plans: row b (235) host.run also refuses a creative agent at spend time, grant record kept for revoke (mos-1164, sage-1908)

docs/plans/2026-10-20_host-credentials.md

@@ -111,8 +111,13 @@ definition's credentials no longer gate host access, so the host grant writer it
 agent is a `CREATIVE_DEFINITIONS` role (row 213), with a named reason and a test. The Case 2 hub runs
 creative agents on .54, and without this a creative role has a path to `host.run`. Duckworth's review checks
 it, and answers from the code whether a decision raised by another role can be spent by a creative one.
+
+`host.run` refuses too, at spend time, when the agent's current definition is a `CREATIVE_DEFINITIONS` role
+(sage-1908, accepted in mos-1164). That covers a grant written before the role became creative. The refusal
+leaves the grant record in place, so `hosts.revoke` still finds it. Each path, the writer refusal at raise
+and at the step 1 recheck and the spend refusal, gets its own test and its own mutant.
 `CREATIVE_DEFINITIONS` comes from row 213, so row 213 lands before row b. If that order can't hold, Sage
 tells Mos before row b lands.
 
 Gate: as row a, with section 10's row b tests and mutants, G27, G28 and the upsert mutant included, and
-the creative refusal test.
+the creative refusal tests and mutants (writer and spend).