Design 39 parts: the lead's answer D3, a list of a place a secret is kept, for §15's check

03-DESIGN/01-to-be/39-milestones/parts.md

@@ -224,3 +224,17 @@ main file and the glossary. No other module changes: every verb, event and provi
   handing `licence.<key>.access` to a bound node. Both go in the milestone file before the push (P3, P7).
 - **D2** (§17's wording): the manager calls `seat:mesh-config.config` no more; the tools bundle does (§3). `invokes`
   is the module's, so the manifest is unchanged (P8).
+- **D3** (§15's check, met after the delivery: `node-reads.list` and `node-files.list` refuse the module's state
+  directory as a place a secret is kept, so no tool can say its database files are gone; prepare in the fix's map):
+  - §15 is read with `node-files.list`, not the retired `node-reads` (P7, P8).
+  - `node-files.list` of a place a secret is kept, at any depth beneath it, answers each entry's name, type, owner,
+    group, mode, size and a link's target held to the content rule, never content, and marks the place
+    `secret-place` as `stat` does; this holds for the mesh's places and a machine's credential places, and a process's
+    `/proc/<pid>/` entries stay refused (P4, P6, P7).
+  - `node-files.stat` of a path that does not exist answers that it does not exist, not that file modes refuse it, so
+    §15's "gone" can be read (P3).
+  - The seat contract's `list` text in mesh-contracts says so in the same delivery group; playbook 08's one-repository
+    rule is bent for one line of text, said in the pull request (P5).
+  - The lines the fix touches cite ADR 0394 §7, the record that refuses a secret place (P8).
+  - The fix runs under issue 1409, whose part this check is, with a note on issue 1844; its own pull requests, since
+    the part's pull request has merged (P7).