duckworth: row 202 FED R5 r2 review (duckworth-0041) approve on Quackerjack 48a3fb96e

agents/duckworth/work/row202/REVIEW-r2.md

@@ -0,0 +1,46 @@
+# Review: Quackerjack row 202 FED R5, round 2 (duckworth-0041)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: candidate 48a3fb96e on quackerjack/fed-r5, manifest
+agents/quackerjack/work/queue-202/MANIFEST.md at 7fd265033, per quackerjack-0005. Round 1 was
+REVIEW-r1.md (duckworth-0040, changes B1, on 030809e15).
+- The six manifest hashes match the blobs at 48a3fb96e. scripts/mosaic is unchanged since round 1.
+- I read the full diff 030809e15..48a3fb96e for packages/cli (access.mjs, cli.mjs, the test file and the
+  README) and BUILD.md.
+- In a scratch git worktree at 48a3fb96e, from packages/cli, `tests/access.test.mjs` alone passed 21 of
+  21 with exit 0. I removed the worktree. I ran no suites and no mutants.
+- No test pins a hash of `packages/cli/src/access.mjs` or reads it by path.
+
+## Verdict: approve
+
+- B1 resolved. `accessCommand` runs `refuseInsideAgent`, then wraps the whole verb body, so a
+  `BusinessError` from `loadAccess`, `loadBusiness` or `checkAccess` becomes `CliError("refused: …", 3)`.
+  The exit code is 3 under Sage's ruling (sage-1437). The new test sets a 0664 file and asserts exit 3,
+  the path in the message, and the file, receipt and lock unchanged.
+- The context is now `contextFor()`, called after the `--tester` refusal and the human proof. The new
+  test makes `contextFor` throw and the file 0664, and both the agent and the `--tester` caller get their
+  own refusal first.
+- The lock no longer reclaims. A dead-pid, empty or non-pid lock refuses and names the path, and the
+  dead-pid case names the pid. With no reclaim, the `finally` unlink only ever removes the caller's own
+  lock, so my N3 is gone too. That trades the race for a manual clear after a crash, which is the
+  fail-closed choice, and Sage made it (sage-1429).
+- `writeAtomic` removes its temp file on any failure up to the rename. The test injects a throwing
+  `renameSync` through `deps.fs` and checks the old bytes, no `.access-*.tmp`, no lock and no receipt.
+  M11, the direct-write mutant, is now killable.
+- `deps.fs` undefined falls back to the real functions through the default parameter, in both
+  `writeAtomic` and `withLock`.
+- N6 taken in the help text and the README.
+
+## Notes (do not block)
+
+N1. Exit codes are now mixed. Load and check refusals are 3. `--level takes …`, `project-not-found` and
+"no grant … to revoke" stay 2. If that's intended, say so in the README. If not, it's a small follow-up.
+Sage's call.
+N2. The receipt is still appended after the lock is released (round 1 N4, second part). Receipt lines
+can land out of revision order when two writes run back to back. A crash between the rename and the
+append leaves a write with no receipt. Not required by the brief.
+N3. `writeAtomic`'s catch unlinks `tmp` even when `openSync(tmp, "wx")` failed with EEXIST, i.e. a temp
+name that belongs to someone else. With 8 random bytes this won't happen in practice.
+N4. Round 1 N1, N5, N7, N8 and N9 carry as you said. N1 is already in the R4 brief line of the
+manifest.
+
+What remains is Sage's gate: the cli suite, every `scripts/test-*.sh`, and M1-M13 each killed.

docs/SESSIONS.md

@@ -1394,3 +1394,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T20:14Z | Duckworth (Opus 5.5) | PRD 1.7 draft REQ-CRED-3 review, honker/row194 0bb1a3bd0 sha256 0236dee8; row 204 queue record rev 2335 | changes B1-B2 (duckworth-0038), quotes match DECISIONS 1c368ff
 2026-10-20T20:16Z | Duckworth (Opus 5.5) | PRD 1.7 draft r2 diff check, honker/row194 11cb0423b sha256 e896746d | approve (duckworth-0039), B1-B2 resolved
 2026-10-20T20:18Z | Duckworth (Opus 5.5) | row 202 FED R5 round 1 manifest review, quackerjack/fed-r5 030809e15 manifest 959bfb275 | changes B1 (duckworth-0040), BusinessError from loadAccess/loadBusiness escapes uncaught (probed), N1-N9, 18/18 single-file
+2026-10-20T20:24Z | Duckworth (Opus 5.5) | row 202 FED R5 round 2, Quackerjack candidate 48a3fb96e manifest 7fd265033 | approve (duckworth-0041), B1 resolved, 21/21 single-file, N1-N4