docs(release): record static approval and post-compaction review conditions

agents/gander/work/config-checks-any-key/ASSERTION-PRESERVATION.json

@@ -0,0 +1,7 @@
+{
+  "base": "01983cd3f",
+  "test": "packages/cli/tests/stack-release.test.mjs",
+  "base_is_byte_exact_prefix": true,
+  "old_assertions_changed": 0,
+  "old_console_refusal_text_unchanged": true
+}

agents/gander/work/config-checks-any-key/BUILD.md

@@ -0,0 +1,48 @@
+# Target config validation for every key implementation plan
+
+Goal: #1797, mos-1353, brief f0e3dcdf4:docs/plans/2026-10-22_config-checks-any-key-brief.md. Base01983cd3f, branchgander/config-checks-any-key. Reviewer Duckworth. Queue number pending Sage; packet moves to queue-N when assigned. No Node, test or push before Sage gap/CLEAR. Rows270/271/203 land first; rebase under a new branch name before the gate.
+
+Architecture: config_checks classifies missing/parseable/unreadable config independently of console presence. With a loader, every existing parseable config goes through the target's own validate. Missing config passes. Malformed JSON refuses. With no loader, allow only the oldest four top-level keys: configVersion, environment, dataRoot, execution. Evidence: c3d29e796:scripts/mosaic-config.mjs:114, the first loader commit, rejectUnknownKeys; row200 fixture's LOADER_OLD has the same list. A missing loader plus a later key refuses and names that key, without inventing validation support. The legacy public refusal code config-console-key and existing console-specific message stay byte-identical; new non-console refusals name the loader's first diagnostic and preserve restore-config-backup instruction. The target loader's resolved stdout is discarded. Its first stderr diagnostic is reported and may echo an invalid value.
+
+Files: scripts/stack-release.sh config_checks/comment only; packages/cli/tests/stack-release.test.mjs appended regression coverage only; docs/TOOLS.md broadens the current console-only release-check description. Existing row200 tests and assertions stay unchanged. No fixture-module edit, flags, pointers, migration, schema, data, live unit or host change.
+
+Tests to write before implementation, unrun until CLEAR:
+- A target loader rejecting a non-console key refuses activate and rollback before any unit stop/start, pointer/unit/store mutation; one refused log entry; --plan preserves state and lists refusal. Reuse refused() and planOnly(). Use execution, already known to the current loader, to prove console-free dispatch before row270 integration; add compactionReadBytes/compactionStreams cases on final post270 base if needed.
+- An accepting target loader is actually called with validate and the selected MOSAIC_CONFIG, succeeds activate/rollback without console, and resolved stdout is not leaked.
+- Missing-loader target permits oldest-key config but rejects a later key with backup instruction. A stand-in rejecting the existing execution key exercises the generic target-validation branch; missing-loader later-key test may use console until final post270 base supplies non-console new keys.
+- Missing file passes the isolated real config_checks function; malformed JSON refuses there, since load_config otherwise exits before this function. Tests extract only that function and provide copies/path/check_refuse stand-ins, never live state.
+- Existing console-key row200 tests and malformed-load test run whole unchanged.
+
+Mutants, each unique target, syntax preflight and byte-identical restore:
+M1 restores the console-only skip, killed by the named non-console activate/rollback refusal test.
+M2 ignores failed target validation, killed by the same refusal assertions.
+M3 allows a missing-loader target with a later key, killed by the explicit missing-loader regression.
+M4 treats malformed JSON as absence, killed by isolated parse guard test.
+M5 skips the loader for an oldest-key config, killed by accepting-loader invocation witness.
+
+Gate after static review and required rebases: intended RED/GREEN; touched stack-release.test.mjs whole, CLI suite whole and every scripts/test-*.sh whole; M1-M5 with fresh passing controls, no timeout counted as kill, restored bytes/status before next. TMPDIR mktemp-d /mnt/storage/scratch/tmp/gXXX; pipefail/tee and busy check before each start. Node timeout-k10 uses at least3x measured duration plus margin; stack-release prior full receipt around584s implies at least1871s, to be recorded from actual receipts before CLEAR. Shell3x table retained with receipts. No test ran and no behavior passes claimed.
+
+Review focus: parser races after load_config; target stderr naming only the refused key, stdout never persisted; current versus target loader selection; unknown key with no console; missing loader compatibility set from immutable history; upcoming row270 loader-list fixture drift. Final integration audits every test dependency and hash pin against the named base. Session registration remains Sage's.
+
+
+Implementation ready, unrun. Four appended tests cover full activate/rollback refusal and plan; actual accepting validate witness/configpath and stdout nonleak; oldest-only missing loader with both compaction keys; missing/invalid JSON isolated realfunction. Stand-in loaders are ESM, matching .mjs. Every old test byte is preserved as a prefix. Existing console refusal text including missing-loader diagnostic is unchanged. Missing-loader compatibility is top-level key compatibility only; current load_config still validates the whole config before normal release operations. Three-path manifest, no fixture-module changes. Static target uniqueness M1-M5 passes. No Node parse, Bash execution or behavior run. Exact full compaction activate/rollback cases must be added against post270 loader, before final gate.
+
+
+Execution state:
+- [x] Read brief, config_checks and row200 assertions.
+- [x] Pin oldest key set from immutable loader history.
+- [x] Write regression tests, implement bounded scope, prepare unique mutants.
+- [ ] Duckworth static review.
+- [ ] Move packet to queue-N on assignment, rebase after270/271/203 and add full compaction-key cases.
+- [ ] On CLEAR run intendedRED/GREEN, touched whole file, CLI whole, M1-M5, ten shells; commit/push records only when authorized.
+
+
+## Duckworth0229 static approval, gate conditions
+
+Source0585b3213, packet e7371025f, manifestd6226d28 approved by static read, note a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md. No runtime proof yet.
+
+C1: after270/271/203 land, rebase under a new branch name and open a new static round. Add exact compactionReadBytes and compactionStreams full activate/rollback refusals. The existing LOADER_OLD uses the current loader plus concat after270, so it is not a pre270 witness; the new test requires its own pre270 stand-in. Reviewer checks the integrated manifest/test before CLEAR. N3 joins that delta: compactionStreams fixture value1024, matching the real type, instead of ['messages'].
+
+C2: every existing B/C1/C release now validates its copied real loader, including external/upgrade suites. Any old CLI red is a change-related suspect and goes to Mos/Sage under mos-1272; no automatic placement as an unrelated fixture.
+
+N1 console plus another refused key retains the old console text by design. N2 missing-loader wording is retained pending final integration review. N4 corrected above: only resolved stdout is suppressed; first stderr may echo a value, so no blanket secrecy claim. No runtime/Node/queue/push authorization is inferred from static approval.

