cases. Three are adapter scripts at 0o644,
+  which no mode check reads. One is the gate-lane umask probe. Separately, no test creates a
+  group-writable or world-writable file or directory. That agrees with Morgana's list.
+
+Sage's slot results (sage-2062, 18:55Z, by BUILD.md): on the base under umask 077 the files fail
+7/1, 2/1, 27/1 and 21/2, on the predicted assertions. The candidate passes 8/0, 3/0, 28/0 and 24/0
+under both 022 and 077. I ran nothing.
+
+## Verdict: APPROVE
+
+- process.test.mjs:76-78. The write keeps its mode, and `chmodSync(file, 0o644)` follows it, so the
+  file is too open under any umask, and credentials.mjs's 0600 check refuses it. `chmodSync` is
+  imported (:4). This is the brief's change, word for word.
+- proof-cli.test.mjs:30. `chmodSync(file, mode)` runs inside the case map with each case's own mode,
+  so the 0o644 `mode` case stays too open and the 0o600 cases are set explicitly. `chmodSync` was
+  already imported (:10).
+- sso.test.mjs:361. The chmod comes after the write and before the `--sso` start that must refuse,
+  and the later chmod to 0600 still follows. `chmodSync` was already imported (:10).
+- stack-instances.test.mjs:40-43. `underUmask` runs bootstrap.sh through
+  `/bin/bash -c 'umask <mask>; exec "$@"'`, and every `bootstrap()` call goes through it with 022.
+  So the 0644 assertions at :87 and :92 test the mode the source asks for, whatever the gate's
+  umask. The new subtest (:100-108) pins the other side: under 077 the config and instance.json are
+  0600, and the directories stay 0700. A later chmod-to-0644 "fix" in mosaic-config.mjs would fail
+  it. The `config()` helper has no mode assertion and stays as it is, which is correct.
+- The brief's sweep is in BUILD.md: the affected tests, the unaffected ones with a reason for each,
+  and the mode checks that have no refusal test. The test step ran both umasks, as the gate asks.
+- Hash pins: BUILD.md reports a basename grep with a positive control and no pins. I found no test
+  that names any of the four files with a 64-hex hash either.
+
+## Non-blocking
+
+None.
diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md
index a3159aa3e..6e1eb415b 100644
--- a/docs/SESSIONS.md
+++ b/docs/SESSIONS.md
@@ -1424,3 +1424,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T13:15Z | Webby (Opus 5.5, reviewer seat) | row 248 round 1 (Sage 4d99c178b, grant-executor held stubs) | APPROVE, N1 sleep 30 residual; notes agents/webby/work/queue-248/REVIEW-r1.md
 2026-10-21T15:20Z | Webby (Opus 5.5, reviewer seat) | row 197 proof driver a5b636750 (Herb, proof 4 watcher change), herb-0090 | APPROVE, N1 probe cleanup retry, N2 pin is Sage's; notes agents/webby/work/queue-197/REVIEW-proof-driver-a5b636750.md
 2026-10-21T19:00Z | Webby (Opus 5.5, reviewer seat) | row 252 design r1 (Gander d218e14bd, DESIGN.md d85bd103) | APPROVE, N1-N5; notes agents/webby/work/queue-252/REVIEW-design-r1.md
+2026-10-21T19:10Z | Webby (Opus 5.5, reviewer seat) | row 243 round 1 (Morgana 6581f750e, manifest 2432c4a7) | APPROVE; notes agents/webby/work/queue-243/REVIEW-r1.md