launchpad: row 294 BUILD.md M1 expectation corrected (Duckworth C1), review recorded with N1-N4 dispositions

agents/launchpad/work/queue-294/BUILD.md

@@ -244,7 +244,7 @@ Mos through Sage first (mos-1272).
 
 | # | Change | Killed by | Expected |
 |---|---|---|---|
-| M1 | remove the `userRoute` gate call in serve.mjs | G4 (transport ran, code is `access-refused` or `not-configured`, not `owner-only`) | G4 red; **G5 and G4's "refused, nothing written" stay green: the bus refuses on its own** |
+| M1 | remove the `userRoute` gate call in serve.mjs | G4 (:239, first route answers 403 `access-refused`, not `owner-only`) | G4 red at :239 on its first route; G5 green in the same run |
 | M2 | skip `access.check(session)` per request | G3 | red |
 | M3 | change one word of the notice in user.html | G6 | red |
 | M4 | `peers: []` back in accessContextFor | the F8 peer test and B1 (access-boot.test.mjs) | red |
@@ -257,8 +257,12 @@ Mos through Sage first (mos-1272).
 | M11 | chat.mjs keeps the last request's args in `channel()` and passes them to `owner('plugins', …)` | G9 (thread create's `{project, name}` reaches owner) | red |
 
 M1 is the brief's "owner verb still refused by the bus": with the Console gate gone, the owner
-verb reaches the broker over the user transport and the broker refuses it (`access-refused`, 403,
-nothing written). G4 kills M1 because it pins the Console's own code and a zero transport count.
+verb reaches the broker over the user transport and the broker refuses it (`access-refused`, 403).
+G4 kills M1 at :239 on its first route, because it pins the Console's own code `owner-only`. The
+count and "nothing written" asserts at :242-244 come after the loop, so under M1 they never run;
+the run records G4's failure with the actual value (`access-refused`). The bus refusing on its own
+is shown by G5, green in the same M1 run. (Corrected per Duckworth C1, duckworth-0249b; the earlier
+row said G4's "refused, nothing written" stayed green, which cannot be observed under M1.)
 
 ## Run limits
 
@@ -276,4 +280,18 @@ no failed test goes to Sage first; a timeout in the shell phase goes to Mos unpl
 
 ## Review
 
+Round 1, manifest 0b3f9c9d…94f3 (ca710eabd): Duckworth APPROVE (static), duckworth-0249b, note
+agents/duckworth/work/row294/ROUND1-ca710eabd.md on duckworth/reviews 5b7089ea1. The owner-transport
+exception is accepted and does not go to Mos.
+
+- C1: the M1 row and note above are corrected. The M1 run records G4's :239 failure value and G5.
+- C2: the gate runs on Sage's CLEAR.
+- N1 (no test reaches the C2b swap): no M12 in this row. Adding one needs a new test and a new
+  manifest round after approval; the brief does not require it. Left as a follow-up for Sage to
+  place: a test that a user session's options carry no owner caller besides `plugins`, with an M12
+  where serve.mjs keeps the owner's `send` for a user session.
+- N2, N3: accepted as they stand; no change.
+- N4: the user-bus.mjs fold-back (C7) is proposed to Sage as a queue row, for the next
+  channel-proof re-pin.
+
 ## Runs