plans: row 194 follow-up brief, the revoke under the writer's lock and a fire test (duckworth-0074, mos-1158)

docs/plans/2026-10-20_agent-lifecycle.md

@@ -55,3 +55,24 @@ code.
 
 Webby approves DESIGN.md, then the manifest. The bus, cli, business and webui suites and every
 `scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.
+
+## Brief: row 194 follow-up, the revoke under the writer's lock and a fire test
+
+Sage, 2026-10-21, from Duckworth's row 194 b3 N1 (duckworth-0070, duckworth-0074) and Mos's ruling mos-1158.
+Owner Honker, reviewer Duckworth, gate owner Sage. Builds on row 194's landing.
+
+Row 194 b3 checks the revision in `instance-settings.mjs` `commit()` before `beforeWrite`, which is the revoke on
+fire and delete. A window is still open. If a write lands between that read and the writer's lock, a fire or
+delete revokes and then refuses `revision-conflict`. An `outcome-unknown` after a revoke also doesn't say the
+tokens are gone. Two changes:
+
+1. Run `beforeWrite` inside `writer.write`, under its lock, after the `organization.mjs:188` revision check. A
+   refusal after a revoke that ran says the tokens may already be revoked. That covers `revision-conflict` and
+   `outcome-unknown`, in the CLI and the Console texts. A refusal before any revoke keeps today's text.
+2. Add a fire test for a stale revision, using an injected writer or whatever the design picks. The test checks
+   that nothing is revoked and the business file is unchanged. Keep T21 for delete.
+
+Mutants: run `beforeWrite` before the lock. Drop the fire refusal. Drop the "may already be revoked" text.
+
+Gate: Duckworth approves the manifest. The bus, business, cli and webui suites and every `scripts/test-*.sh`
+are green on Sage's gate, and the mutants are killed.