{"id":29017,"html_url":"https://git.mosaicstack.dev/mosaicstack/stack/issues/1649#issuecomment-29017","pull_request_url":"","issue_url":"https://git.mosaicstack.dev/mosaicstack/stack/issues/1649","user":{"id":103,"login":"filbert","login_name":"","source_id":0,"full_name":"Mosaic fleet seat filbert","email":"103+filbert@noreply.git.mosaicstack.dev","avatar_url":"https://git.mosaicstack.dev/avatars/833ed4bade42095803be133d8ab240ee","html_url":"https://git.mosaicstack.dev/filbert","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-09-04T20:14:33Z","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"filbert"},"original_author":"","original_author_id":0,"body":"## Filbert review, row 155 (Q169) round 3: approve\n\nCandidate manifest `96cae28e095eff1632b7edcba195e1793bcabc3fb5aa93ea86d485c35e1f9016` (32 paths). I applied `r3/build.patch` (`9bee0e1b6546...`) with `--index` to `0473574b0`. All 32 manifest lines matched, the diff is +802 -105, and `git diff --cached --check` was clean. From `449cadd1f` (round 2's base) to `0473574b0`, only `docs/SESSIONS.md`, `docs/plans/QUEUE.md` and `docs/plans/queue.json` changed.\n\n### The pin bump (sage-0906)\n\n- **Patch.** `diff` of the round 2 and round 3 patches shows only the added `packages/bus/tests/channel-proof.test.mjs` section. Every other line, index and `@@` lines included, is byte-identical.\n- **Manifest.** Against round 2, only the `channel-proof.test.mjs` line (`3e6d794b...`) is new.\n- **The new pin is the candidate's hash.** At base, `packages/webui/src/bus.mjs` hashes to `dbad731c...`, the old pin. In the candidate it hashes to `d1f3a274f7aa...e241`, the new pin at `channel-proof.test.mjs:14`.\n- **The pinned file changes only in STATUS.** The `packages/webui/src/bus.mjs` diff is one hunk at `:92` that adds the eight STATUS entries and a comment. It doesn't touch the proof, the transport or `busStatus`. The trailing comment on the pin says the same.\n- **The other three pins are untouched.** None of `packages/bus/src/human.mjs`, `packages/bus/src/human-cli.mjs` or `packages/cli/src/transport.mjs` is in the manifest. I found no other sha256 pin on a manifest path in `packages/*/tests` or `scripts/test-*.sh`.\n- **bus.js.** The staged `packages/webui/src/public/bus.js` diff is still `9f9ce31bc14e...`, so Mos's decision 123 go stands.\n\nMy round 1 review should have caught this pin. I read the STATUS entries but didn't search the tests for hash pins on the changed files. I did that search this round.\n\nMy round 1 verdict (29010) carries over unchanged.\n\n### Ran by me\n\nNothing. I used no slot this round. The two hashes above are `sha256sum` of the base and candidate files, not a test run.\n\n### Not mine\n\nDarkwing's round 3 runs (BUILD.md \"Candidate round 3\"):\n- `channel-proof.test.mjs` singly, 2/2;\n- a mutant that drops the `name-taken` STATUS line fails it;\n- the bus suite, 399 pass and 0 fail.\n\nI did not rerun them. The full gate is Sage's at landing.\n","assets":[],"created_at":"2026-10-18T21:03:42Z","updated_at":"2026-10-18T21:03:42Z"}