A node is a conversation, and that is not the employee model

Moving this out of 0003 and out of its vocabulary. I had spent three attempts
fitting the node's own session into the agent-as-employee record, each time
bending hired, draining, reassigned and retired to cover something none of them
describe. 0003 is back to its original text.

It belongs in 0004, under what a node is, because that is what it is -- not a
program installed on a node but part of the node. It holds one session
permanently, anything in the mesh can message it, and it remembers across
callers and across weeks. Its system prompt is the engram, which is recorded
here for the first time despite running on every node.

Also recorded: it has its own narrower tool list, so it can go and look rather
than only report about itself; there is no authorisation between nodes, because
every node is the operator's own; and how a node passes a question on is its
own business rather than a protocol field.

Switched off it still answers, and that is the point of having an off state
rather than an absent one. A node with nothing there is a silence somebody has
to diagnose. A node that says it is switched off is not. Same rule the host
follows about a service that does not exist.

0001's summary is corrected too: it had one row for "agents", which is the
conflation being complained about. Two rows now. A node's own session and a
hired worker are built from the same parts and run on entirely different terms.

Left standing and NOT resolved here: 0001 says a node does not authenticate to
a model provider, agents do. A node that holds a session does. That is a real
conflict between what is recorded and what runs, and it needs deciding rather
than a fourth reconciliation from me.

02-DECISIONS/0004-a-node-and-how-it-joins.md

@@ -28,6 +28,52 @@ asked to do — and that belongs in the host's profile rather than in the defini
 because its absence is every node in the ordinary disconnected situation at once. An episodic
 host on a phone is that situation more often. Neither needed a new mechanism.
 
+### A node is also a conversation
+
+*Written 2026-08-29. It runs on every node today and appeared in no record, which is how something
+deliberate comes to look accidental.*
+
+**A node holds one session, permanently, and it is part of what the node is** — not a program
+installed on it. Anything in the mesh can send it a message; it replies; and it remembers. What it
+was asked ten minutes ago is still there next week, alongside what everything else asked in
+between, the same way both sides of any conversation remember it.
+
+Its system prompt is the node's **engram** — what makes one node's replies recognisably its own
+rather than generic.
+
+**It has its own tools**, and fewer than a session a person is driving directly. So a question can
+be answered by going and looking: *what is in our forge*, not only *what is your battery*.
+
+**Messages travel the broker like everything else** ([ADR 0002](0002-nodes-communicate-over-a-broker.md)).
+There is no second transport and nothing is dialled.
+
+**Any node can message any node, and this is the one part of the system that is genuinely a mesh**
+— symmetric, with no centre. A node that is asked something it does not know can ask another, and
+how it passes the question on is its own business: it may say who wants to know, or simply ask. A
+person relaying a question makes the same choice, and it follows from the engram rather than from a
+message format.
+
+**There is no authorisation between nodes.** Every node is the operator's own, so a message from
+one is a message from them, and asking a node something is asking a colleague rather than
+presenting credentials. Stated once so it is not discovered later: **the mesh boundary is therefore
+the security boundary** — anything inside can reach what any node can reach, which is what puts the
+whole perimeter on the token and the overlay
+([ADR 0007](0007-connectivity.md)).
+
+**It can be switched off, and switched off it still answers.** A node whose session is disabled
+replies saying so, at once, with no model involved — the queue is still read, and the state is the
+reply. That is deliberate and it is the same rule the host follows about a service that does not
+exist: **absence must never be indistinguishable from a failure to answer.** A node with nothing
+there is a silence somebody has to go and diagnose; a node that says *I am switched off* is not.
+
+**One per node, always, and it cannot be moved to another machine.** Two and nothing decides which
+replies; none and the node is mute; moved, and one machine is answering as another.
+
+**It is not an employee** ([ADR 0003](0003-agents-are-persistent-employees.md)). Nobody hires it,
+it holds no tasks, it drains nothing and it is never reassigned — that vocabulary was written for
+workers and does not describe this. It exists because the node does, and it is gone when the node
+leaves.
+
 ## How it joins
 
 **The host has one behaviour and two sources of declaration.** What differs between the first