ADR 0265: a panicking verb answers, and refused logins are not a reconnect loop

02-DECISIONS/0265-a-verb-that-reads-is-answered-on-the-serving-controllers-own-connection-and-every-connection-says-what-it-is.md

@@ -58,7 +58,8 @@ also keeps a record of the connections it closed, with why (`/connz?state=closed
 1. **`conditions` (list, show, history), `hand-acts` and `queue` are answered by the serving controller**,
    on its own connection and its own condition keeper, by the same command function the shell runs,
    writing into the answer. A call of any of them opens no connection. `conditions silence` and every verb
-   that acts still run as their own process.
+   that acts still run as their own process. A handler that panics in the serving process answers an error
+   and the controller serves on; a command's flag errors are said in the answer, not in the controller's log.
 2. **The serving controller lends its connection** to what it does for a moment: the hand-act log, the
    build queue, a build's log, whether the build seat paused, whether the bus answers, a build it asks for.
    A lent connection's close closes nothing. Its long-lived connections are two: the one it serves on and
@@ -74,7 +75,8 @@ also keeps a record of the connections it closed, with why (`/connz?state=closed
    thousand) reaches back the whole window.
 5. **Self-check probe D15** asks that tool every run, for the last hour, and raises `bus-reconnects` (a
    warning) for each user whose connections were dropped more than twelve times in the hour, a provisional
-   bound. Its words say who keeps losing the bus and that what it says and is asked waits while it
+   bound. Connections refused before they logged in belong to no user and are left out: a login refused
+   again and again is not a reconnect loop. Its words say who keeps losing the bus and that what it says and is asked waits while it
    reconnects. It needs nothing of the operator. A bus module older than the tool is passed over.
 
 ## Consequences