Design 26: keep the seats' own events apart from their holders', since no event moves subject in this milestone

The four seats defined whole list only what their seat subject carries as the seat's; the
holders' events stay under their own subjects, checked by a fixture from the running holder.
The vault seat drops the two verbs no holder serves.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/26-the-seats.md

@@ -188,26 +188,36 @@ record of this milestone changing ADR 0613 §1-§3, to be proposed).
   operator's answer of 2026-11-04 to move them all). Every seat this milestone changes is defined whole and its
   contract moves into `mesh-contracts`: `npm-package-registry`, `go-package-registry`, `container-image-registry`,
   `oci-artifact-registry` (one common part of their shared verbs, written once, so the four cannot drift) and
-  `mesh-broker`; and the four seats it adds a verb or an event to, each with every verb and event its holder's
-  manifest on the trunk declares today, plus the new ones:
-  - `mesh-delivery-checker` (held by the checker): the verbs `try`, `try-read` and `try-end`; the events `verdict`
-    and `tag-wanted` (design 51 *Tagged versions*, its family `checker.asks`), both new. Its manifest declares no
-    event today; `preview.written` on its own stream is declared in the same change (above).
-  - `mesh-config` (held by mesh-config): the verbs `config` and, new, `renames`; the events `config-changed` and,
-    new, `renamed`, `retiring` and `retired` (design 32).
+  `mesh-broker`; and the four seats it adds a verb or an event to, each with every verb its holder's manifest on the
+  trunk declares today, plus the new ones. **No event moves subject in this milestone** (a record of this milestone
+  changing ADR 0613 §1-§3, to be proposed): a seat's own events are only those published on its seat subject today,
+  and a holder's own events stay under the holder's own subjects, listed beside the seat they belong with, never moved
+  onto it:
+  - `mesh-delivery-checker` (held by the checker): the verbs `try`, `try-read` and `try-end`; no seat event. The
+    holder's own, beside it: its family `checker.asks`, new, with `tag-wanted` (design 51 *Tagged versions*) and
+    `verdict` (*Out of step is learned from events*, below); and its stream `checks`, which already declares
+    `preview.**` and `owed.**`, only its `emits` lacking `preview.written`, which the same change adds.
+  - `mesh-config` (held by mesh-config): the verbs `config` and, new, `renames`; no seat event. The holder's own,
+    beside it: `config-changed`, and its family `config.events`, new, with `renamed`, `retiring` and `retired`
+    (design 32).
   - `mesh-vault` (held by the vault): the verbs `get`, `secret-ask`, `issued`, `rotate`, `move-in`, `node-key`,
     `own`, `issue-account`, `sign`, `enrolment-token`, `node-account`, `rotate-node`, `node-account-confirm`,
-    `abandon` and, new, `retire`; the events `provisioned`, `rotated`, `secret-changed`, `account-hashed`,
-    `own-replaced`, `account-issued`, `signed`, `rotation-begun`, `node-account-ready`, `rotation-done` and, new,
-    `own-retired` (design 32). The seat list mesh-sdk compiles today also names `accept` and `move-asks`, which
-    the vault does not serve; the definition carries what the holder serves, and the two are an open point.
+    `abandon` and, new, `retire`; no seat event. The holder's own, beside it: `provisioned`, `rotated`,
+    `secret-changed`, `account-hashed`, `own-replaced`, `account-issued`, `signed`, `rotation-begun`,
+    `node-account-ready`, `rotation-done` and, new, `own-retired` (design 32). The seat list mesh-sdk compiles
+    today also names `accept` and `move-asks`, which no holder serves and nothing calls: the same mesh-sdk change
+    drops them from the seat, and its `vault_seat_test.go` with them.
   - `operator-channel` (held by the router, the messenger module): the verbs `open`, `history`, `notify`, `tell`
-    and `asks`; the asks it accepts, `ask`, `cancel` and `condition`; the events `decided` and, new, `offered` and
-    `closed` (design 55 § 11); the holder's own `refused` beside them. mesh-sdk's seat list holds no entry for it
-    today, so its definition is written from the holder's manifest.
+    and `asks`; the asks it accepts, `ask`, `cancel` and `condition`; its seat event `decided`; `by-caller` for
+    `ask`, `cancel`, `condition` and `decided`; and `records` `asks`, as the holder's seat entry has them. The
+    holder's own, beside it: `refused`, and `offered` and `closed`, new, on its restricted stream (design 55 § 11).
+    mesh-sdk's seat list holds no entry for it today, so its definition is written from the holder's seat entry.
 
-  The builder and the indexer hold no seat: the builder's `numbered` and `old-form-closed` and the indexer's
-  `manifest-accepted` and `indexer.views` are events of those modules, declared in their own manifests, which
+  **How it is checked**: each of these definitions' conformance fixtures names every event's subject, the seat's and
+  the holder's own, and a case of the holder's whole-module test takes a fixture from the running holder (an event
+  it publishes) and matches it, subject and body, against the definition. The builder and the indexer hold no seat:
+  the builder's `numbered` and `old-form-closed`, the indexer's `manifest-accepted` and its family `indexer.views`
+  are those modules' own, declared in their own manifests, which
   ADR 0613 does not govern, and no seat definition carries them. Every other seat, the foundation's included, has its definition on the bus in the same milestone, all
   at once (ADR 0608 §2), holding the seat list's grain: its name, whether it is held once or on every node, its verbs
   with their inputs and its provision, generated from the seat list mesh-sdk compiles today, so the move changes