## Row 140 round 2 review (Filbert): approve

Candidate: manifest sha256 `04a381e88eeee7be99ddd4a1911cc3f5a3211668a47e7da962bb29da26d84c43`, 11 paths, base 02ee7f640, packet agents/researcher/work/queue-140/r2/ in 1d8aabd3c.

My round 1 finding is fixed. The tests now judge the sender and the launcher by definition, and the two mutants that survived round 1 are killed. I found no defect.

### Rebuild

- A fresh worktree at 02ee7f640 with row140.patch applied. Every manifest hash matched and `git diff --check` was clean (11 files, +429 -5).
- The added lines have no dash, curly-quote or control characters. The packet manifest checks.
- No commit from 02ee7f640 to refactor HEAD touches a manifest path.

### What changed since round 1, and what I checked

- **Only staff-request.test.mjs changed.** I compared each file's added and removed lines with round 1's row140.patch. The other 10 files are identical.
- **roles/chief-of-staff.md.** The added bullet is unchanged. It now sits after row 146's `_bus` bullet, and both are present. business chief-of-staff (10/10), the test that reads this file, passes.
- **The new tests cover each case I asked for:**
  - instance `lead` of the pm definition sends, and the chief receives it from `lead`;
  - instance `pm` of the coder definition is refused `staff-request-refused`;
  - launcher `boss` of the chief-of-staff definition receives;
  - launcher `chief` of the coder definition gives `no-chief-of-staff`.
  The refusals leave no message and no `staff.request` `action.allowed` event.
- **The rollback assertion.** A separate test refuses three ways (no launcher, a coder sender, `roles: []`) and asserts that no event and no message remain. I agree with build.md that it has no mutant target. The event disappears because the transaction rolls back, and no single line does that.

### Notes (non-blocking)

1. **Row 136 also changes packages/bus/src/broker.mjs,** in `#checkAuthority` and the supersede check. This row changes the staff.request handler. The changes are in different places, but whichever lands second rebases onto the other and reruns the bus tests.
2. My round 1 note 1 (the requested role names aren't checked against the business's roles) stands, as a note.

### What I ran and what I took from receipts

**I ran**, as single files on the candidate with Docker disabled, all with 0 fail and 0 skipped. Every file except launcher used TMPDIR set to scratch. launcher used the default TMPDIR, and the spec reporter shows the request_staff test ran.

| Test file | Result |
|---|---|
| bus staff-request | 10/10 |
| bus messaging | 13/13 |
| bus broker | 16/16 |
| bus csuite-messaging | 16/16 |
| bus threads | 14/14 |
| bus chief-of-staff | 13/13 |
| bus launch-notice | 7/7 |
| bus tester | 11/11 |
| harness tools | 18/18 |
| harness bundle | 21/21 |
| harness runner | 24/24 |
| business chief-of-staff | 10/10 |
| cli verbs | 7/7 |
| cli tester | 7/7 |
| cli launcher | 18/18 |

I also ran three mutants of my own on broker.mjs against staff-request. The tree matched the manifest again afterwards.

| Mutant | Round 1 | Round 2 |
|---|---|---|
| N1: the sender check reads the instance name (`s.role !== STAFF_FROM`) | survived, 7/7 | 1 fail |
| N2: the launcher check becomes "exists and isn't named coder" | survived, 7/7 | 1 fail |
| N3: a launcher named `chief` passes whatever its definition | not run | 1 fail |

**From Researcher's receipts, not rerun by me:**
- m1 to m21 plus N1, N2, N2b and n2f, all killed, 23:56:41Z to 23:56:50Z (mutants-run.txt), and round 1's tests letting N1, N2 and n2f pass (round1-tests-on-new-mutants/);
- the 61 other bus, harness and cli test files run singly, rc 0 (suites/others/_summary.txt).

No gate has run on this candidate yet. Sage's runs at landing. I took no slot.