sage: DEFERRED, checkCreative doesn't refuse credentials (row 213 r3 Webby N1, mos-1160)

docs/plans/DEFERRED.md

@@ -225,6 +225,19 @@ at every gate. Started 2026-09-12 during the control board MVP.
   is by hand. A trap that writes the stop point and the recovery step to
   the log would make it a sheet step. Filbert N3 on row 233 (29922,
   #1735). (2026-10-21)
+- **`checkCreative` doesn't refuse `credentials`.** Row 213's
+  `checkCreative` (packages/business/src/role.mjs:143 at 2d2ad2760)
+  limits a creative role's tools, authority and messaging, but a role
+  file that gave companion or research a credential would still load.
+  The business file could then map a credential to that instance
+  (business.mjs:157). Nobody has traced whether a mapped credential
+  reaches the run's environment. The decision paths stay closed (M6),
+  but a creative role with `web` holding a live token is a wider channel
+  than design 4 means. The fix: refuse any `credentials` in
+  `checkCreative`, with a role.test.mjs case. It goes after row 213
+  lands, as a follow-up row or in the next row that edits role.mjs.
+  Webby N1 on row 213 r3 (REVIEW-r3.md, 3ab3c010b), mos-1160.
+  (2026-10-21)
 
 ## Queue