Say in to-be 27 how a value several modules share is set once, and that it reaches no trusted setting (issue 415, ADR 0309, ADR 0319)

03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md

@@ -2,8 +2,10 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller internal/catalogue]
-updated: 2026-10-08
+updated: 2026-10-12
 decisions:
+  - "ADR 0319"
+  - "ADR 0309"
   - "ADR 0262"
   - "ADR 0225"
   - "ADR 0112"
@@ -212,6 +214,24 @@ gains a setting by shipping its current value as the default, and `settings` lis
 source: the default, the mesh, or the node. The first module to use it is the notifier, whose font size
 and width are preferences. *How it is checked:* the table in ADR 0262.
 
+*A value several modules share is set once (2026-10-12, ADR 0309 and ADR 0319,
+issue 415):* a module keeps every setting it takes, and a preference may also name a mesh-wide
+**shared name**, such as `desktop.font-size`. Unset in every layer of its own module, the preference
+reads the shared value, and only when that is unset too its default; read from the bottom, last
+winning: the default, the shared value, the module's mesh-wide layer, the node's. So a person sets
+the interface font size once and every module that names it follows, while any one module or node
+can still be set apart in its own layer. A shared value is a fourth place of change beside the three
+of ADR 0164, and the plan of a change to it names every assignment, of every module that reads it,
+whose effective value moves. It is set and cleared through the `settings` verb without a module, and
+both `settings` listings name the shared name as a value's source beside the default, the mesh and the
+node. **A shared value reaches no trusted setting** (ADR 0319): a trusted setting may not declare a
+shared name, and registration refuses one that does, so a shared value is never trusted and needs no
+warrant; a trusted setting is set in its own module's layer, on the operator's warrant (ADR 0277) or at
+the terminal, as before. Where a stored manifest still has a trusted reader, the write of that shared
+value is refused naming it, and the trusted setting never reads the value. Whether a shared value is a
+number, a colour or a string waits for the typed-settings work (issues 346 and 410). *How it is
+checked:* the tables in ADR 0309 and ADR 0319.
+
 *The operator's value travels only where it is asked for (2026-09-30,
 [issue 173](../../04-ISSUES/173-a-modules-settings-reach-every-fact-it-contributes/00-report.md)):*
 a setting overrides a key a contribution or a served fact declares and adds none; a file keeps taking