ADR 0254: correct what the fix covers after its review, as a progressive insight (issue 318)

02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md

@@ -137,6 +137,15 @@ anyway, since the unit that cannot run is what the gate names first.
   next machines. A unit that fails for a reason of its own is therefore said only after the login, as the
   module's own condition. A build that passed its gate is not put back by a later condition; a newer
   build or a person's push is the way.
+
+  > **Progressive insight — 2026-10-08.** This consequence described the first build of the fix
+  > (mesh-controller PR #142), and its review found it too wide. It said that while the relogin is pending
+  > every later build of the module is excused, and that the walk carries each of them on. Since
+  > mesh-controller PR #146 the wait excuses **only the build whose own send put the account into its
+  > wait**: the account resource must have said *relogin needed* since the gate began judging, with two
+  > seconds allowed for the clocks. A later build sent while the login is still owed is judged as before,
+  > and fails at the bound if the account's manager still fails. The decision stands. What changed is
+  > what it covers.
 - **A failed send keeps the passes of its healthy modules only after the settle time, in the walk path.**
   In the walk of the builds waiting for a gate, a module that was healthy for the passes asked, at least
   the settle time after the send, keeps its pass when another module of the send fails. What still
@@ -145,6 +154,18 @@ anyway, since the unit that cannot run is what the gate names first.
   where the module the gate is kept on and the modules of its tier sent with it record no pass when the
   send fails. Those are left as before: on the machine, with no verdict, so other walks still wait for
   them. A walk that fails still stops, and the next one still waits for a person's release (ADR 0236).
+
+  > **Progressive insight — 2026-10-08.** The two gaps named above were closed by mesh-controller PR
+  > #146, from the review of the fix. A module found broken now stays broken for the rest of the judging.
+  > The send's verdict waits until every other module of the send has its own, or until the gate's bound:
+  > a fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
+  > module the gate is kept on keeps its pass when it passed on its own, as the others of its tier already
+  > did. At the verdict, every module of a failed send has one: a pass if it passed on its own, otherwise it
+  > is put back with what failed. A pass is counted only the gate's spacing after the one before. The cost:
+  > a broken module is put back when the rest of its send are judged, up to the bound, not at once. Each
+  > carried build's verdict carries only its own wait. A provider waiting for a login lists the consumers
+  > held under it, and is urgent while any is. The decision stands: one verdict per send, and each module
+  > keeps its own pass.
 - **The gate's record grows three fields**: the per-module counts, the waits, and the modules that kept a
   pass. A plan written before them reads as having none.
 - **Rollout order**: the node-engine first, so that units name their account; then the controller.

03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md

@@ -168,13 +168,17 @@ account that is *relogin needed* (ADR 0252), and units of that module failing in
 that same account, read **waits for a person**: the build did what it should, and the operator has one
 step left. The reading counts as a pass and is carried in the verdict; nothing is put back for it, so the
 account group the build added stays. Anything else unhealthy of the module beside it is judged as above.
+Only the build whose own send put the account into its wait is excused; a later build sent while the login
+is still owed is judged as above.
 The node-engine names the account on every resource that runs in an account's own manager, which is how
 the controller tells such a unit from one that is broken.
 
 **Each module of a send keeps its own pass** (ADR 0254). A send is still judged as one, with one verdict.
 The gate also counts, per module, the judgings in a row that found it healthy or waiting for a person;
 when the send fails, a module whose count reached the passes asked keeps a pass, said "on its own", and is
-neither put back nor left as a move no gate has seen for every other walk to wait on.
+neither put back nor left as a move no gate has seen for every other walk to wait on. A module found broken
+holds the send's verdict until the modules beside it have their own, or the bound, so every module of a
+failed send leaves it with a verdict: its own pass, or put back.
 
 ## 6. A provider down is said once