PR #558 follow-ups: the MainTest box-dependency rule, and a stale notes bullet nf-yva5 ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/564 by tools/beads/import_github.py's reconcile pass.

Suggestions from ninefold-reviewer's review of #558. Both are below the gate's severity floor — the PR converged at 7e75f6a with the python lane measured green on the Windows merge box (69/69) — so neither blocked it. Filed unclaimed so they are not lost.

#562 and #563 held earlier rounds' residuals and both close on #558's merge; this is their successor, not a duplicate.

1. The MainTest rule closes the PATH dependency but not the tmux-session one

tools/tests/test_spawn_dev.py:1070-1116, and it is the rule's own exemption case.

7e75f6a writes the rule down in the module docstring — *"assert only what holds on a box with neither tmux nor claude … or pass which=pretend_installed. Never let the real PATH decide."* That is right, and which= removes the PATH from the assertion. But spawn reaches tmux_alive(names, runner) before the worktree check (spawn_dev.py:828), and main passes no runner seam, so the real tmux has-session -t dev-widget still runs:

• on a box without tmux → 127 → False → flows on to nothing to resume. Fine.
• on the office box with a live tmux session literally named dev-widget → the refusal is tmux session dev-widget is already running, and assertIn("nothing to resume", errs) fails.

Not a regression — it was true at a2fcd47 too, and the $NF_DEVS_ROOT tempdir still guarantees the #563.1 safety property (nothing can be spawned) regardless. It is only that the assertion's determinism now rests on no dev being named widget, which is the same coincidence #563.1 declined to rest on. main taking a runner= seam alongside which= — one kwarg, threaded to the spawn(...) call at spawn_dev.py:1076 — closes it the same way and finishes the rule.

2. notes/spawn-dev.md still describes ensure_identity as check-only

notes/spawn-dev.md:34-36 — "Carries what git does not: … and a check that commits will land as jcantsp-bot."

Accurate before a2fcd47. Since #563.4 the function re-reads after writing and refuses the spawn when the guarantee does not hold — a post-create refusal, so it leaves a worktree behind and skips the next-steps report. That is a spawn outcome the Gotchas list does not mention, and the Gotchas list is what a ninefold reader meets it from. One bullet, same shape as the --resume-with-no-transcript one directly above it.