plans: row 165 brief correction, the second reviewer waits on P19 367 (mos-0823)

reviewer, coder, pm and cto declare gitea and vikunja credentials, and the
row keeps credentials out. The writer refuses an added instance or a
definition change whose definition declares credentials, with a named
refusal that says why, and never writes an instance without its binding.
One added test line. Acceptance 314 is covered: security-reviewer and
merge-gate declare none. Jason rules on credential binding in daylight.

docs/plans/2026-10-18_role-instance-verb.md

@@ -21,6 +21,20 @@ is done. Until this row lands, acceptance 314 stays as written
 (`docs/acceptance/314.md:27-29`): Jason adds the security-reviewer and
 merge-gate instances by editing the business file.
 
+**Correction, 2026-10-18 (mos-0823).** The second reviewer in the
+example above waits on a follow-up, P19 367. This row can't add it.
+reviewer, coder, pm and cto each declare gitea and vikunja credentials
+in `roles/*.json`, and this row keeps `credentials` out (What ships item
+1, Out of scope). So the writer refuses, with a named refusal whose
+message says why, any added instance and any definition change whose
+definition declares credentials. It never writes an instance without
+its credential binding. Changing `vars` or launch membership of an
+instance that already has its binding stays allowed and leaves the
+binding untouched. security-reviewer and merge-gate declare no
+credentials, so acceptance 314 is covered. Whether the human binds
+credentials through this command is a question Mos puts to Jason. Until
+Jason rules, nothing binds credentials through it.
+
 ## The human adds and changes role instances
 
 ### Problem
@@ -112,6 +126,11 @@ Tests:
 - a call without the human proof, and any role's attempt, are refused;
 - a definition change into `END_PROTECTED`, or one that strips the
   assistant's protection, is refused.
+- adding an instance whose definition declares credentials, or changing
+  an instance's definition to one that does, is refused with the named
+  refusal, its message says why, and the file's bytes don't change; a
+  `vars` change on an instance that already has its binding succeeds and
+  leaves the binding as it was (mos-0823).
 
 Mutants: one per behavior above, with the killing test in the packet.