Keep setting aside and discarding an aside on the operator's hand tools, refused by restore-kept

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

03-DESIGN/01-to-be/47-milestones/G-12-develop-answers-fourth.md

@@ -47,8 +47,9 @@ that round are written into the lines they name, here. Questions that an earlier
   kept data's local name), `form`, `fingerprint`, `why` and `catch-up` as `{tool, arguments}` (§451); its point
   (the module, the kept data, its form, the fingerprint, `snapshot`, `consumers` with each durable consumer's
   stream, name and acknowledged sequence, `size` in bytes, `at` and `catch-up`) comes on its event `ended` (§554); `restore-kept` takes
-  `module`, `kept`, `form`, `fingerprint`, `why`, `from-backup` (yes or no) and one of `snapshot` (the restore point's
-  name), `aside-only` (the operator's hand tool alone, §554) or `discard-aside` (an aside's `id`), and its result (`restored`, `aside`, `missing`, true when the
+  `module`, `kept`, `form`, `fingerprint`, `why`, `from-backup` (yes or no) and `snapshot` (the restore point's name),
+  and refuses `aside-only` and `discard-aside`, answering `error` naming them: setting aside without restoring and
+  discarding an aside are the operator's hand tools alone (§554); its result (`restored`, `aside`, `missing`, true when the
   point is not in the recovery module's directory, and `error`) comes on its event `restored`. Both verbs answer only
   `accepted`, `busy` or `error` (§554). No argument `local-name` or `from` is taken, and a
   catch-up is never text.
@@ -74,14 +75,15 @@ that round are written into the lines they name, here. Questions that an earlier
     restores the aside under the live names and sets the consumers back before it answers `failed`, and at its start
     the recovery module does the same for every aside whose record ends at `removed`, so a failed or stopped restore
     never leaves the kept data gone. The aside's `id` is that directory's name, its `name` the bus name it was live
-    under, its `size` its bytes on disk; nothing of an aside stays on the bus. `discard-aside` removes that directory
+    under, its `size` its bytes on disk; nothing of an aside stays on the bus. `recovery_discard_aside` (§554) removes that directory
     and nothing else, an `id` holding `.`, `..` or `/` refused. A restore point is removed only as §551 says.
 
   This completes §405 and §406. Why: the operator's answer of 12:55 CET (§554) puts the taking and restoring of a
   module's kept data on the live bus on a module of its own; the server restores a stream only where no stream of that
   name exists, so the live data is set aside as a snapshot before the point takes its name (develop questions BKP1,
   BKP3 and NATS4's argument names; review round 1, running and testing 1, seams and tools' notes). How it is checked:
-  unit (mesh-recovery's contract), each verb's input and answer read, an input naming `from` refused; whole (recovery
+  unit (mesh-recovery's contract), each verb's input and answer read, an input naming `from` refused; a node-engine's
+  `restore-kept` with `aside-only` or `discard-aside` refused, naming them; whole (recovery
   module, backup holder, bus), a point is taken, its directory removed, brought back with `from-backup` and restored,
   the live data's aside listed with its size and the consumer at its recorded sequence; a point missing from both says
   `restore point missing`; a restore made to fail after the removal, and one stopped there and started again, leave
@@ -95,7 +97,7 @@ that round are written into the lines they name, here. Questions that an earlier
   made. Why: a module's tools read everything it holds (*Tools are how a module is spoken to*), and the list is the
   holder's own fact (ADR 0596 §2; develop question BKP2; review round 1, seams and tools 4). How it is checked: whole
   (recovery module), `kept-points` lists a point and an aside with their sizes, an aside is gone after
-  `discard-aside`, and a restart lists the same.
+  `recovery_discard_aside`, and a restart lists the same.
 - §523 **A seat event whose subject has parts.** A seat definition's `subject` with `<part>` tokens (§397), such as
   `mesh-recovery`'s `ended.<module>.<kept>` and `node-backup`'s `item-started.<node>.<module>` (§554), is said on
   `mesh.seat.<seat>.event.` followed by the subject, each part filled in the definition's order: the seat
@@ -537,7 +539,7 @@ that round are written into the lines they name, here. Questions that an earlier
   beside a `restore-kept` (§554). Each removal is written in the hand-act log of the seat `mesh-hand-acts` and said as
   `mesh-recovery`'s event `point-removed` on `mesh.seat.mesh-recovery.event.point-removed.<module>.<kept>` (`module`,
   `kept`, `form`, `fingerprint`, `snapshot`, `at`), kept 90 days (§396). The backup holder's copies go by its
-  repository's own rotation (ADR 0235 §4). Data set aside is removed only by `discard-aside` (§516). This completes
+  repository's own rotation (ADR 0235 §4). Data set aside is removed only by `recovery_discard_aside` (§554). This completes
   §516 and answers issue 1921's note on the retention of restore points. Why: the operator's answer; the event, the
   checks and their order are the design's. How it is checked: whole (recovery module), a point older than 90 days is
   removed and said, the newest point of a kept data older than 90 days stays, and a removal due during a restore runs

