## Row 122 round 2 review (Filbert): approve

Candidate: manifest sha256 `00b84e311475f97ced0d9a9599fba23a28442971ed15d8d489d9422d84a8812e` (44 paths), base 0afbd818e (post-119), packet agents/rocko/work/queue-122/r2/ in 4b6e50636, logs in 2fd2ad84f.

Rebuild: a fresh worktree at 0afbd818e with the r2 build.patch applied. Every manifest hash matched and `git diff --check` was clean. The added lines have no dash, curly-quote or control characters. No commit from 0afbd818e to HEAD touches a manifest path.

### Round 1 findings

| Finding | Status | How I checked |
|---|---|---|
| F1 base drift | Fixed | Rebuilt on 0afbd818e. BUILD.md describes the merge for each of the nine paths. |
| F2 post-119 mapping | Fixed | My fixture run below. limits.test.mjs:30 runs the exact 94e41ae29 example and a Jason-shaped fixture, and validates both outputs. |
| F3 inherited models | Fixed | An inherited instance now uses the system `execution.provider` and `execution.model` and must match both. The family check uses the previous model, so it's no longer self-referential. |
| F4 stale comments | Fixed | business.mjs:1-3 names the trusted writer. The old family-ceiling comment in vocabulary.mjs is gone. |
| F5 dense code | Fixed | organization.mjs, migrate-launch.mjs, launch-settings.mjs and launch.mjs have no line over 120 characters (longest 117). The broker limits block is readable. |

On the round 1 note: runtime.mjs no longer calls `recover()` at start. Recovery runs only inside `write`, under the lock. `read` validates the whole document and ignores receipts. bus limits.test.mjs:24 covers this: after an interrupted write and an outside edit, the bus starts, `limits` reads 12, and `limits.set` refuses with `organization-uncertain` without changing the bytes. That matches Sage's ruling.

### My migrate fixture runs

This used the 94e41ae29 example renamed `mosaic-stack.json`, with placeholders filled in. pm, cto and reviewer were set explicitly to claude-opus-5-5 and coder to claude-sonnet-5-5. The runs used the shipped migration-map.json, the post-119 roles from the test fixture and a temporary config, never a real one.

| Case | Result |
|---|---|
| A. MIGRATION.md step 1 shape (chief and assistant explicit opus), config path missing | Prints a document the post-122 validator accepts. No config read, no bus contact. Applying jason-migration.patch.json to the input gives exactly this output. |
| A2. Output from A run through migrate again | Same document (idempotent) |
| B. chief and assistant inherited, system config anthropic / opus | Valid; chief and assistant map to opus |
| C. B with system model sonnet | Refused: "changes chief's inherited provider/model" |
| C2. B with system provider openrouter | Refused, same message |
| D. B with the config file missing | Refused: "system config problem (mosaic-config exit 3)" |
| E. A with coder mapped to opus | Refused: "changes coder's external model" |
| F. A with launch.by pm | Refused by the role check |

In every case, the input bytes and mtime and the config bytes were unchanged.

### MIGRATION.md and the combined window

The order is right: the 119 entry, then the print-only conversion, then Jason's install, then the re-pin in the same Mos window with the PM idle. Steps 1 and 3 agree with the patch: chief and assistant get explicit models in step 1, so every `replace` path in the patch exists. The command must run from the new copy with `--roles-dir roles`, and the doc says so. The writer accepts a 0644 installed file; it refuses only group- or world-writable files.

I approve the window plan going to Mos with two additions. Both are decision 137 doc-only: `grep -rlF MIGRATION.md packages/*/tests scripts/test-*.sh` finds no file. Sage can add them to the Mos message without a new round.

**Doc-only, follow-up:**
1. **Backup and rollback.** Before step 1, Jason keeps a copy of the current organization file. If step 2 refuses or the window stops before the re-pin, he restores that copy before the window closes. After step 1, the old live copy may not accept the file.
2. **Nothing in between.** No bus or Console restart and no launch happens between step 1 and the re-pin. The old code can't read the converted schema, and the new roles refuse launch.by pm.

### Notes (non-blocking)

- limits.test.mjs:32 reads the example through `git show 94e41ae29`, so the test needs the repository history. stack-copy.test.mjs already depends on git in the same way, so this is consistent.
- serve.mjs has one added line of 207 characters (the settings model check). It isn't on the write path.
- If a write fails before the rename, the `.<id>.<tx>.tmp` file stays in businesses/ after recovery marks the write aborted. Nothing lists that directory, so it's harmless.

### What I ran and what I took from receipts

**I ran**, as single files with TMPDIR set and Docker disabled:

| Test file | Result |
|---|---|
| business launch-settings | 8/8 |
| business business | 15/15 |
| business chief-of-staff | 10/10 |
| business assistant | 7/7 |
| cli limits | 3/3 |
| cli launch-limits | 1/1 |
| bus limits | 3/3 |
| webui settings-write | 3/3 |

I also ran the fixture cases A to F above.

**From Rocko's receipts, not rerun by me:**
- the full gate: 23 suites at exit 0 in gate-run-final.log and gate/results.json, release and task included. The settings-form browser test is at gate/pkg-webui.log:102, 112/112.
- 38 of 38 mutants killed in MUTANTS.md.
- the launcher.test.mjs case that starts the first chief over uncertain receipt evidence (in pkg-cli; BUILD.md says no live process is involved).

The pre-merge pkg-business assertion failure is kept in gate/ and disclosed in BUILD.md; the whole gate was rerun after it.

I took no slot.

Landing still needs Mos's go (decision 123). Decision 144 still applies: nothing edits Jason's file.