gosalyn: Case 2 C2-03b round 3 for Webby webby-0156 R4: the fetch fallback reads the append-only events table for any GRANT_EVIDENCE event with method gitea and agent the chief, never gitea_grants, whose row a revoke and a grant-lost delete. It names no project, since grant.applied and grant.revoked carry none, so a chief grant on any project ends the fallback and fails safe. The revoked and fired tests go through grants.revoke and instance.fire and assert the row is gone before the fetch

docs/plans/2026-10-20_case2-rows.md

@@ -1893,12 +1893,18 @@ Design 7.2's C2-03b paragraph:
   for the fetch, or slot `library-human` with her Gitea user for her save. The helper reads the file with
   the same checks as `readSecretFile` in `gitea-grant.mjs`: no symlink, the bus's uid, mode 0600. It still
   answers only the exact Username and Password prompts for the configured host and that one user.
-- The fetch falls back to slot `library-gitea` only while no gitea grant record for the chief on the
-  library project has ever existed, in any state, so an install that runs before C2-21 still syncs. Once
-  a record exists, a revoked or `held` grant, or a fired chief, refuses the fetch with
-  `library-fetch-no-grant` and the slot is never read. A write, a revert and a save never fall back to
-  the slot. `library.status` names which credential the last fetch used, by kind and user, never the
-  value, and shows `library-fetch-no-grant` when the fetch refuses (webby-0151 R3).
+- The fetch falls back to slot `library-gitea` only while the bus has never recorded a gitea grant event
+  for the chief. The check reads the events table for any event matching `GRANT_EVIDENCE`
+  (`broker.mjs:246` at aca16404c) with `method` `gitea` and `agent` equal to the chief, of any action. It
+  never reads `gitea_grants`. A revoke deletes that row (`broker.mjs:2785`), so does grant-lost (`:2609`),
+  and the table has no state column (`packages/bus/schema.sql:469-480`). The events table is append-only
+  (`schema.sql:131-132`), so the check survives a revoke, a grant-lost and a fire. It names no project,
+  since `grant.applied` and `grant.revoked` carry none (`:2469`, `:2787`). A chief grant on any project
+  ends the fallback, which fails safe (webby-0156 R4). An install that runs before C2-21 still syncs. Once
+  such an event exists, a revoked or `held` grant, or a fired chief, refuses the fetch with
+  `library-fetch-no-grant` and the slot is never read. A write, a revert and a save never fall back to the
+  slot. `library.status` names which credential the last fetch used, by kind and user, never the value,
+  and shows `library-fetch-no-grant` when the fetch refuses (webby-0151 R3).
 - Her save and revert read slot `library-human`. A missing slot, or one failing the helper's file checks,
   refuses `library-human-missing` before any git call.
 
@@ -1906,12 +1912,15 @@ Tests: against a local bare repo through the module parameter, a fast-forward pu
 moved tip reports the race, a second race refuses `stale-base`, and a dead remote refuses
 `library-push-failed`. The helper answers with the named seat's user and file and refuses another seat's
 user, a symlinked file, a 0644 file and another uid's file. The fetch uses the chief's file when a live
-grant exists and the slot only when no chief grant record exists. With a revoked, a `held` and a fired
-chief's grant, each with a valid slot file present, the fetch refuses `library-fetch-no-grant`. The same
-three cases with the slot file at mode 0000 still give `library-fetch-no-grant`, not a read error, which
-shows the slot is never opened. A missing `library-human` refuses `library-human-missing` and runs no
-git. A search of argv, the mirror's config, the run log and test output
-finds no fixture token. A mutant that adds `+` to the push refspec fails.
+grant exists and the slot only when the events table holds no gitea grant event for the chief. The revoked
+case revokes the chief's grant through `grants.revoke` and the fired case fires the chief through
+`instance.fire`, the broker's real paths, and each asserts the `gitea_grants` row is gone before the fetch
+runs. With that revoked grant, the fired chief and a `held` grant, each with a valid slot file present,
+the fetch refuses `library-fetch-no-grant`. A chief grant on a project other than the library project also
+ends the fallback. The same three cases with the slot file at mode 0000 still give
+`library-fetch-no-grant`, not a read error, which shows the slot is never opened. A missing
+`library-human` refuses `library-human-missing` and runs no git. A search of argv, the mirror's config,
+the run log and test output finds no fixture token. A mutant that adds `+` to the push refspec fails.
 
 ### Out of scope