## Row 49 round 1 review (Filbert): approve

Candidate: manifest sha256 `87ef1321a1a08be64a20499889fc24b5549b47d6d33abfd86db95f62fb3cb6d0` (17 paths), packet agents/rocko/work/queue-49/r1/ in ea5e70fa8, base.txt 7b166a0f1.

Rebuild: a fresh worktree at 5f457b2ff (current refactor) with build.patch applied. Every manifest hash matched and `git diff --check` was clean. The added lines have no dash, curly-quote or control characters. The packet manifest checks. No commit from 7b166a0f1 to 5f457b2ff touches a manifest path, so the candidate is the same on the current base.

### What I checked and found correct

- **Brief test.** comment-restart.test.mjs test 1 stops the bus, posts a comment with the clock moved three hours before and after it, restarts, and sees exactly one event. A tick and a reconcile after that add none.
- **Durable state.** Cursor rows, snapshots and events commit in one `recordTask` transaction. `lastComment`, `commentsAt` and `commentCount` advance only after `record` returns. Tests 3 and 4 cover a crash after commit and a failed event insert.
- **Row growth.** A row is appended only when the observed maximum id rises. The forward trigger rejects anything else. Bot comments advance the cursor but don't count toward events.
- **Startup.** The adapter restores cursors from `taskView(name, 'comments')`. The first reconcile reads the comment list for every task, because no count is cached yet.
- **Authority.** `recordTask` refuses `commentCursors` from a capability caller (`agent-required`), so only the sync path writes them.
- **Migration.** Normal startup refuses a 3b store. `migrate-schema.mjs` checks each step's source digest, metadata, WAL mode, integrity and times, and applies the DDL, version, digest and epoch in one transaction. It refuses a missing store. The `meta_no_update` guard is dropped and recreated inside that transaction, and the final digest check covers it. store.mjs replays the chain at import and refuses if it doesn't reach the schema digest.
- **land-work.** read.mjs imports `SCHEMA_VERSION` instead of its own '3b', so the version has one source.

### Sage's note (28559)

I'm approving as is, so the migration test's version pins stay and row 123's eight-line edit lands with row 123, per the ruling.

### Notes (non-blocking)

1. **A task read twice in one pass aborts the pass.** `foreignComments` no longer updates `lastComment` during the loop. If one task id appears in two project reads in the same tick or reconcile and has a new comment, both reads push the same cursor. The forward trigger rejects the second insert, and the whole `recordTask` rolls back. My probe on the candidate store: two equal inserts for one task in one transaction give "comment cursor must advance" and zero rows. `walk` refuses duplicates inside one project, and `ctx.tree` has one entry per project, so this needs a move between two project reads. The next pass recovers and nothing is lost or duplicated. A follow-up could keep the highest cursor per task in `out` instead.
2. **land-work and the live bus between landing and migration.** Once this lands, read.mjs from any tree at or after it refuses a 3b bus with `bus-schema` until Mos migrates the live store. This fails closed. MIGRATION.md doesn't mention it, so Sage may want it in the window plan if a land-work run could fall in that gap.

### What I ran and what I took from receipts

**I ran**, as single files with TMPDIR set and Docker disabled:

| Test file | Result |
|---|---|
| bus comment-cursors | 2/2 |
| bus comment-migration | 5/5 |
| bus schema | 1/1 |
| bus store | 6/6 |
| bus tasks | 9/9 |
| bus task-read | 3/3 |
| tasks comment-restart | 5/5 |
| tasks sync | 11/11 |
| tasks tree | 19/19 |
| tasks adapter | 8/8 |
| tasks startup | 9/9 |

I also ran the duplicate-cursor probe above.

**From Rocko's receipts, not rerun by me:**
- the targeted gate in gate/results.json: bus 178, tasks 97, cli 195, webui 112, harness 84, seat 132, test-land-work 84/0;
- 22 of 22 mutants killed in MUTANTS.md.

I didn't run test-land-work.sh or any full suite, and I took no slot. The brief's full shell gate is Sage's landing gate.