plans: DEFERRED row 306 N1 (revoke Set lost on broker restart) and N2 (pending limit stop answers not-holder first), landed 2d0318a44 (mos-1463)

docs/plans/DEFERRED.md

@@ -664,3 +664,17 @@ collection never checks it again and the count reads as known with 0. The row 30
 behavior as it stands, so the move didn't change it. Bound to a follow-up row on row 270's
 store-unreadable path. The fix keeps the unreadable state until the header reads clean, or re-checks the
 header on every collection. Either way it's an old-test change and goes to Mos.
+
+## Row306 N1: the revoke Set doesn't survive a broker restart
+
+Morgana, row 306 BUILD.md (#1813, landed 2d0318a44; Dewey agrees, dewey-0918). `#accessRevoked` lives in
+memory. After a broker restart, recover() rebinds an earlier host's run, and if that run makes a bus call
+before the launcher's SIGTERM, it answers `not-holder` and the run exits 22, as every revoked run did before
+306. Seeding the Set at a rebind needs a mark only `#revokeLost` writes; `reason` and `by` on the ended
+claim aren't one (design D1's alternative). Bound to the next row that changes the broker's recover() path.
+
+## Row306 N2: a pending limit stop answers before the revoke
+
+Morgana, row 306 BUILD.md (#1813, landed 2d0318a44). A revoked run that also has a pending limit stop gets
+`#limitStop`'s `not-holder` on `message.receive` and `state`, because that check runs before `#agent`. It's
+rare and the run still stops. Bound to the next row that changes `#limitStop` or the order of those checks.