Give ADR 0344 a home in design 46: an approved settings change is sent at once (issue 641)

03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md

@@ -2,8 +2,9 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-tools, mesh-sdk, mesh-catalog]
-updated: 2026-10-12
+updated: 2026-10-13
 decisions:
+  - "ADR 0344"
   - "ADR 0332"
   - "ADR 0308"
   - "ADR 0286"
@@ -431,11 +432,29 @@ the factors are the router's state.
 | approve or reject a waiting retirement set (`retire approve` / `retire reject`) | approve |
 | confirm a kept binding moves (`pin`, while `binding-kept` names it) | approve |
 | end a stuck plan; send a machine its declaration by hand; reset a bus consumer; retry a healer | approve |
-| set or clear a trusted setting an agent proposed (`settings propose`, ADR 0277) — bound to the exact values shown; the push stays a separate act | approve |
+| set or clear a trusted setting an agent proposed (`settings propose`, ADR 0277) — bound to the exact values shown; the one Approve also sends it (ADR 0344) | approve |
 | silence a condition | acknowledge |
 | delete a retired consumer's data, one or by age (`cleanup delete`) | destroy |
 | change the operator's identities, the away channel, or a factor's enrolment | destroy |
 
+### An approved settings change takes effect (ADR 0344)
+
+*2026-10-13, issue 641.* Approving a settings proposal is the act that makes it take effect. The
+serving controller sets the layer and, in the same act, opens a **settings walk**: every machine
+that runs the module and that the layer reaches, the control node last, each sent and its module
+judged at the first-node gate before the next. The send keeps every module whose policy is `record`
+at the build its machine was last sent, so a held build stays held while the settings go out. The
+walk says its start and end like every walk, so the operator is told once when it has landed, or
+why it failed. A failure stops the walk and leaves the layer as approved; the previous layer is in
+the settings history. The ask says all this before the Approve, and no longer names a push.
+
+A delivered file is not yet an applied one: a module whose program reads its settings only when it
+starts applies them itself (a service's `restart-on`, or a tool of its own). Betterbird is such a
+module; issue 643 makes it restart Betterbird at a quiet moment.
+
+How it is checked: the controller's tests open the walk on the warrant, send one machine at a time
+judging the module, stop on a failure without holding other walks back, and read the ask's words.
+
 ### Proofs and tiers
 
 - **P1, a verified sender:** a Telegram tap from the operator's own account, through a holder placed