ADR 0254: a wait for a person's new login passes the gate, so one module's wait stalls no walk (issue 318)

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -4,6 +4,7 @@ status: in-progress
 code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab]
 updated: 2026-10-08
 decisions:
+  - 02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md
   - 02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md
   - 02-DECISIONS/0239-a-delivery-is-owned-by-the-mesh-delivery-module-and-runs-from-commit-to-delivered.md
   - 02-DECISIONS/0238-a-commit-is-the-build-at-hand-one-commit-one-change-plan-checked-off-the-trunk-and-published-only-on-it.md
@@ -497,6 +498,11 @@ the other machines follow. "Reported applied" is not enough.
   or leaves the machine while a build no gate has seen waits there; a rebuild with the same artifacts and
   manifest is no move. What waits is moved by a **walk**, one machine at a time, the control
   node last, each judged; one that fails holds the next until `upgrade release-backlog --why`.
+- **A wait for a person passes, and each module of a send keeps its own pass**
+  ([ADR 0254](../../02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)): a module whose only fault is a new login the operator owes
+  is passed with the wait carried and said as its condition `relogin-needed`; when a send fails, a module
+  healthy on its own for the passes asked keeps a pass and is not put back. Designed in
+  [to-be 48](48-a-module-says-how-it-is-healthy.md) §5.
 - **A new controller that passes its gate sends the bus's machine the user list it composes**, when that
   changed and nothing held back would go with it.
 - **The default policy is to roll** (ADR 0236 §4); `record` stays where a module says why, keeps

03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md

@@ -2,8 +2,9 @@
 layer: to-be
 status: in-progress
 code: [mesh-host, mesh-controller, mesh-lab, mesh-catalog]
-updated: 2026-10-07
+updated: 2026-10-08
 decisions:
+  - 02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md
   - 02-DECISIONS/0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md
   - 02-DECISIONS/0241-a-machine-says-how-its-network-is-and-an-outside-writer-of-a-mesh-file-is-a-finding.md
   - 02-DECISIONS/0247-a-machine-with-a-vpn-client-routes-names-by-domain-through-a-resolver-of-its-own.md
@@ -139,6 +140,11 @@ that says no resource is unhealthy clears it. `module` joins the scopes of the c
   restarts are evidence. Held to the content rule (ADR 0234 §6), as every condition.
 - **Resolver:** `self` — it clears on observation. A healer that acts on it is a later record.
 
+**A wait for a person's new login is its own condition**, `module.<module>.<machine>.relogin-needed`, in
+place of `unhealthy` ([ADR 0254](../../02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)): a warning, the operator's, never escalated by age, raised and
+cleared as above, its summary one sentence that says to log out and in again. When the login has come and
+a unit still fails, it clears and `unhealthy` is raised.
+
 **`status`** lists it with the other conditions; **`node show`** shows each module's resources with their
 state and since when, so "is it working" has an answer without opening a terminal on the machine.
 
@@ -156,6 +162,19 @@ send and within ten minutes of it. Two of its points now read this design:
 
 At the bound, a module not healthy is put back, as ADR 0236 §3 says.
 
+**A wait for a person is not a fault** ([ADR 0254](../../02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md), issue 318). A module's
+account that is *relogin needed* (ADR 0252), and units of that module failing in the own service manager of
+that same account, read **waits for a person**: the build did what it should, and the operator has one
+step left. The reading counts as a pass and is carried in the verdict; nothing is put back for it, so the
+account group the build added stays. Anything else unhealthy of the module beside it is judged as above.
+The node-engine names the account on every resource that runs in an account's own manager, which is how
+the controller tells such a unit from one that is broken.
+
+**Each module of a send keeps its own pass** (ADR 0254). A send is still judged as one, with one verdict.
+The gate also counts, per module, the judgings in a row that found it healthy or waiting for a person;
+when the send fails, a module whose count reached the passes asked keeps a pass, said "on its own", and is
+neither put back nor left as a move no gate has seen for every other walk to wait on.
+
 ## 6. A provider down is said once
 
 A check that names, in `needs`, the provision it exercises is tied to that provision's provider for this