# Row 285 / #1790 r4 review packet

Candidate: the pushed magica/row285-r4 tip accompanying the manifest.
Base: d0a6a87cd (landed 296 + 217). Initial r4 receipt: 0f6cdc861.
Owner: Magica. First reviewer: Poe. Landing reviewer: Webby. Sage posts requests.

The build grants the six creative definitions library.write and the declared Gitea
service, gives the chief a read-only Gitea declaration, and requires its instance
reference exactly when the business declares a library. The current write-scoped
grant path still refuses the chief. No live business file is changed.

Binding scope is the C2-08b brief, Scrooge's retained BUILD, and mos-1580 through
mos-1586 as quoted in BUILD.md. N1 (creative-only library.write role validation)
remains a follow-up. No grant executor or write verbs join this row.

Review the entire original role/contract/vocabulary patch and the new instance
settings logic. The latter is limited to actual instance credential references,
duplicate-first hiring, and the creative-only equal-service exception:

- Derive creative status from reviewed withinRole library.write, not role names.
- Preserve all non-creative definition fences and base accepted values.
- Validate the full proposed creative change before its credential guard.
- Permit retention only between creative definitions with identical DECLARED
  service sets. Host stays in that set even though it has no file reference.
- Retain credential objects byte-for-byte; call no credential creation or mint.
- List creative definitions only for the existing Gitea store add path; another
  service retains the base accepted value.

Check every old assertion, especially instance-settings 68/131/189/211/290/306/311
and lifecycle 191. Those two files must be byte-identical to the initial r4 tip.
Check the B1 token-only insertions against e0c6142f3 and the final data fixes
against d0a6a87cd. The only non-credential fixture change is the explicitly ruled
tracker credentials?.vikunja guard; its put() role set remains pm/cto/coder/reviewer.

Read the new instance-credential-transitions tests. Its auxiliary creative-host
case must validate as an ordinary business before the declared-service fence
refuses it, so M13 is evidence for the equal-set guard itself. M15 must preserve
the old validator-first BusinessError. M11/M12 cover the two earlier guard reds.
M10 must independently fail the new no-library positive and unchanged Case1 test.

Manifest hashes, final whole-suite/script counts, mutant receipts, blob restoration
and controls are recorded in BUILD.md and gate-r4-final. Earlier r3/r4 failed logs
are historical evidence and are not green acceptance claims. The completed release
file has an 1800-second bound because its unchanged collection run takes about
600 seconds; the original 300-second interruption is retained, never overwritten.