morgana: row 295 r2 rebase on 80793d824 (sage-3256): accessFor comment is stamp-cached (dewey-0871 N3); BUILD.md rebase note

agents/morgana/work/queue-295/BUILD.md

@@ -3,6 +3,7 @@
 Brief: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: FED R4, revocation".
 Design: agents/gizmoduck/work/federation/DESIGN.md at b93f098f0 (r4.11), sections 3.7 and 7.
 Base: origin/refactor 253346e3c (rows 206, 271 and 275 are in it). Branch morgana/row295.
+Round 2 base: 80793d824 (row 294 landed as d3059c2c3), branch morgana/row295-r2 (sage-3256).
 Reviewer Dewey, gate owner Sage.
 
 Row 193's viewer level landed with row 275 (3410df7c3), so it is on this base. The downgrade test and
@@ -137,3 +138,16 @@ the kill, a run that polls would exit 22 on not-holder and hide the mutant.
   comment to stamp-cached, and check its ACCESS_HELP edit against M15's ordering assertion.
 - N4: the touched whole files (user-principal, viewer, thread-shares) run whole in the bus suite;
   a first-run red goes per mos-1272.
+
+## Rebase onto 80793d824 (sage-3256)
+
+- Row 294 landed (d3059c2c3). Of 295's manifest only packages/cli/src/access.mjs drifted; the rebase
+  applied with no conflict and keeps 294's lines (the federation.peers help and comment,
+  accessContextFor's peers). The reload sentence still sits right after "so do that second.", so
+  M15's order assertion holds; 294 changed only lines after it.
+- N3: packages/cli/src/config.mjs accessFor's comment now says the broker reads on a user request
+  that finds the stat changed and on the 30 s timer. config.mjs joins the manifest (comment only).
+- 294 put `access` on the live boot, so the timer and the request sweep run in its new tests:
+  packages/cli/tests/access-boot.test.mjs and packages/webui/tests/granted-user.test.mjs run whole at
+  the gate with the touched files. stack-release.test's copy list carries access.mjs, which adds
+  no import here.

packages/cli/src/config.mjs

@@ -85,9 +85,10 @@ function trackerFor(system, b, warn) {
 }
 
 // FED R6 (#1800, sage-3142): the runtime's `access`, { file, context }. The broker reads the file
-// with R1's loadAccess on every user request, so a bad file leaves every user with no grant and
-// the owner's bus still boots (sage-3153). The context is the cli's accessContextFor, peers included. No file,
-// or a context that can't be built, means no `access`: no user binds, as before R6.
+// with R1's loadAccess on a user request that finds the file's stat changed, and on its 30 s timer
+// (FED R4, #1801), so a bad file leaves every user with no grant and the owner's bus still boots
+// (sage-3153). The context is the cli's accessContextFor, peers included. No file, or a context
+// that can't be built, means no `access`: no user binds, as before R6.
 function accessFor(system, env, warn) {
   const file = accessFilePath(configDir(env));
   try {