stack/agents/filbert/work/queue-33/build.md

# Queue row 33 build notes (#1508)

Filbert, 2026-10-04. Brief: `docs/plans/2026-10-04_queue-follow-ups.md`
(blob 1dc08bf0…). Reviewer: Darkwing. Base: HEAD 3e39a26a, queue rev 45.
Candidate: `candidate-manifest.sha256` in this directory, uncommitted.
Sage commits it after approval.

## What changed

1. **Genesis and the owner-not-reviewer rule.** `parseMigrationMap` refuses
   a map row whose owner is among its reviewers: "migration map row N owner
   SEAT can't be a listed reviewer", exit 2. Genesis parses the map before
   it writes anything, so no file, witness or view changes.
2. **Assign wording.** "can't assign row N to SEAT: SEAT is one of its
   reviewers". The two tests that matched the old text now match this one.
3. **HEAD moved.** `queue-commit.sh` gains `head_moved`, called in
   `guard_check` before the canary and again when the clean run fails. A
   moved HEAD exits 2 with "refused (STEP): HEAD moved since H was
   recorded (another commit landed); run queue-commit.sh again". A real
   guard failure, with HEAD unmoved, keeps the old message.
4. **Calendar dates.** `checkTime` refuses any ISO time or date that
   doesn't format back to itself through `Date.parse` and `toISOString`:
   "WHAT is not a calendar time|date: VALUE". A shape error keeps its old
   message. Every time the validator reads goes through `checkTime`: row
   times, review times and log entry times.
5. **Cold start.** See "Cold runs" below.

README: the commit steps, the owner rule and the time format. DEFERRED:
four items move to Done, and the cold-start item too, if no failure shows
up.

## Choices

- **C1. The genesis check sits in the map parser, not in replay.** The
  review-record refusal is kept as defense in depth for a log written
  before the rule (`review.test.mjs`). A check in `checkGenesis` would
  make such a log unreadable. A new data test pins this: the parser
  refuses the map, and a genesis document built past the parser still
  loads. Mutant M10 (the rule added to replay) is killed by it.
- **C2. "another commit landed", not "another queue commit landed".** The
  brief quotes the second wording. The check before the canary fires for
  any commit, including one that touches no queue file, so "queue" would
  be wrong there. The rest of the message is the brief's.
- **C3. HEAD is checked twice.** The brief asks for a check before the
  canary. A commit can still land between that check and the hook run, and
  then the old misdiagnosis comes back. A second check, only when the
  clean run fails, closes that gap. It adds one `rev-parse` on a failing
  path only.
- **C4. Two existing F1 tests changed.**
  - "HEAD moving after commit-tree and before update-ref" moved its
    trigger to `before update-ref`. A move after commit-tree is now caught
    at the step-7 check (exit 2). The test still proves update-ref's
    expected-old-value check, now at the only point where it's the last
    line.
  - "H is recorded before the canary…": a commit outside the queue files
    during the step-1 canary used to reach update-ref (exit 1). It's now
    refused at the step-7 check (exit 2), before that check's canary, and
    update-ref never runs. The test asserts that.
- **C5. 24:00 is refused.** V8 parses `T24:00:00.000Z` as the next day's
  midnight, so it doesn't round-trip. Minute 60 and second 60 already
  parse as NaN.

## Tests

- `data.test.mjs`:
  - a new genesis test (map refusal; replay tolerance);
  - a new calendar test: month 13, month 0, day 32, 2026-02-30,
    2027-02-29 and 2026-04-31 as dates in `requiredSince` and `createdAt`;
    the same days plus 24:00, minute 60 and second 60 as ISO times in
    `updatedAt` and `requiredSince`; 2028-02-29 valid in both forms; the
    shape message kept; a log entry `at` refused on replay;
  - the assign wording.
- `store.test.mjs`: genesis from a map with row 9's owner among its
  reviewers exits 2. For that repository and the two refusals before it,
  there's no queue.json, no witness and an unchanged QUEUE.md. Also the
  assign wording.
- `commit.test.mjs`, two new tests, both with a nested
  `queue-commit.sh` run landing a real queue commit:
  - after `symbolic-ref` (H recorded, before step 1's check): refused at
    step 1 with the HEAD-moved message, no canary run, and a rerun commits
    the next revision;
  - before the first `git hook run`: the clean run fails on the moved
    HEAD, and the recheck reports HEAD moved, not the guard.
  The existing "the canary refuses a hook that git would not run" test
  still covers the guard message.

## Mutants

Eleven, run on an export of the candidate. Ten are killed:

| | Mutant | Killed by |
|---|---|---|
| M1 | no HEAD check before the canary | step-1 and step-7 HEAD tests |
| M2 | no recheck after a failed clean run | the between-check-and-canary test |
| M3 | `head_moved` exits 1 | all three HEAD tests |
| M4 | no round trip | calendar test |
| M5 | NaN check only | calendar test |
| M6 | round trip on ISO times only | calendar test |
| M7 | round trip on dates only | calendar test |
| M9 | genesis rule removed | data and store genesis tests |
| M10 | genesis rule also in replay | data genesis test |
| M11 | old assign wording | data and store assign tests |

One survives:

- **M8** compares only the date part of an ISO time. It's equivalent
  under V8. The only out-of-range time V8 parses is 24:00, and that moves
  the date, so the date part catches it.

## Suites

On the final candidate bytes, HEAD 3e39a26a:
- canonical checkout: `node --test packages/queue/tests/` passes 148/148
  and `bash scripts/test-queue.sh` 29/0;
- an export of HEAD with the candidate files: `bash scripts/test-queue.sh`
  27/0 (the live checks skip, as designed);
- `queue verify --current`: ok at rev 45. The live log replays under the
  calendar check.

## Cold runs

Not reproduced in 20 cold runs. `cold.sh` (here) built each tree fresh
from HEAD 3e39a26a plus the candidate files: odd runs as a
`git clone --shared` with push set to DISABLED, even runs as a
`git archive` export. It ran `node --test packages/queue/tests/` once in
each, one run at a time with nothing else running, then deleted the tree.
Every run passed 148/148, 2960 of 2960 in total, taking 39 to 61 s each.
The counts are in `cold-runs.txt`. The 300 ms deadline test is unchanged.

Run 1 started with a `queue-commit.sh` that differed from the candidate in
one comment line, the step-1 comment, which I reworded during run 1. Runs
2 to 20 used the candidate bytes.