gizmoduck: row 302 BUILD.md folds Dewey's d1 approval (dewey-0875): D1 role.claim refuses a released run, landRelease reaches runner.test:742-772 so Q1 moves :771-772, Q2-Q4 and N1-N4 settled

agents/gizmoduck/work/queue-302/BUILD.md

@@ -195,3 +195,42 @@ Mutants. Each one must die on the forcing test, with the bus test also named whe
 
 Limits will be set in the run plan after the design round (mos-1275: `timeout -k 10` at three times or
 more the longest run).
+
+## After Dewey's d1 review (dewey-0875, 05:32Z): APPROVE on D1, folded here before any build
+
+D1 (required). role.claim's thread branch (broker.mjs:5154-5173) doesn't go through `#agent` and
+refuses only `run-revoked`, the session fence and `thread-already-held`. So an idle-released run could
+claim its free session again. Its key would still be in `#idled`, and a later real not-holder on that
+claim would answer `idle-released` and exit 0. Fix: the thread branch of role.claim refuses
+`idle-released` for a run in `#idled`, before the insert. The key stays, because the run's claim is over.
+Bus assertion: after threadIdle releases a-run, a-run's role.claim refuses `idle-released`, and no
+thread_claims row is added. Mutant M7: drop that check. It dies on that assertion.
+
+Correction to "Harness: no new runner.test case". That's true for threadIdle only. runner.test reaches
+landRelease, which is a role-run path: :742-772 releases coder-run with `ctx.broker.landRelease` and no
+launcher, and pins `out.code === EXIT.session` (:771) and `session stopped working: not-holder` (:772).
+If Q1 is yes, those two lines change (to stopped/0 and the released line). They go to Mos through Sage
+with threads.test:393, and that test then serves as the land-relaunch forcing case. No launcher means no
+SIGTERM, so the receive always lands after the release. The cli case for land-relaunch is dropped. If Q1
+is no, the follow-up row cites runner.test:771-772 as its evidence.
+
+Q2. The code is `launcher-released` if Q1 is yes, and `idle-released` if Q1 is no. Every name in this
+file reads that way.
+
+Q3. Agreed. A limit stop on an idled run stays not-holder and exits 22.
+
+Q4. No per-site cases. Both ops return `released:false` while a delivered message is unread
+(threadIdle via `t.unread`, landRelease via its count). The runner reads only after the reply
+(runner.mjs:575-580), so a run can't be released mid-turn. landRelease keeps a run that hasn't received
+yet (`landing:true`), and thread runs have no landing. So only the receive site can see the code. All
+four sites keep the shared helper, and the three unreachable ones get a one-line comment saying why.
+
+N1. The cli control must reach the runner before any launcher signal. It uses a role.revoke on the run
+(no launcher stop), or holds the signal the same way the forcing test does. assistant.stop gets checked
+first in case it goes through a launcher stop. It also asserts the run's runner.log has
+`session stopped working: not-holder` and `exiting 22`.
+N2. The control keeps "after an idle release", so `#idled` isn't empty when M5 runs.
+N3. M6 is equivalent. The key drop in endLaunch stays, so the set doesn't grow.
+N4. The other-pin grep also covers runner.test `session stopped working`. :558 (unauthenticated) and
+:647 (revoke) stay, and :772 changes only under Q1.
+Docs: if Q1 is yes, landRelease joins the bus README line and the harness exit-table row 0.