agents/gander/work/config-checks-any-key/MANIFEST.sha256

@@ -0,0 +1,3 @@
+eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517  docs/TOOLS.md
+a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59  packages/cli/tests/stack-release.test.mjs
+f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150  scripts/stack-release.sh

agents/gander/work/config-checks-any-key/REVIEW-STATUS.json

@@ -0,0 +1,9 @@
+{
+  "reviewer": "duckworth",
+  "verdict": "static approve, conditions C1-C2",
+  "message": "duckworth-0229",
+  "source": "0585b3213",
+  "manifest": "d6226d28",
+  "note": "a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md",
+  "next": "wait for row number and post270/271/203 base, new integration static round before gate"
+}

agents/gander/work/config-checks-any-key/SHAS.json

@@ -0,0 +1,5 @@
+{
+  "docs/TOOLS.md": "eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517",
+  "packages/cli/tests/stack-release.test.mjs": "a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59",
+  "scripts/stack-release.sh": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150"
+}

agents/gander/work/config-checks-any-key/SOURCE.json

@@ -0,0 +1,14 @@
+{
+  "issue": 1797,
+  "row": "pending Sage assignment",
+  "branch": "gander/config-checks-any-key",
+  "base": "01983cd3f",
+  "source": "0585b321309e4d8a199afb1a1024cf6091f56770",
+  "manifest": "d6226d281c778677a45e90993bbd9c985de89ba0f870d4a3ca12b6923a497e4a",
+  "runtime": "NOT RUN; no Node, tests or push authorized",
+  "after": [
+    270,
+    271,
+    203
+  ]
+}

