diff --git a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md
index d5a2ee0..d868c2b 100644
--- a/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md
+++ b/03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md
@@ -393,8 +393,28 @@ controller), and `hand-act record` for an act done outside the mesh —
 takes a required `--why` and writes an entry: who, which verb and arguments, why, when, the condition
 key it addresses if any, and a **cause** (the condition kind, or a word the person gives). `status`
 shows the week's count. A cause recorded twice within fourteen days raises `healer-wanted` (S15) —
-except `retire-waiting` and `cleanup-waiting`: approving a retirement and deleting what was retired are
-a person's decision by design (ADR 0230), and no healer may take them over.
+except an act recorded by a verb that is a person's decision by design, which is no repair and never
+counts, whatever cause it gives. The controller keeps one table of the verbs that write the log, and
+each says whether it records a repair or a decision, and why: approving or rejecting a retirement and
+deleting what was retired (ADR 0230); `bus upgrade`, because the bus is never rolled by the mesh, and
+`upgrade release-backlog`, because after a failed release plan the next opens only on a person's word
+(ADR 0236); and `secret rotate` when its cause is a leak (`leaked-in-logs`) — a person judges what was
+disclosed, one leak rotates several values, and a leak that recurs is a defect of the module that
+prints them, an issue against it, not a healer that rotates. A rotation for any other cause counts. A
+push by hand, `plans stop` and `close`, `broker consumer-reset`, `conditions silence` and `hand-act
+record` (an act outside the mesh, whose kind the mesh cannot tell) count; so does a verb the table does
+not list. The table's test finds every verb the controller records and fails on one it does not list.
+A `healer-wanted` already open for a decision clears on the next watchdog tick, as any condition its
+row no longer sees.
+
+> **Progressive insight — 2026-10-06.** This paragraph said before: "except `retire-waiting` and
+> `cleanup-waiting`: approving a retirement and deleting what was retired are a person's decision by
+> design (ADR 0230), and no healer may take them over." The exception was keyed on two causes, and the
+> first planned bus upgrades (two within a day, one recorded after the fact and one through `bus
+> upgrade`) raised `healer-wanted` for `bus-upgrade`, as did two rotations after one leak for
+> `leaked-in-logs`. What makes an act a decision is the verb that recorded it, not the word it gives as
+> its cause, so the exception is read from the verbs. Nothing decided changes: ADR 0230's acts stay
+> exempt, and pushes by hand — what roll-out by default (ADR 0236) exists to end — still count.
 
 ## 8. Staged core upgrades and rollback (rule 8)