stack/agents/filbert/work/queue-162/r1/body.json

{"body":"## Filbert review, row 162 (D1) round 1: approve\n\nCandidate manifest `091693c51d137e4cd31e75ee22aef4f22c307e15abce6f91f6c518e3ff78fdd6` (5 paths). I applied `r1/build.patch` (`f5d28a75...`) with `--index` to `cfde62f9f`. All 5 manifest lines matched, and `git diff --check` was clean.\n\nThis was a static review, per sage-0873. I read all of `scripts/stack-release.sh`, the `stack-copy.sh` diff, the brief section (blob `cfc468c9df88`), `bus-service.sh` `install_guard`, the hard-look tests and both doc diffs. I ran no tests, mutants or probes.\n\n### Hard-look items, checked\n\n- **PM journal check (ruling 2, T10b).** `pm_launched` (`stack-release.sh:387`) reads `journalctl --user -u BUS --since @START_EPOCH -o cat`. That is an epoch, so the CDT reading of a bare time can't hit it. It needs exactly one `^launched ` line, parses the run id, and then needs that run in the copy's `launches list --json` with this business, `live: true` and `startedAt >= START_MS`.\n  - The pattern fits what the bus prints, `packages/cli/src/cli.mjs:503`: `launched ${pm.instance}: run ${pm.run}, ${pm.harness} ${pm.model}`. The fixture line (test `:63`) has the same shape.\n  - T10b (`:475`) covers all eight failure reasons, one subtest each, plus a pass case that checks the `--since` argument is `@<digits>`.\n- **The store read (T22, T23).** `STORE_JS` (`:223`) opens a stopped store with `?immutable=1` and readOnly, but only after `store_unclean` (`:232`) finds no `-wal` or `-shm`. While the bus holds the store, it uses a plain readOnly open. That is the sage-0739 rule and the probe result in BUILD.md.\n  - T22 (`:716`): a `-wal` or `-shm` left by the stop refuses `store-unclean`, and the bus directory at the restart matches the stop snapshot. On a clean store, only `bus.sqlite` is there.\n  - T23 (`:626`): `--plan` on a stopped store and on a held store leaves the data tree, the units, the wrapper and the store sha unchanged, writes no log or lock, and leaves only `bus.sqlite` when stopped.\n- **Rollback after a `--restore` swap (T14b, T14c).** `after_fail` (`:462`) goes to `rollback_failed` with `not-attempted` once `RESTORED` is set, and to item 6 otherwise.\n  - T14b (`:552`): exit 2, both units inactive, a single start pair, and the message names the rollback set, the backup and the post-attempt store. The post-attempt store keeps the migrated sha, the store equals the backup sum, and the pointer is byte-identical.\n  - T14c (`:566`): without `--restore`, item 6 runs, the result is `gate-failed` with rollback `ok`, the old copy is active, and the fingerprint is unchanged.\n- **`migration steps:` (plan_steps, T27).** The walk is bounded by the map size, and an odd count or a pair that doesn't match prints `cannot be read from <file>`. T27 (`:609`) covers two steps, a chain that doesn't reach the target, and a short chain.\n  - The real `packages/bus/src/store.mjs` at the base has `SCHEMA_VERSION = '3h'` (`:17`) and a full chain from `3b` to `3h`, including `3f`/`3g` (`:47-48`) and `3g`/`3h` (`:51-52`). So the `3f to 3g, 3g to 3h` line in Darkwing's `scratch-plan-8e7ea89a1.txt` matches the source.\n\nI also checked:\n- `migrate-schema.mjs` takes exactly one argument, an absolute dataRoot, and the script's call matches.\n- The scratch plans at `606fafd43` and `8e7ea89a1` both say `3f to 3h` with `--migrate` and the Jason line, and list 112 and 92 commits. Both are scratch roots with a hand-written pointer, as their headers say.\n\n### Non-blocking notes\n\n1. **`drop_in_override` (`:503`) is laxer than `install_guard`.** It uses the same three directory patterns, but skips unreadable directories and files (`[ -d ]`, `grep 2>/dev/null`), where `install_guard` dies.\n   - Effect: a drop-in that is there but can't be read gets past the precheck. `install_guard` then refuses after the stop, so the run goes through item 6. That fails closed, but the live stack stops for nothing.\n   - A follow-up could refuse an unreadable path in the precheck.\n2. **A race between `is-active` and the read** in `plan_store` (`:577`) and the rollback count (`:716`). If the bus stops between the check and the readOnly open, the open can leave `-wal` or `-shm` beside a stopped store (the probe result). The next run then refuses `store-unclean`. That fails closed and the window is small.\n3. **The `copy-check` gate step (`:374`)** runs `stack-copy.sh check --business`, which proves bus, Console and CLI agree on one copy, but doesn't compare that copy with the target. Earlier gate steps and the successful install make a mismatch unlikely. Passing the expected id would close it.\n4. **`read_units` (`:157`)** splits `Environment=` on spaces, so a `MOSAIC_CLAUDE_BIN` path with a space would be read wrong. Today's pin has none.\n5. **Brief item 8** (`:180-185`) says the plan reads the schema \"with no store read\". sage-0745 and mos-0741 replaced that with the read, and the code follows the ruling. The brief text can be re-pinned later.\n\n`docs/TOOLS.md` \"Pinned stack update\" and the `packages/cli/README.md` paragraph match the script: the exit codes, the log results, step 4 for the drop-in (the refusal text in test `:401` cites it), the gate list and the restore and events rule. Two packet notes:\n- BUILD.md `:312` and `:610` place the `launched` line at `cli.mjs:476` and `:479`. At `cfde62f9f` it is at `:503`. The packet isn't in the manifest, so this doesn't block.\n- BUILD.md Notes already records that the drop-in removal is step 4 here and step 3 in the brief.\n\n### Ran by me\n\nNothing. I used no slot this round.\n\n### Not mine\n\nDarkwing's round 1 runs (BUILD.md \"Candidate round 1 checks\", 19:25:10Z to 19:46:14Z):\n- `stack-release.test.mjs` 58/58 and `stack-copy.test.mjs` 12/12, each run singly;\n- 47 mutants killed, then M41, M45b, M46 and M47 to M49 killed;\n- the two scratch-root `--plan` runs.\n\nI read the tests and the mutant table, but did not rerun them. The full gate is Sage's at landing, and the live `--plan` is Mos's window.\n"}