agents/gander/work/config-checks-any-key/UNIQUENESS.json

@@ -0,0 +1,32 @@
+[
+  {
+    "id": "M1",
+    "occurrences": 1,
+    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
+    "after": "804a86442527f2728f633f485eaeca02552df66a34350eac5101127046415188"
+  },
+  {
+    "id": "M2",
+    "occurrences": 1,
+    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
+    "after": "1c2acb6397e29ab898d8a89bc5bc691a294be749ca7d7f7897c83ec1b3e9f9ef"
+  },
+  {
+    "id": "M3",
+    "occurrences": 1,
+    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
+    "after": "954c9a9735904e1c566d844001b2e85c13cd16eb16e7b4b91b752974bb6dc754"
+  },
+  {
+    "id": "M4",
+    "occurrences": 1,
+    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
+    "after": "953d91bf28073b11e4bc5a6da516a0db1b8dfff892083cd3e6fcebe9c47b6bbf"
+  },
+  {
+    "id": "M5",
+    "occurrences": 1,
+    "before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
+    "after": "310c32b16f0fc554d5a7ffeeb0742ea7dd9fc84e1ddafabb25d7ca3f449865ef"
+  }
+]

agents/gander/work/config-checks-any-key/changes.json

@@ -0,0 +1,37 @@
+[
+  {
+    "id": "M1",
+    "file": "scripts/stack-release.sh",
+    "old": "    [ \"$key\" != 1 ] || return 0\n    if [ \"$key\" != 0 ]; then",
+    "new": "    [ \"$key\" != 1 ] || return 0\n    [ \"$extra\" = '\"console\"' ] || return 0\n    if [ \"$key\" != 0 ]; then",
+    "killer": "config-any-key: a non-console target refusal"
+  },
+  {
+    "id": "M2",
+    "file": "scripts/stack-release.sh",
+    "old": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\"; then return 0",
+    "new": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\" || true; then return 0",
+    "killer": "config-any-key: a non-console target refusal"
+  },
+  {
+    "id": "M3",
+    "file": "scripts/stack-release.sh",
+    "old": "        [ -n \"$extra\" ] || return 0",
+    "new": "        return 0 # drop missing-loader later-key refusal",
+    "killer": "config-any-key: missing-loader copies"
+  },
+  {
+    "id": "M4",
+    "file": "scripts/stack-release.sh",
+    "old": "    if [ \"$key\" != 0 ]; then\n        check_refuse config-console-key",
+    "new": "    if [ \"$key\" = 99 ]; then\n        check_refuse config-console-key",
+    "killer": "config-any-key: missing config passes but malformed JSON refuses"
+  },
+  {
+    "id": "M5",
+    "file": "scripts/stack-release.sh",
+    "old": "    if [ ! -f \"$loader\" ]; then",
+    "new": "    [ -n \"$extra\" ] || return 0\n    if [ ! -f \"$loader\" ]; then",
+    "killer": "config-any-key: accepting loaders run validate"
+  }
+]

docs/TOOLS.md

@@ -632,9 +632,12 @@ onto the pointer's copy from the target, past any same-copy re-pin, checked
 against the set's `SHA256SUMS`. `--send` and `--tester-port` follow the pointer.
 When that set is missing, fails its sums, holds no readable argv or already ran
 `--sso`, the run refuses `sso-rollback-flags`. Any activate or rollback also
-refuses `config-console-key` before anything stops when the config holds a
-`console` key the target's `scripts/mosaic-config.mjs validate` refuses (a copy
-before row 192 refuses the key). The message says to remove the key first. So a
+refuses `config-console-key` before anything stops when the target's
+`scripts/mosaic-config.mjs validate` refuses the config, including a non-console
+key. Every existing parseable config is checked; a missing file passes. A target
+without a loader accepts only the oldest top-level keys: `configVersion`,
+`environment`, `dataRoot`, and `execution`; any later key refuses. The refusal
+names the rejected key and says to restore the config.json backup first. So a
 window re-pins to row 192 or later before it writes the key, and a rollback past
 row 192 removes the key first.
 

