plans: brief for the config_checks follow-up (row 270 rollback hazard, duckworth-0226, sage-3038)

docs/plans/2026-10-22_config-checks-any-key-brief.md

@@ -0,0 +1,58 @@
+# Brief: stack-release.sh config_checks runs the target loader on any config
+
+Sage, 2026-10-22. Builder per mos-1353. Follows `docs/plans/BRIEF-TEMPLATE.md`. Raised by Duckworth's row 270 round 2 review
+(duckworth-0226, rollback hazard), ruled a follow-up row by Sage (sage-3038).
+
+## stack-release.sh config_checks runs the target loader on any config (row 270 rollback hazard)
+
+### Problem
+
+`config_checks` in `scripts/stack-release.sh` (the row 200 item 3 check, about :1079-1097 at 62a279cf3)
+runs the target copy's `scripts/mosaic-config.mjs validate` only when config.json holds a `console`
+key. Row 270 (264c, #1775) adds two human-only system config keys, `compactionReadBytes` and
+`compactionStreams` (mos-1352, sage-3038), and `mosaic-config.mjs` rejects unknown keys. A re-pin or
+rollback to a copy from before 270, with either key set and no `console` key, passes `config_checks`.
+The bus, the Console and the seats then fail closed on their next config read. The same holds for any
+later key an older loader doesn't know.
+
+### Owner and reviewer
+
+- Owner: Gander (mos-1353).
+- Reviewer: Duckworth (found the hazard, duckworth-0226; mos-1353).
+- After: rows 270, 271 and 203. All three change `scripts/stack-release.sh` or the config loader.
+
+### Files owned
+
+`scripts/stack-release.sh` (`config_checks` and its comment only), `packages/cli/tests/stack-release.test.mjs`,
+`docs/TOOLS.md` (the release check line, if it names the console key) and the packet
+`agents/gander/work/queue-<row>/`.
+
+### What ships
+
+- `config_checks` runs the target's loader `validate` whenever the config file exists and parses, not
+  only when it holds a `console` key. A file that doesn't parse still refuses as it does today. A
+  missing file still passes. A target with no `scripts/mosaic-config.mjs` refuses only when the config
+  holds any key beyond what the oldest copies accepted. Name that set from the copies, or refuse and
+  say so in BUILD.md.
+- The refusal text names the key the loader refused and keeps the "restore the config.json backup"
+  instruction.
+- Tests: a fixture target loader that rejects a non-console key refuses activate and rollback; a
+  loader that accepts it passes; the console-key cases keep passing unchanged; a mutant that restores
+  the console-only skip is killed.
+- `stack-release.test.mjs` whole, the cli suite and every `scripts/test-*.sh` are green.
+
+### Out of scope
+
+The row 270 keys themselves (row 270). Writing or removing config keys in any window (windows remove
+keys by hand, per Duckworth's row 270 C1, until this lands). Console flags and pointer handling.
+
+### Gate
+
+Duckworth approves the manifest. The touched test files run whole, the cli suite and every
+`scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
+
+### Handoffs
+
+Every seat hands off directly (DECISIONS Q210, mos-1221). When the owner pushes a build or a new
+round, or the reviewer posts a verdict, that seat messages the next seat's T3 thread and Sage's with
+`mcp__t3__t3_send_message`. Copy Mos's thread only when Mos has a step.