plans: row 139 follows Jason's Q169, only the chief of staff or the human removes the assistant

Q169 replaces Mos's sage-0523 ruling. The chief of staff's end of the
assistant succeeds, another role's arbiter-resolved revoke of it is
refused, a human-resolved one still works, and other cited revokes route
by REQ-DEC-2. Reconfiguring the assistant is a separate row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-10-15_q167-rows-r3.md

@@ -439,8 +439,8 @@ Jason on 2026-10-15.
 - `roles/*.json`, grants only as the PRD 1.5 text requires
 - tests in the bus and business packages, and READMEs; in
   `scripts/test-land-work.sh`, only the arbiter-resolved `not-human` case
-- `docs/prd/mosaic-stack.md`, only the note under REQ-WAIT-1 for the
-  assistant revoke ruling below
+- `docs/prd/mosaic-stack.md`, only the note under REQ-WAIT-1 for Jason's
+  Q169 ruling below
 
 ### What ships
 
@@ -464,16 +464,28 @@ Jason on 2026-10-15.
   to the arbiter, for an uncited decision still going to the human, for a
   stale spec citation, and for the land refusal: a coder raises a cited
   merge decision, the arbiter approves it, and the land refuses.
-- A test that a cited role.revoke of the assistant goes to the human and
-  that an arbiter can't resolve it, beside a test that a cited revoke of
-  another role still goes to the arbiter.
-- A revoke of the assistant stays with the human (Mos's ruling, sage-0523,
-  which Jason can override). The assistant is Jason's own channel into
-  the Stack. A role.revoke whose target's definition is in
-  `END_PROTECTED` (`broker.mjs`) routes to the human even when the raise
-  cites the current spec, and an arbiter's resolve of it is refused.
-  Every other cited revoke routes as REQ-DEC-2 says. The PRD notes this
-  under REQ-WAIT-1 as a Mos ruling Jason can override.
+- Jason's ruling Q169 (DECISIONS, brain repo; it replaces Mos's ruling in
+  sage-0523), verbatim: "The only agent that should be able to remove the
+  assistant role is the chief of staff. The COS and the user should have
+  the ability to (re)configure the assistant role and seat name. The user
+  via WebUI or CLI, the COS via the proper tooling." For this row:
+  - a revoke or end of an instance whose definition is in `END_PROTECTED`
+    (`broker.mjs`) goes through only when the chief of staff acts, or
+    when the caller cites a decision the human resolved through the CLI;
+  - the chief of staff's `role.end` of the assistant, with a reason,
+    succeeds. Ending the caller's own run stays refused;
+  - any other role's revoke of the assistant is refused, and that
+    includes a cited raise an arbiter resolved. A raise for it routes to
+    the human even when it cites the current spec, never to an arbiter;
+  - every other cited revoke routes as REQ-DEC-2 says;
+  - the PRD notes this under REQ-WAIT-1 as Jason's ruling Q169.
+  Reconfiguring the assistant's definition and seat name is a separate
+  row, not this one.
+- Tests for Q169: the chief of staff's end of the assistant succeeds;
+  another role's cited revoke of the assistant, resolved by an arbiter,
+  is refused; a revoke of the assistant citing a human-resolved decision
+  still succeeds; a cited revoke of a role not in `END_PROTECTED` still
+  goes to the arbiter.
 - Whichever of 137 and 139 lands second makes the host land op accept an
   arbiter-resolved merge decision, as row 137's brief says. Row 139 always
   adds a test that land-work still refuses an arbiter-resolved merge