packages/cli/tests/stack-release.test.mjs

@@ -2585,3 +2585,60 @@ test('row196 rehearsal selects socket only for marked copies and uses scratch da
   assert.equal(untouched(e),before);
  });
 });
+
+// #1797: validate every config with the target loader, even without console.
+function anyConfigLoader(file,text){
+ const old=existsSync(file)?readFileSync(file):null;
+ if(old!==null)chmodSync(file,0o644);
+ mkdirSync(dirname(file),{recursive:true});writeFileSync(file,text);
+ return ()=>{if(old===null)rmSync(file);else{writeFileSync(file,old);chmodSync(file,0o444);}};
+}
+const ANY_CONFIG_MSG=(e,to,op,why)=>`${e.cfg} is refused by ${to}'s loader (${why}); remove the refused key first (restore the config.json backup from the window's step 1), then run the ${op} again`;
+test('config-any-key: a non-console target refusal stops activate and rollback before any stop',async t=>{
+ const e=await mk(t);await seed(e);
+ let r=await run(e,'activate',C1,'acme');assert.equal(r.code,0,r.out+r.err);
+ const why='mosaic-config: unsupported configuration key: "execution"';
+ const undo=anyConfigLoader(join(COPIES,B,'scripts/mosaic-config.mjs'),`console.error(${JSON.stringify(why)});process.exitCode=2;\n`);
+ try{
+  assert.equal(Object.hasOwn(JSON.parse(readFileSync(e.cfg,'utf8')),'console'),false);
+  for(const op of ['activate','rollback']){
+   const args=op==='activate'?['activate',B,'acme']:['rollback','acme'];
+   await refused(e,args,'config-console-key',ANY_CONFIG_MSG(e,B,op,why));
+  }
+  const out=await planOnly(e,3,'rollback','acme');
+  assert.deepEqual(out.filter(l=>l.startsWith('refuses ')),[`refuses config-console-key: ${ANY_CONFIG_MSG(e,B,'rollback',why)}`]);
+ }finally{undo();}
+});
+test('config-any-key: accepting loaders run validate with the selected config on activate and rollback',async t=>{
+ const e=await mk(t);await seed(e);const witness=join(e.root,'loader-calls.jsonl'),canary='resolved-config-must-not-leak';
+ const undos=[B,C1].map(id=>anyConfigLoader(join(COPIES,id,'scripts/mosaic-config.mjs'),`import fs from 'node:fs';fs.appendFileSync(${JSON.stringify(witness)},JSON.stringify({copy:${JSON.stringify(id)},args:process.argv.slice(2),config:process.env.MOSAIC_CONFIG})+'\\n');console.log(${JSON.stringify(canary)});\n`));
+ try{
+  for(const args of [['activate',C1,'acme'],['rollback','acme']]){
+   const r=await run(e,...args);assert.equal(r.code,0,r.out+r.err);assert.equal((r.out+r.err).includes(canary),false);
+  }
+  assert.deepEqual(lines(witness).map(JSON.parse),[
+   {copy:C1,args:['validate'],config:e.cfg},{copy:B,args:['validate'],config:e.cfg},
+  ]);
+ }finally{for(const undo of undos)undo();}
+});
+function isolatedConfigChecks(e){
+ const source=readFileSync(SR,'utf8'),body=source.split('config_checks() {')[1]?.split('\n}\n')[0];assert.ok(body,'config_checks exists');
+ return spawnSync('bash',['-c','config_checks() {'+body+'\n}\ncheck_refuse(){ printf "%s: %s\\n" "$1" "$2" >&2; exit 3; }; config_checks'],{
+  encoding:'utf8',env:{...e.env,COPIES:join(e.root,'target-copies'),TO:'old',OP:'activate'},
+ });
+}
+test('config-any-key: missing-loader copies accept only the four oldest keys',async t=>{
+ const e=await mk(t);let r=isolatedConfigChecks(e);assert.equal(r.status,0,r.stderr);
+ const original=JSON.parse(readFileSync(e.cfg,'utf8'));
+ for(const [key,value] of [['compactionReadBytes',1048576],['compactionStreams',['messages']]]){
+  writeFileSync(e.cfg,JSON.stringify({...original,[key]:value}));r=isolatedConfigChecks(e);
+  assert.equal(r.status,3,r.stderr);assert.match(r.stderr,new RegExp(`configuration key: "${key}"`));
+  assert.ok(r.stderr.includes('restore the config.json backup from the window\'s step 1'));
+ }
+});
+test('config-any-key: missing config passes but malformed JSON refuses without calling the loader',async t=>{
+ const e=await mk(t),file=join(e.root,'target-copies/old/scripts/mosaic-config.mjs'),witness=join(e.root,'validate-called');
+ mkdirSync(dirname(file),{recursive:true});writeFileSync(file,`import fs from 'node:fs';fs.writeFileSync(${JSON.stringify(witness)},'called');\n`);
+ rmSync(e.cfg);let r=isolatedConfigChecks(e);assert.equal(r.status,0,r.stderr);assert.equal(existsSync(witness),false);
+ writeFileSync(e.cfg,'{');r=isolatedConfigChecks(e);assert.equal(r.status,3,r.stderr);assert.match(r.stderr,/cannot be read as JSON/);assert.equal(existsSync(witness),false);
+});

