gosalyn: row 229 design draft 1 after mos-1306: Chet's route has no fallback by default with a human-only fallback still possible through routes, and the dates note records that the live check gates every build row, not the design

agents/gosalyn/work/queue-229/DESIGN.md

@@ -7,9 +7,9 @@ per-instance pi agent dir for Chet's Codex login (#428)". Base: `refactor` at ac
 `node_modules/@earendil-works/pi-ai/dist/...` (`pi-ai:`).
 
 This is a design. Nothing in it is built or tested. The brief's gate holds: no build row starts until
-the live check in section 9 passes, run with Jason's or Mos's go, after 10-27. Sage put this design next
-in my order (sage-2784). I read "starts after 10-27" as covering the build and the live check, not the
-design text. If Sage meant the design too, this file waits unreviewed until then.
+the live check in section 9 passes, run with Jason's or Mos's go, after 10-27. Mos ruled that "starts
+after 10-27" covers the build and the live check, not the design, and that the check gates every build
+row (mos-1306). Mos asks Jason for the go when the build rows are ready.
 
 ## 0. Summary
 
@@ -29,7 +29,8 @@ design text. If Sage meant the design too, this file waits unreviewed until then
   dir. No login refuses `pi-login-missing`, and a broken file refuses `pi-login-invalid`.
 - The human logs in with a new `mosaic pi-login <business> <instance>`. It runs pi's own `/login` with
   the dir set, so Mosaic gets its own fresh grant. It never copies Hermes's `auth.json`.
-- I recommend Chet's route has no fallback. A fallback would quietly move him back onto Bean's Z.ai key.
+- Chet's route has no fallback by default (mos-1306). A fallback would quietly move him back onto Bean's
+  Z.ai key.
 - Two build rows: 229a, the store, the checks, the bind, the env, the preflight and the tests. 229b, the
   login command and the README.
 
@@ -169,9 +170,11 @@ fails the first turn when its refresh fails, and the turn's failure is visible i
 fix is the same login command. I chose `--no-refresh` over a refresh at preflight because a host-side
 refresh would race a running session of the same instance.
 
-Fallback. Row 65 lets a failed primary preflight take the stated fallback. I recommend Chet's route
-states no fallback. A fallback onto Bean's Z.ai key would make a lost login silent: Chet answers on
-another provider and Melanie can't tell. Without one, the launch refuses with `pi-login-missing`.
+Fallback. Row 65 lets a failed primary preflight take the stated fallback. Chet's route ships with none
+(mos-1306). A fallback onto Bean's Z.ai key would make a lost login silent: Chet answers on another
+provider and Melanie can't tell. Without one, the launch refuses with the preflight's code. Under Q222 a
+human can still add a fallback through the human-only routes setting. This row only makes none the
+default, and no agent path adds one.
 
 ## 7. The login command (229b)