relations: Phase 4 federation (erel trust-gating, peer_rel/trust, fed-sx mock transport, revocation) + 22 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/relations-on-sx.md

@@ -18,7 +18,7 @@ links. Reuses `lib/datalog/` — does not reimplement the engine.
 
 ## Status (rolling)
 
-`bash lib/relations/conformance.sh` → **70/70** (Phases 1–3 complete)
+`bash lib/relations/conformance.sh` → **92/92** (Phases 1–4 complete)
 
 ## Ground rules
 
@@ -89,17 +89,36 @@ lib/relations/federation.sx
 
 ## Phase 4 — Federation
 
-- [ ] cross-instance relationships — a peer asserts `rel(local, remote, kind)`;
+- [x] cross-instance relationships — a peer asserts `rel(local, remote, kind)`;
   replicate rel facts via fed-sx (mock the transport in tests)
-- [ ] trust gating — a peer's link binds locally only under a local trust fact
+- [x] trust gating — a peer's link binds locally only under a local trust fact
   (mirror acl's non-transitive `trust`/gate-in-engine model; do NOT copy acl code,
   re-derive the shape)
-- [ ] revocation — retract a replicated link; reachability re-saturates
-- [ ] `lib/relations/tests/fed.sx` — federated reachability chains, trust gating,
+- [x] revocation — retract a replicated link; reachability re-saturates
+- [x] `lib/relations/tests/fed.sx` — federated reachability chains, trust gating,
   revocation
 
 ## Progress log
 
+- **Phase 4 — federation** (92/92). Re-derived acl's trust-gate shape (not
+  copied). engine.sx now derives the whole engine from an EFFECTIVE relation
+  `erel` rather than raw `rel`: `erel(S,D,K) :- rel(S,D,K)` (local, always) and
+  `erel(S,D,K) :- peer_rel(P,S,D,K), trust(P)` (peer link, gated by a local trust
+  fact). reach/reach_any/rnode/has_parent/has_child all read `erel`, and the
+  direct-query fns moved into engine.sx to query `erel` too — so with no
+  peer_rel/trust facts `erel ≡ rel` and Phases 1–3 are unchanged. Trust is a body
+  literal, re-checked every saturation, so it is non-transitive (only a peer's own
+  links bind, only under local trust(P)) and revocation is immediate. New
+  federation.sx: `relations-peer-rel`/`relations-trust` constructors, a mock
+  fed-sx transport (`relations-fed-fetch`/`-collect` over a peer→links dict),
+  `relations-fed-build-db` (local facts + pulled peer links), and
+  `relations-fed-assert!`/`relations-revoke!` over a live db. fed.sx covers
+  untrusted-link-doesn't-bind, trusted-link-binds (child + federated reachability
+  + connecting path through the federated edge), non-transitive trust (peerB's
+  link inert without trust(peerB)), link revocation, trust revocation (local edge
+  survives), transport pull with selective trust, and live fed-assert!. The shared
+  recursive-reachability shape with acl is flagged (Phase 2 note); the trust-gate
+  is the same convergence — still NOT extracted, per ground rules.
 - **Phase 3 — typed relations + path explanation** (70/70). New `explain.sx`:
   `relations-path(db,a,b,kind)` is relations' answer to acl's proof tree — the
   `reach(K,a,b)` derivation read off as the node chain. lib/datalog/ keeps no