diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
index d610e3ea..5b5f6ab6 100644
--- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
+++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
@@ -535,3 +535,9 @@ written; they are cited as "design 39 bus-and-switch B*n*".
 - **B44** (§12's leases, review round 1): the carry-over carries each lease still live at its run, as a `leases` key with
   its remaining lifetime, so the new manager never refreshes a licence the old one holds a refresh lease on, whatever the
   order in which the delivery stops one and starts the other; an expired lease is counted read and not written (P3, P7).
+- **C1** (the operator, 2026-11-12: "the licence manager module should have a service part and a tools part"; met live
+  when the manager, run inside the machine's tool runner, was issued none of its own logs): the module declares
+  `runs-as claude-licence-manager` with an account of its own, as the vault and the mail reader do. Its own runtime runs
+  the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part
+  beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's.
+  The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7).