plans: row 126 brief names the 3h to 3i step and the account guard (#1620)

Filbert's r1 note (a): the scope line didn't name the 3i rebuild or the
account-is-credential guard, which sage-0970 and mos-0835 authorize.
Item 6 describes both. The acceptance list gains the mos-0835 tests, and
the scope bullet now covers the migration step, the version bump and the
guard.

docs/plans/2026-10-14_prd-1.2-build.md

@@ -530,6 +530,18 @@ since its `since`.
    keyed on the `daily` path, saying it counts only the stack's own use
    (lead decision 142, ruling 9). No new report field: core's report
    validation stays as row 125 left it.
+6. **Bus schema 3h to 3i** (Sage, 2026-10-19, sage-0970; Mos's go,
+   mos-0835). Schema 3h holds `usage_records.account` to
+   `CHECK (account IS NULL)` (`packages/bus/src/migrations/3g-3h.sql`), so
+   item 1 can't write the name without a rebuild. A new step,
+   `packages/bus/src/migrations/3h-3i.sql`, rebuilds `usage_records` and
+   its three triggers in one transaction and drops only that CHECK. The
+   launcher refuses `account-is-credential` when `launch.account.name`
+   equals the value of a `SESSION_CREDENTIALS` variable in the bus host's
+   environment, so `account` holds a name and never a secret. 3i is
+   refactor only. It goes live through a later `activate --migrate` window
+   with Jason present, and the rollback is the pre-migrate backup
+   (`MIGRATION.md` in the packet).
 
 **Acceptance.**
 
@@ -540,10 +552,16 @@ since its `since`.
 - Tests that `token-limit` ignores `tokens.daily`, that a `daily` leaf
   with a bad `reset` or `timeZone` fails the organization-file read, and
   that a launch logs the account name and its usage records carry it.
+- For item 6: a test that forces a failure partway through the 3h to 3i
+  step and finds the store at 3h with every row; a test that sqlite_master
+  for `usage_records` and its three triggers equals 3h's apart from the
+  account CHECK; a test that the launcher refuses an account name equal
+  to a credential; and the packet's DESIGN.md corrected where it said no
+  schema change.
 - Outside `packages/plugins/limit-check/daily-quota/`, the diff touches
-  only item 1's account naming, the two `DEPTH` tables, the
-  `checkTokenLimits` schema and item 5's fixed line, with their tests and
-  docs. No sandbox change.
+  only item 1's account naming, item 6's migration step, version bump and
+  account guard, the two `DEPTH` tables, the `checkTokenLimits` schema and
+  item 5's fixed line, with their tests and docs. No sandbox change.
 - One mutant per behavior above, each with the test that kills it.
 
 ## Quota for more than one account or per proxy key (parked on #237)