Design 39 bus-and-switch: C2, the manager replaces a key pair it cannot read

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

03-DESIGN/01-to-be/39-milestones/bus-and-switch.md

@@ -541,3 +541,8 @@ written; they are cited as "design 39 bus-and-switch B*n*".
   the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part
   beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's.
   The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7).
+- **C2** (review of C1: the key-pair file the manager wrote in its state directory under the tool runner's account,
+  which the node-engine does not hand to the new owner): when the manager cannot read the key pair it finds, it makes a
+  new one in its place and says so in its journal; every use passes the public key per ask, so nothing depends on the
+  old pair (P3, P7). The node-engine handing a program-written directory's contents to a new owner (every module that
+  moves to `runs-as`) is noted on its issue, not built here.