row 202 round 2 manifest: candidate 48a3fb96e (FED R5)

agents/quackerjack/work/queue-202/MANIFEST.md

@@ -1,35 +1,64 @@
-# Row 202 manifest: FED R5, mosaic access list, grant, revoke
+# Row 202 manifest: FED R5, mosaic access list, grant, revoke (round 2)
 
-Commit: 030809e15 on quackerjack/fed-r5 (base: R1 at 80fe31071, merged; 44e36fc4c on top, pyc only).
+Candidate: 48a3fb96e on quackerjack/fed-r5 (round 2). Supersedes the round-1 manifest at 959bfb275, which
+pointed at build 030809e15 and was reviewed by Duckworth as round 1 (changes, B1; REVIEW-r1.md, a76767e87).
+Base: R1 at 80fe31071, merged; 44e36fc4c and 35aaceac9 on the branch before the build.
 Owner Quackerjack, reviewer Duckworth, gate owner Sage. Brief: docs/plans/2026-10-20_federation-r1-r2-r5.md, Brief: FED R5.
 
-## Files (sha256 of the blob at 030809e15)
+## Files (sha256 of the blob at 48a3fb96e)
 
 ```
-42958364617e7c0f0daac7a487cf68c74753f3a141b2daa80f8a1e5ede1ef03a  packages/cli/src/access.mjs
+e2d3e613a8d6f04544904acb2af8aec44dedf9ba6820f1936e1f7d6547be2028  packages/cli/src/access.mjs
-19981c6d46a2c3e1490fdbe017d948ea8f980ececa4a7917716852eebdfdab92  packages/cli/src/cli.mjs
+e956ac5b54844af30ac7717e85b5b60282b2ccf00dfc134d1d5c1d9f3cb44f32  packages/cli/src/cli.mjs
-e5cd9158e1c65280c5c35d4c83aee7739b3308ddc853b1bc4575cfb121fc2f5e  packages/cli/tests/access.test.mjs
+de7d15dc6989379a47b1efd4f449e9707004978198f01d704b2d61c8411ed6ca  packages/cli/tests/access.test.mjs
-57091e13a0e7e7789af6e34645cf9624075dd98c41afb7ee3e539ada00c5134d  packages/cli/README.md
+f50760a67337147e50af032969ea65ca313ac7b76f6239e23e5c0d95431bd4b7  packages/cli/README.md
 aeddef32c28c883eedf166bcac96d1e6828b71c862e683977e097706339baf86  scripts/mosaic
-2d7f1595d1070443a5afaf665259d7e7428f407f74e75378d500317b6aa2bdb3  agents/quackerjack/work/queue-202/BUILD.md
+79f2c5344c0d73754804ab58c68edfb82bad7bfef50718550c698f61ae2a8ab5  agents/quackerjack/work/queue-202/BUILD.md
 ```
 
+scripts/mosaic is unchanged since round 1.
+
+## What changed in round 2
+
+- Lock: no reclaim. A dead-pid, empty or unreadable lock refuses and names the path (and pid); a human
+  removes it. The reclaim race is gone (Sage sage-1429).
+- Atomic write: fs calls go through `deps.fs` (default: the real `node:fs` functions). A failed write
+  removes its temp file and leaves the old bytes (Sage sage-1429, the direct-write gap).
+- BusinessError from loadAccess or loadBusiness: exit 3, file and key path on stderr, no stack trace
+  (Duckworth B1, Sage sage-1437). Sage's ruling is exit 3, so the checkAccess refusals move from exit 2 to
+  exit 3 too.
+- `contextFor` is a function, built after the agent and tester refusals and the human proof. A refused
+  caller never reads access.json or the business files (Sage sage-1437).
+- The help text and README say the command runs as the instance's uid (Duckworth N6, Sage sage-1437).
+
 ## Interface used from R1 (80fe31071)
 
-checkAccess(doc, { providers, peers, businesses, ssoSubjects }), loadBusiness, accessFilePath is not used (the CLI takes configDir), covers is not used by R5. BusinessError is caught and re-thrown as exit 2.
+checkAccess(doc, { providers, peers, businesses, ssoSubjects }), loadBusiness, loadAccess (via readCurrent),
+accessFilePath is not used (the CLI takes configDir), covers is not used by R5.
 
 ## Named in review
 
-- Human proof: one project.list call (proveHuman, access.mjs). Gate: packages/bus/src/broker.mjs:2319 (project.list case) and :377 (#human).
+- Human proof: one project.list call (proveHuman, access.mjs). Gate: packages/bus/src/broker.mjs:2319
-- Lock: <configDir>/access.json.lock, 0600, pid stamp, stale reclaim on ESRCH, see BUILD.md.
+  (project.list case) and :377 (#human). Agent and --tester refusals come before the proof.
-- Pinned bus behavior: failed proof reads as outcome-unknown (client.mjs:32-33). Outside R5.
+- Lock: <configDir>/access.json.lock, 0600, pid stamp. Live pid refuses (BUSY); dead, empty or unreadable
-- Context: accessContextFor; peers [] until row 203; subjects flattened from console.sso.providers[].subjects.
+  refuses and names the path. No reclaim. See BUILD.md.
+- Write: checkAccess on the new document, then temp file, fsync, rename; revision compared inside the lock.
+- Pinned bus behavior: a failed proof reads as outcome-unknown (client.mjs:32-33). Outside R5.
+- Context: accessContextFor, built lazily; peers [] until row 203; subjects flattened from
+  console.sso.providers[].subjects.
 
 ## Tests and mutants
 
-- packages/cli/tests/access.test.mjs: 18 tests, single file green on 030809e15.
+- packages/cli/tests/access.test.mjs: 21 tests, single file green on 48a3fb96e (21/21, run on the candidate).
-- Mutant list M1-M10 in BUILD.md, run on Sage's go. Known gap: atomic-rename failure is not tested (BUILD.md).
+- Mutants M1-M13 in BUILD.md. M11 (direct write) and M12 (no BusinessError catch) and M13 (context built
+  early) are new. Run on Sage's go and slot only.
+- Not run in this round: the mutant batch, the cli suite and scripts/test-*.sh.
 
 ## Not in this row
 
-R2 peers, R4 access.reload, row 192 checkConsole, cli suite and scripts/test-*.sh (Sage's gate).
+- R2 peers and the federation key (row 203).
+- R4 access.reload (its brief takes N1: project.list exempts testers, so access.reload needs #human).
+- row 192 checkConsole (the context reads console.sso directly until 192 lands).
+- Viewer level (Sage's carry, item 5): whichever of 202 and 204 lands second adds it. Row 204 is not on
+  refactor yet as of 10-20 20:23Z.
+- Cli suite and scripts/test-*.sh (Sage's gate).