Note on ADR 0240 rule 5 and ADR 0283 decision 1: what a provider waiting for the operator holds (issue 405)

02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md

@@ -184,6 +184,17 @@ that provision's provider for this consumer is unhealthy on the record, the cons
 the provider's condition — listed there as waiting on it, raised as nothing of its own — and the consumer's
 gate waits rather than fails. What a consumer finds while its provider is healthy is its own.
 
+> **Progressive insight — 2026-10-11.** A provider can now also be stated *waiting* for the operator's secret or
+> setting ([ADR 0283](0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md)),
+> which this rule did not foresee. Its consumers are held under it as under an unhealthy provider: listed at its
+> `needs-operator` condition, which stays a warning, and raised as nothing of their own. Their gate, however, does
+> not wait: a consumer held under a provider that only waits for the operator passes its gate as a wait for a
+> person ([ADR 0254](0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)),
+> the wait carried in the verdict. That is the trade-off ADR 0283 decision 4 makes for the waiting module itself,
+> since a walk that waits for the operator may wait for days. Under an unhealthy provider the consumer's gate still
+> waits, as written above. Only consumers of the part that waits are held (ADR 0283 decision 1, its note of the
+> same date). Issue 405; built in mesh-controller #216.
+
 **6. Nothing is restarted for being unhealthy.** The runtime restarts what exits, as now. A condition
 reaches a person through the operator's conversation, or a healer; a healer that restarts on health is its
 own decision.

02-DECISIONS/0283-a-part-that-waits-for-the-operators-secret-or-setting-is-said-as-waiting-passes-the-first-node-gate-and-names-the-act.md

@@ -99,6 +99,16 @@ named exactly, once. Nothing here conflicts with GENESIS.
    that reason. The type, its constructors and its reader are mesh-sdk's (`go/health`), so the module and
    the node-engine read one shape; an answer without `state` is read from `healthy` as before.
 
+   > **Progressive insight — 2026-10-11.** This decision says each wait names its `part` and that `waits` means
+   > nothing else of the module is wrong; it did not say which consumers a waiting provider holds
+   > ([ADR 0240](0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md) rule 5). The controller reads
+   > it so: **a wait covers a provision when its `part` is that provision's name, or when the secret it waits for is
+   > the provision's shared credential** ([ADR 0158](0158-a-provider-with-one-credential-shares-it-with-every-consumer.md)). A consumer whose
+   > failing check needs a covered provision is held under the provider's `needs-operator` condition; a wait that
+   > covers nothing holds no consumer, so the consumer's own fault is said, with a line that its provider waits. Today
+   > no provider names a part after a provision — the mounts module says "the source …" and provides none — so the
+   > hold is dormant until one does. Issue 405; built in mesh-controller #216.
+
 2. **The node-engine states such a resource `waiting`**, a fifth state beside healthy, unhealthy,
    starting, held and unknown (ADR 0240 §4), with its waits. One look that says it is enough, inside the
    grace too: it is a statement, not a flake that a second look might not repeat. The next look that says