diff --git a/agents/launchpad/work/queue-255/DESIGN.md b/agents/launchpad/work/queue-255/DESIGN.md
index b04a6c47d..6c0d905e8 100644
--- a/agents/launchpad/work/queue-255/DESIGN.md
+++ b/agents/launchpad/work/queue-255/DESIGN.md
@@ -245,10 +245,9 @@ to respect that; I recommend the first:
   The user pastes it into config.json, as with Q175 step 4. Rerunning `scripts/bootstrap.sh` (or
   `--instance NAME`) then validates it through the loader, including the section 1 cross-check, and writes
   nothing. Nothing changes in invariant 2.
-- **R2.** `enroll --write-config` writes those two keys itself, with a backup of config.json first, and
-  refuses if `console` or `components` is already present. That would be the first tool to modify an
-  existing config.json. **M2 (to Mos, only if R2 is wanted): R2 changes canon invariant 2's
-  "never overwritten" practice.**
+- **R2 (rejected, Sage sage-4401: R1 chosen).** `enroll --write-config` would write those two keys itself, with a backup of config.json first, and
+  refuse if `console` or `components` were already present. That would be the first tool to modify an
+  existing config.json, against canon invariant 2's "never overwritten" practice. Not built.
 
 Whose subject. Enroll creates one person, the one running it, and only that subject goes in the entry. On
 Jason's instances, only his subject goes into `console.sso` (mos-1197). Further people are added with
@@ -366,7 +365,7 @@ runs on .53, .54 or dragon-lin, and none installs Pocket ID on any host.
 3. **P3, unit.** The unit template, `render|install|status|remove|purge`, and the encryption key slot. Gate:
    the render and remove tests, and the sandbox bind test.
 4. **P4, enroll.** The namespaced bootstrap, the client, the subject, `relink`, and printing the entry (R1),
-   or R2 if Mos rules for it. Gate: the enroll tests in section 9, and a secret-leak grep over every test log.
+   (R2 rejected). Gate: the enroll tests in section 9, and a secret-leak grep over every test log.
 5. **P5, Console against the fake Pocket ID.** The section 9 fake-OP start tests, and the
    `NODE_EXTRA_CA_CERTS` render flag for the Console unit. Gate: the webui suite, with no change to
    `sso.mjs` checks (a diff of `sso.mjs` and `sso-config.mjs` against the base shows none).
@@ -377,7 +376,7 @@ runs on .53, .54 or dragon-lin, and none installs Pocket ID on any host.
 ## Open items for review
 
 - **M1 (Mos):** the new top-level `components` key in config.json (section 1).
-- **M2 (Mos, only if R2):** a tool writing config.json (section 5). R1 needs no ruling.
+- M2 dropped: Sage chose R1 and rejected R2 (sage-4401).
 - **Q1 (Webby):** the private network namespace for enroll (section 4). The other option is to start the
   real unit and race `/setup`, which I think is unsafe while agents share the host network.
 - **Q2 (Webby):** one-providers-entry for the bundled choice (section 1). REQ-INST-2's wording reads that