row 285: BUILD.md records N1, the creative-only library.write refusal as a follow-up, and the round scope (#1790, sage-3593)

agents/scrooge/work/queue-285/BUILD.md

@@ -220,6 +220,10 @@ PRD 1.16 landed with row 291 (4874d1e83) and Jason's yes is mos-1354 Q32, so the
 
 Open for review, not in scope: the PRD says library.write is granted to the six creative roles only. role.mjs checkCreative bounds what a creative role holds, but nothing refuses library.write in a non-creative role's withinRole. The brief asks only that the chief refuses it under an allowlist validator, and the chief has none. Flagged for Webby and Sage.
 
+N1 (sage-3593): role validator should refuse library.write on a non-creative role (PRD 1.16 creative-only). Not part of 285. Role files change only through reviewed commits (invariant 7), so a review would see such a grant today, but a refusal at load is the fail-closed form. Webby confirms it in the round, and Sage files it in DEFERRED as a follow-up row at landing.
+
+Review scope (sage-3593): commits 1-5 are a rebase, so check the range-diff. Commit 3 (8f8b8cf15) is new code, so review it in full.
+
 ## Results
 
 Not run.