row 207 (#1705): BUILD.md records sage-2810 (Q1 no reload, cited to broker.mjs:384; Q2 refuse with user-has-grants) and the usage/help pin sweep: access.test.mjs is the only reader, no hash pin; doc only

agents/megavolt/work/queue-207/BUILD.md

@@ -51,6 +51,31 @@ suite and every `scripts/test-*.sh` are green on Sage's gate, and the mutants ar
   non-local home, an owner sso subject or a subject another user holds refuses through checkAccess, exit 3,
   before any write. The verb does not repeat those checks.
 
+### Rulings (sage-2810, 16:40Z, cc Duckworth)
+
+- Q1 agreed: no reload call. The reason is broker.mjs:384-386, the `#access` field's comment: "() => the checked
+  access document (R1's loadAccess), read once per user request", wired in runtime.mjs:263 as
+  `() => loadAccess(access.file, access.context)`. A write acts on the next request. FED R4 owns any reload verb.
+- Q2 agreed: `user remove` refuses with `user-has-grants`, exit 2, naming the grant ids, and writes nothing.
+  Dropping the grants silently would make removal revoke access without saying so.
+- Usage and help pins: grep the tests for the changed strings, sha256 and snapshot pins included, and run every
+  reader whole (section 6).
+- Row 203 (Quackerjack) does not touch access.mjs; its stale help lines stay a follow-up, so no overlap.
+
+### The usage and help pin sweep (sage-2810), on aca16404c plus this row
+
+- Source readers of ACCESS_USAGE and ACCESS_HELP: packages/cli/src/access.mjs only (cli.mjs imports
+  accessCommand and accessContextFor, not the strings).
+- `git grep` over 'packages/*/tests/*' and 'scripts/*' for ACCESS_USAGE, ACCESS_HELP, "mosaic access",
+  "access list", "access grant", "access revoke", "Access (FED" and the help's "revoke them here first": the only
+  hits are packages/cli/tests/access.test.mjs (positive control: `accessCommand` hits it twice).
+- Hash pins: no test file names packages/cli/README.md or packages/cli/src/access.mjs next to a sha256 or a
+  64-hex value. The one 64-hex file that mentions a README (packages/queue/tests/fixtures/queue-marked.md) names
+  packages/queue/README.md and packages/ledger/README.md, not this one. scripts/stack-copy.sh copies
+  packages/cli/README.md; stack-copy.test.mjs builds its own fake repo and is in the cli package, run whole.
+- packages/business/tests/access*.test.mjs import packages/business/src/access.mjs, a different file, unchanged.
+- So the readers are access.test.mjs, run whole in step 1, and the cli package whole in step 2.
+
 ## 3. The change (code and docs)
 
 - packages/cli/src/access.mjs: two ACCESS_USAGE lines and one help line; accessVerb accepts `user add ID` and