publish: row 242 follow-up docs, the git socket comments name the hold and the late record; BUILD.md residual and :311 cite (Duckworth N1, N2, N4, #1748)

Megavolt's c5a125f4b on megavolt/row242-docs, parent 5fb736b92 (the row 242
landing). Comments and .md only: git-socket.mjs changes comment lines at
:39-44 and :433-435, BUILD.md records N2 and N4. No test pins either path's
hash. Landed without a gate under the doc-only rule.

agents/megavolt/work/queue-242/BUILD.md

@@ -80,8 +80,8 @@ Results (Sage's slot, sage-1686, 2026-10-21T03:35:00Z to 03:35:15Z): both killed
 (cmp ok).
 
 - M1: publish-socket 8/1, the row 242 test fails at :322 in 0.5 s.
-- M2: publish-socket 8/1, the row 242 test fails at :327 (the bounded wait at :311 for one allowed
-  event) in 10.3 s.
+- M2: publish-socket 8/1, the row 242 test fails at :327, the wait for one allowed event, through
+  the assert.fail inside `until` (:311) after its 10 s bound, in 10.3 s.
 
 ## Suites
 
@@ -101,5 +101,8 @@ and scripts/test-*.sh are left for Sage's landing gate.
   notified. The allowed event and the bus log line are the only trace. A later publish on the
   decision gets decision-consumed, which tells the agent the decision was used. Whether the run
   should get a RESULT for a late record is a follow-up question for Sage.
+- A late push whose recordPublish refuses (Duckworth N2) is filed with that code: the ref stays on
+  the fork and the decision is not spent, the same residual as an in-band push whose record
+  refuses.
 - The hold lives in the bus process's memory, like the broker's open tickets. A bus restart during
   a hold drops both, the same as today for any publish in flight.

packages/cli/src/git-socket.mjs

@@ -38,7 +38,10 @@
 //          one op at a time within 10 s. The poll ends at publishDeadlineMs
 //          (publish-timeout), past git's own limit on each of the four git
 //          runs. recordPublish files the push; any refusal after checkPublish
-//          is filed once, by publishRefused.
+//          is filed once, by publishRefused. After publish-timeout the bus
+//          holds the decision until its push ends (a retry gets publish-busy),
+//          then records a push that reached the fork or files the refusal
+//          (row 242, #1748).
 //
 // A refusal is {"ok": false, "error": "<code>"}, and the connection ends.
 // The host checks, in order: identity (a role of this business), the request
@@ -427,8 +430,9 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env
           await op({ op: "publishPush", ticket });
           const until = Date.now() + publishDeadlineMs;
           for (;;) {
-            // The bus's git may still finish after this; the fork could then hold the commit with
-            // no record, as when recordPublish refuses after a push.
+            // The bus's git may still finish after this. The bus holds the decision until it does,
+            // then records a push that reached the fork (row 242); the fork can still hold the
+            // commit with no record if recordPublish refuses, as after an in-band push.
             if (Date.now() >= until) {
               log(`git socket: publish ${task_ref}: publish-timeout; the bus process's push may still reach the fork`);
               throw new Refusal("publish-timeout");