Row 286 C2-03b: BUILD.md notes for dewey-0869 and sage-2951 (fired-chief path :4308, marker-gated busy test, T9 scratch roles)

agents/ludwig/work/queue-286/BUILD.md

@@ -196,8 +196,7 @@ Choices made without a ruling. Each is small and reversible:
 - T7 and T9 run the real verbs (dewey-0864, ruled by sage-2947: no SQL staging; replaces the
   staged state in cefebf65b). Until row 285 lands, the test passes its own definitions; once it lands
   the real chief definition carries gitea. Whichever of 285 and 286 lands second rebases and reruns
-  library and bus whole (sage-2947). The chief's
-  grant goes through decision.raise and the human's yes against fake-gitea-api.mjs. The test's own
+  library and bus whole (sage-2947). The chief's grant goes through decision.raise and the human's yes against fake-gitea-api.mjs. The test's own
   definitions give chief-of-staff a gitea credential, as gitea-grant.test.mjs gives coder one. The
   real roles/chief-of-staff.json has `credentials: []`, so a live chief can't get one before C2-21.
   - Revoked: `grants.revoke`, then the row is gone and the fetch refuses.
@@ -205,22 +204,27 @@ Choices made without a ruling. Each is small and reversible:
     refuses its own name (`organization-instance-referenced`, broker.mjs `#chiefLifecycle`). So the
     test's launch.by is `boss` (definition pm, the chief's authority), and boss fires the one listed
     chief-of-staff instance. Step G deletes the row (row 281), `roles.chief` stays, the fetch refuses.
+    Only launch.by may call instance.fire (`role-not-chief`, broker.mjs:4308 at 94c33a43c) and it
+    refuses its own name (:4335), so this is the only fired chief the verb allows. Accepted by
+    sage-2951 as brief owner and read the same way in dewey-0869.
   - T9's revoked case runs `grants.revoke` on the runtime's own data root and store, between starts.
+    T9's runtime gets a scratch roles/ whose chief-of-staff carries `{service: gitea}`, as row 285
+    ships it (case2-rows.md:1823-1824), so its definitions match the grant's (dewey-0869). After a
+    rebase onto 285 the copy needs no edit.
   - Delisted with the row still there, a `fire.stopped` with no `fire.done`, held, two chiefs and
     another project stay unit checks on the choice function with SQL fixtures.
 - "Another uid" in T5: the suite can't chown, so a PATH `stat` shim reports uid+1 for the open file.
   The real `id -u` compare is covered only through that shim (dewey-0864).
 - Two listed chiefs, or none listed, refuse `library-fetch-no-grant` (T8).
 - The race fetch inside `push()` takes sync's `running` guard (dewey-0864 R1, in this row per
-  sage-2947). While a sync of the
-  mirror runs it refuses `library-sync-busy`, fetches nothing, and the caller writes again. Test:
-  "race fetch: while a sync of the mirror runs".
+  sage-2947). While a sync of the mirror runs it refuses `library-sync-busy`, fetches nothing, and
+  the caller writes again. Test: "race fetch: while a sync of the mirror runs". Its sync fetch is a
+  git alias that touches a marker, then waits for a release file. The push starts after the marker
+  exists and the release comes after the refusal, so nothing depends on timing (dewey-0869).
 - The slot at 0000: T9 covers the revoked case at runtime. Fired and held refuse inside the choice
   function, which takes no path and opens no file. `sync` with any `{ refused }` runs no git (library
   test, valid slot present).
-- First-run risks: T9's runtime rebuilds definitions from rolesDir, where chief-of-staff has no gitea
-  credential. If giteaStart or reconcile then holds or drops the chief's grant, T9 part 1 fails. The
-  fix would be in the test's setup, not in the product.
+- First-run reds in the new tests are mine to fix in setup and report afterwards (mos-1272).
 - The chief's evidence is any gitea grant event naming the chief, of any action (grant.applied,
   grant.revoked and the rest), per the plan. The spend event names no agent, so it doesn't count.