plans: row 155 refuses a definition change into END_PROTECTED and tests the chief's revoke as a hard wait

Dewey's two edges from row 139 round 2 (dewey-0546).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-10-16_q169-assistant-config.md

@@ -79,6 +79,12 @@ What exists on base 9aa90193d:
    `broker.mjs:122`), so a change can't strip the protection.
    `holder` and `credentials` stay out of this row. The repository's
    role files in `roles/` still change only through reviewed commits.
+   No writer this row adds may change another instance's definition to
+   one in `END_PROTECTED`. Row 139's protection check passes the chief
+   of staff whichever channel recorded the resolution, so a revoke the
+   chief raised against an unprotected instance, resolved by an arbiter,
+   would get past the check if that instance then became the assistant
+   (Dewey, row 139 round 2, dewey-0546).
 2. The human configures it through a CLI command and the Console's
    settings view. The chief of staff configures it through
    `change_organization` or one new typed tool, carrying the file's
@@ -102,7 +108,12 @@ What exists on base 9aa90193d:
    - the chief of staff's change succeeds and logs the chief as actor;
    - another role's change is refused;
    - a definition change to one without the assistant's protection is
-     refused;
+     refused, and so is a change that gives another instance a
+     definition in `END_PROTECTED`;
+   - a revoke of the assistant raised by the chief of staff is a hard
+     wait that goes to the human and that no arbiter resolves, as
+     REQ-ROLE-2 in PRD 1.6 says (row 139's tests raise it only as other
+     roles);
    - a stale revision is refused;
    - the human's and the chief's name changes succeed and another
      role's is refused;