gosalyn: Case 2 design round 3 for Webby webby-0156 R4: the fetch fallback reads GRANT_EVIDENCE events with method gitea and agent the chief in the append-only events table, never gitea_grants, and names no project, so it survives a revoke, a grant-lost and a fire and fails safe. The ruling paragraph, 7.2 and section 10 steps 4 and 4b say so, cited at aca16404c

agents/gosalyn/work/case2/DESIGN.md

@@ -348,8 +348,13 @@ granted `permissions`. If either fails, C2-21 stops and goes to Mos.
 
 The mirror's fetch uses the chief's token, whose grant is `read`, and the chief's user in the askpass
 helper. That replaces the bot slot `library-gitea` from C2-03a. C2-03b makes the change. The fetch falls
-back to slot `library-gitea` only while no gitea grant record for the chief on the library project has
-ever existed, in any state, so an install that runs before C2-21 still syncs. Once one exists, a revoked
+back to slot `library-gitea` only while the bus has never recorded a gitea grant event for the chief.
+The check reads the append-only events table (`packages/bus/schema.sql:131-132` at aca16404c) for any
+`GRANT_EVIDENCE` event (`broker.mjs:246`) with `method` `gitea` and `agent` the chief. It never reads
+`gitea_grants`, whose row a revoke and a grant-lost delete (`broker.mjs:2785`, `:2609`), and which has
+no state column (`schema.sql:469-480`). It names no project, since `grant.applied` and `grant.revoked`
+carry none (`:2469`, `:2787`), so a chief grant on any project ends the fallback, which fails safe
+(webby-0156 R4). An install that runs before C2-21 still syncs. Once such an event exists, a revoked
 or `held` grant, or a fired chief, refuses the fetch with `library-fetch-no-grant`, and `library.status`
 shows it. A write, a revert and a save never fall back to the slot. When `library.status` shows the fetch
 on the chief's grant, Jason deletes slot `library-gitea` (10 step 4b, webby-0151 R3).
@@ -1389,8 +1394,8 @@ C2-03b adds the push for C2-02's commits, the one race retry, `library-push-fail
 `library-remote-invalid` refusals of writes (B9). It also changes whose token the helper answers with: the
 chief of staff's grant token and Gitea user for the fetch, in place of slot `library-gitea`, the writing
 seat's own grant token for its write, and slot `library-human` for her save and revert (ruling after
-r11). The fetch falls back to slot `library-gitea` only while no chief grant record has ever existed, and
-nothing else ever reads that slot. There is no `unpushed` state.
+r11). The fetch falls back to slot `library-gitea` only while the events table holds no gitea grant
+event for the chief, and nothing else ever reads that slot. There is no `unpushed` state.
 
 Tests (C2-03a): `syncCommand` argv equals `SAFE` plus the fixed sequence above, with no other
 `protocol.*` key. Its env holds `LC_ALL=C` and `GIT_ASKPASS` pointing outside the mirror. The helper
@@ -1753,16 +1758,16 @@ Her own token signs her Console saves.
    `<configDir>/secrets/<business>/`, which is `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` for
    `mosaic`, mode 0600. He puts it there, or says who may, per the Q173 secrets rule. Agents never print
    it. If the install runs before C2-03b lands, the C2-03a fetch still reads slot `library-gitea`, which
-   then needs a read token as r11 said. After C2-03b the fetch reads that slot only while no chief grant
-   record has ever existed (7.2). Step 4b removes it.
+   then needs a read token as r11 said. After C2-03b the fetch reads that slot only while the bus has
+   no gitea grant event for the chief (7.2). Step 4b removes it.
 4a. `scripts/case2-precheck.sh --business <business> --library-status` as `<user>`, once the bus is up
    and the fetch token is in place. It reads the bus's recorded sync state only and syncs nothing. It
    refuses when the mirror is missing, when `lastError` is set, or when `lastFetch` is null. It prints
    each R-problem as a `problem` line and then a count, never text (sage-2189). The bus syncs every 60
    seconds, so the first check after step 4 may have to wait for one sync.
 4b. Once C2-21 has run and `library.status` shows the fetch on the chief's grant, Jason deletes slot
-   `library-gitea` and revokes its token in Gitea. The fetch never reads the slot again, since a chief
-   grant record then exists (webby-0151 R3).
+   `library-gitea` and revokes its token in Gitea. The fetch never reads the slot again, since a gitea
+   grant event for the chief then exists and events are never deleted (webby-0151 R3, webby-0156 R4).
 5. Her Console sign-in from her machine: her Authentik user and `sub` once SSO lands (#412 step 3 is the
    model), or his ruling on an interim. The proxy forwards to the Console's port below 1024 and sets the
    proof header. The proof file goes under `<configDir>/secrets/`, mode 0600, owned by `mosaic`, and