03-DESIGN/01-to-be/47-milestones/G-14-recovery-module-and-review.md

@@ -76,15 +76,15 @@ are written into the lines of G-12 they name.*
     2026-11-11 13:10 CET: "if something asks for a restore, you should do it; he'll have his reasons".
     `kept-points` takes the default of a read (§391). The operator, 2026-11-11 13:06 CET at lead-47's terminal: setting
     aside is a move, not a removal, so deleting the live objects once their aside is whole and checked (§516) needs
-    no person's warrant, the data staying in the aside until `discard-aside`; `aside-only` is the operator's hand tool
-    alone, `recovery_aside` (class `act`, callers `operator`); and `discard-aside` and the hand tools are checked by the
-    identity of who asked: they are taken only from the operator's account as the bus proves it, and from sessions
+    no person's warrant, the data staying in the aside until the operator discards it; setting aside without restoring is
+    the operator's hand tool `recovery_aside`, and discarding an aside the hand tool `recovery_discard_aside`, both of
+    class `act`, callers `operator` and `sessions`, written in the hand-act log first; `restore-kept` refuses
+    `aside-only` and `discard-aside`, naming them (§516). The hand tools are checked by the identity of who asked: they are taken only from the operator's account as the bus proves it, and from sessions
     acting on it as for every `act` tool (§391), with no warrant asked per act. Each act is written in the hand-act log of the seat `mesh-hand-acts` first, with the caller the
     bus proved and `why`; an act whose log write fails does nothing and answers `error`, naming the log (as §480).
   - **The operator's hand tools.** `recovery_take` (take a point of one module and kept data now), `recovery_restore`
     (restore one point) and `recovery_retry` (ask again the last failed act of a module and kept data), each of class
-    `act`, callers `operator` and `sessions` (§391), written in the hand-act log; they skip the want check, since the
-    operator's call is the reason.
+    `act`, callers `operator` and `sessions` (§391), written in the hand-act log; they are checked by identity, as above.
   - **Its account.** Composed by the grants part from the seat's definition and the manifest: the bus's stream
     snapshot and restore subjects with their chunk subjects, a stream's deletion and a durable consumer's creation,
     only for the bus names of a module's kept data; the subjects its seat says and its hand-act log write; its
@@ -129,17 +129,18 @@ are written into the lines of G-12 they name.*
   account's hold no restore; whole (recovery module), a call from an account that is no node-engine's refused, a
   `busy` answer then the act on the other's `ended`, a second form change not woken by the first's `ended`, a dump
   asked during a restore starting after `restored`, a restart during the dump starting no restore, an act whose
-  hand-act log write fails doing nothing, and an unrestored aside failing the health check.
+  hand-act log write fails doing nothing, an unrestored aside failing the health check, a node-engine's `restore-kept` with `aside-only` or `discard-aside`
+  refused, and the operator's `recovery_discard_aside` removing the aside and writing the log.
 - §555 **What moves to the recovery module.** §296 asks `mesh-recovery`'s `snapshot-kept` and waits for its `ended`,
   never the seat `node-backup`; §297 asks its `restore-kept` and waits for its `restored`; §302's `backed-up` lists
   the recovery module's data item as any item, and the restore points and asides are listed by `kept-points` (§517),
-  `discard-aside` being `restore-kept`'s; §303 and test 36 name the recovery module where they named the backup
+  an aside discarded by the hand tool `recovery_discard_aside` (§554); §303 and test 36 name the recovery module where they named the backup
   holder and the bus module; §337's and §405's callers `holder:node-backup@same-node` go with the two verbs of
   `mesh-broker`, which gains none; the seat `node-backup` gains nothing for kept data on the bus: its `aside` and
   `discard-aside`, the arguments `kept`, `form` and `fingerprint` of its `now` and `restore`, and its events
   `ended.<node>.<module>.<kept>` and `restored.<node>.<module>.<kept>` go from its definition in mesh-contracts, and
   it gains only `item-started` and `item-ended` with their `<item>` token, and names `holder:mesh-recovery@same-node`
-  among `restore`'s callers for the recovery module's own item (§554); §450's `aside` answer is `restore-kept`'s with `aside-only`;
+  among `restore`'s callers for the recovery module's own item (§554); §450's `aside` answer is `recovery_aside`'s;
   §406's catch-up is recorded in the point as before. Why: one owner of the acts (§554). How it is checked: unit
   (definitions), `node-backup` and `mesh-broker` hold none of the moved verbs; test 36.