scripts/stack-release.sh

@@ -1073,27 +1073,34 @@ slot_problem() {
     [ "$size" != 0 ] || echo "is empty"
 }
 
-# Row 200 item 3 and the design's phase 2 rollback order: a config.json with a `console` key must be
-# one the target's loader reads, or its bus, Console and seats fail on their next read. Runs the
-# target's own scripts/mosaic-config.mjs validate; its output, the resolved config, is not kept.
+# Row 200 item 3 and #1797: every existing parseable config must be one the
+# target loader reads. Older copies without a loader accept only the four keys
+# in c3d29e796's first loader. Resolved config stdout is never kept.
 config_checks() {
-    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first
-    # 0: a console key; 1: no key, or no file; 2: the file doesn't parse, so whether it holds the key
-    # is unknown, and the run refuses rather than pass it (webby-0028 N2). load_config already exits on
-    # such a file before anything is read or stopped, so this is reached only if the file changes after it.
+    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first extra
+    # 1: missing file; 2: unreadable JSON. This also fences a change after load_config.
     local key=0
-    node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-process.exit(d!==null&&typeof d==="object"&&Object.hasOwn(d,"console")?0:1)' -- "$cfg" 2>/dev/null || key=$?
+    extra="$(node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
+const oldest=["configVersion","environment","dataRoot","execution"];
+if(d===null||typeof d!=="object"||Array.isArray(d)){process.stdout.write(JSON.stringify("[configuration shape]"));process.exit(0)}
+const k=Object.hasOwn(d,"console")?"console":Object.keys(d).find(k=>!oldest.includes(k));if(k!==undefined)process.stdout.write(JSON.stringify(k))' -- "$cfg" 2>/dev/null)" || key=$?
     [ "$key" != 1 ] || return 0
     if [ "$key" != 0 ]; then
         check_refuse config-console-key "$cfg cannot be read as JSON, so whether $TO's loader reads it is unknown; fix the config first, then run the $OP again"
         return 0
     fi
-    if [ ! -f "$loader" ]; then out="it has no scripts/mosaic-config.mjs"
+    if [ ! -f "$loader" ]; then
+        [ -n "$extra" ] || return 0
+        if [ "$extra" = '"console"' ]; then out="it has no scripts/mosaic-config.mjs"
+        else out="it has no scripts/mosaic-config.mjs to validate configuration key: $extra"; fi
     elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0
     fi
     first="${out%%$'\n'*}"
-    check_refuse config-console-key "$cfg holds a console key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    if [ "$extra" = '"console"' ]; then
+        check_refuse config-console-key "$cfg holds a console key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    else
+        check_refuse config-console-key "$cfg is refused by $TO's loader ($first); remove the refused key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    fi
 }
 
 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose