row 269 (264b, #1774): BUILD.md names the sessioned-survivor residual in Q2 and records N1's mos-1292 allowance (duckworth-0159 N3, N4)

agents/gizmoduck/work/queue-269/BUILD.md

@@ -182,6 +182,11 @@ with `id` = the thread id (3k-3l.sql:50-51). The rule reads only an immutable ro
   check holds the instance then, for sessionless survivors and thread starts only (duckworth-0158
   N1). recover() waits up to 5 s per leftover for the outer pid and the runner (N2, see "recover()
   change, for a design read").
+  Residual (duckworth-0159 N3): a survivor with a `session` counts nowhere, because :309 counts
+  only sessionless entries. The same session could start again while the old runner lives. The
+  lock doesn't catch it either: it records the outer pid as runPid (launcher.mjs:574), so with the
+  outer pid gone it reads stale and is taken over. The base has the same exposure. In practice
+  the runner dies with its pid namespace when the outer bwrap is killed.
 - start(): the store and workspace come from the session. The lock covers checkouts and spawn.
   `bindLaunch` gets `session`, and the entry records it.
 - threadPass(): one pass per session row. `startedFor` and `refusedThreads` key on the session.
@@ -376,8 +381,9 @@ the log-line edit after it, against aca16404c:947-976.
 - Fallback, if Duckworth or Sage doesn't accept this: revert recover() and check() to the base
   behaviour, keeping only the sessionless check over the registry, the pre-recover leftovers and
   bwrap survivors. Drop the legacy-run-live test and M10-M12, and name the untestable path here.
-- N1 (refusedOnce pins `actor_run`) changes a pre-existing test. Under mos-1290 term 5 it goes to Mos
-  first, so the edit stays out of the code commit until Mos rules.
+- N1 (refusedOnce pins `actor_run`) changes a pre-existing test. Mos allowed it in mos-1292 (copy
+  mos-1294) on mos-1285's terms, and it's committed as a81b3446e, with a closing line on the
+  DEFERRED.md entry.
 
 ## Rollback