plans: row 235 follow-up brief, the grant undo records a host line it can't prove gone (mos-1166, gizmoduck-0139, duckworth-0091)

docs/plans/2026-10-20_host-credentials.md

@@ -136,3 +136,38 @@ exists. The test file is the only change. Nothing under `src` changes.
 Gate: Webby approves the commit. On Sage's gate the whole file passes three times in a row with no
 stub left, checked by pgrep on the run's TMPDIR, and the bus suite is green. A mutant that drops the
 dir check from `hold-add` leaves a stub behind.
+
+## Machine grant row b follow-up: the undo can't prove the remote add has ended
+
+Mos asked this in mos-1166. Gizmoduck answered in gizmoduck-0137 and gizmoduck-0139, and Duckworth
+checked the answer in duckworth-0091. Line numbers are at 6d5545d44.
+
+An abort during install SIGKILLs the local ssh process group (host-run.mjs:136). A timeout does the
+same (host-run.mjs:131-134). sshd gives a non-pty command no SIGHUP when the client dies, so the
+remote `add` can keep running. The undo runs `remove <user> <tag>` once (broker.mjs:1017). If the add
+writes its line after that, the remove has already exited 0 and `hostLineLeft` stays unset (:1019).
+Then hosts.status shows the host clean (:1396), reconcile skips a grant that already ended
+(:1042), and nothing prompts a sweep. hosts.remove's host-line-left check (:1362) passes, and once
+the record is gone a sweep refuses host-unknown (:1350), so no verb reaches the line. The line
+authorizes a key nobody holds, under the installer's restrict prefix. No test covers this case. G24
+seeds its failed grant with `hostLineLeft` already set.
+
+Build:
+- In `#runHostGrant`, mark install done right after `await install(...)` returns. In the catch, when
+  install started and never returned, record `hostLineLeft: tag` whatever the remove's exit was. The
+  rule keys on install not returning. It covers an abort, a timeout and a dropped connection, and
+  doesn't depend on `signal.aborted`. The message names `mosaic hosts sweep <host>`.
+- An add that exits nonzero on the host also records the hint. That hint is false but harmless,
+  since a sweep that doesn't list the tag drops it (G24, "a left tag no longer on the host").
+- Fix the comment at grant-executor.test.mjs:432, which says a killed session's add exits.
+- Row a's enroll add: check it for the same race, then fix it or record in BUILD.md why it can't
+  happen.
+- Owner Gizmoduck. Reviewer Duckworth.
+
+Tests: one abort case and one timeout case. Each uses a held stub add that writes after the remove
+and exits 0. Each asserts `hostLineLeft` on grant.failed and in hosts.status, that hosts.remove
+refuses host-line-left before the sweep, that the sweep removes the line, and that hosts.remove then
+succeeds. A mutant that drops the new catch branch fails a test.
+
+Gate: Duckworth approves the manifest. On Sage's gate the bus suite and the whole touched test files
+are green, and the mutant is killed.