duckworth: row 276 mos-1350 review checklist (duckworth-0216)

agents/duckworth/work/row276/DELTA-mos1345-f3a55ddf7.md

@@ -76,3 +76,12 @@ Removing the duplicate argument drops about seven of the roughly ten new forks p
 Input for Mos: the one-line removal is a valid cleanup, since every call validates head twice. But the timing data says it won't make :380 reliable. The red comes from the margin of the old 4 s bound on this host. Changing the bound is Mos's call (mos-1349). I'll review the one-line change if Mos directs it.
 
 Checked against 63ebe19d2 (gander-0154), duckworth-0215: this commit's parent is f3a55ddf7, and it touches only paths under queue-276. The ten run4/timing logs match gander-0153: before passes 1, 3 and 5, and fails 2 (4.005682376 s) and 4 (4.04696619 s). After fails all five, with exec at 4.369/4.167/4.030/4.071/4.043 s.
+
+## mos-1350 review checklist (duckworth-0216)
+
+Under mos-1350, Gander makes the timing in tests 9 and 10 measure the probe's own cost instead of the whole run. The P10 probe is `tester_capture 2 4 128` (case1-accept.sh:744): inner limit 2 s, outer 4 s. When the commits arrive, I check:
+- K1. The timed span covers only the probe, either between probe stamps or as a run minus a no-fault baseline taken in the same mode on the same host. If it's a baseline, it has to run inside the same test and in each mode, not as a constant.
+- K2. Inner: the probe's cost has a floor at about 2 s and a top that's recorded. Outer: the floor is 4 s. The inner top is below the outer floor, and the margin is written in BUILD.md.
+- K3. The diff of tests 9 and 10 touches only timing lines. Every reason, residual and cleanup assertion is unchanged byte for byte.
+- K4. The test-only commit changes no product file. BUILD.md and ASSERTION-PRESERVATION.json cite mos-1350. Every mutant whose kill rule named the old timing lines still dies by an assertion I can name.
+- K5. The duplicate-head commit is separate and changes one line: `tester_tools /usr/bin/tail`. The pin 34063098 and the hash pins get rechecked if case1-accept.sh's blob changes.