Merge pull request 'To-be 45 §5: the operator-channel holder reads open state before it speaks (issue 271)' (#326) from fix/271-channel-reads-open-state-before-it-speaks into main

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -6,6 +6,7 @@ updated: 2026-10-12
 decisions:
   - "ADR 0325"
   - "ADR 0323"
+  - "ADR 0318"
   - "ADR 0314"
   - "ADR 0293"
   - "ADR 0289"
@@ -379,7 +380,30 @@ section; to-be 46 §13 builds what follows from it.
   (warning); on `condition-cleared`, by editing the first message where the channel can. A silenced
   condition sends nothing. Urgent goes to both channels; warning to the desktop notifier when the
   operator's session is there, otherwise to Telegram.
+  *Amended 2026-10-12, ADR 0318:* **history is never news.** On start, every ten minutes, and at once
+  when an event older than its last reading arrives, the holder reads the open conditions from the
+  controller and takes them as its state; an event is acted on only when it is newer than that reading
+  (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is
+  recorded as state and never said as its own message. While the controller cannot be read, the `at`
+  test alone decides, and the reading is asked for again until it is had. Every close, drop, fold into
+  a digest and hold under the cap is recorded in the holder's own history. A condition open in the
+  holder's state but absent from the controller's open set ended while the holder was away, and is
+  closed quietly: edited where a channel can, never sent to wake a desktop. A clearing of something
+  never said says nothing, and a message still waiting is dropped the moment its clearing is read.
+  Every urgent condition a reading finds open and unsaid is named once, together, in one digest; when
+  the grace minute ends, or at once when the reading is not a start's, each still open and
+  unacknowledged is then sent as its own message with its answers, under the cap. A grace minute
+  follows every start or reassignment: nothing is sent in it except that one digest, not even a fresh
+  urgent event.
 - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all.
+  *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first
+  item and sends it together — alone as itself, several as one digest of headlines, one line each, with
+  no answers; a message that offers answers is never folded into a digest but sent on its own, and an
+  urgent item breaks a thirty-second quiet at once, except inside the grace minute. The desktop keeps a
+  gentler rhythm than Telegram: a warning reaches it at most once every fifteen minutes; an urgent
+  message is never held to that rhythm, and still goes to both channels. Reaching the cap is said once,
+  in its own message; what it holds back, urgent included, waits until the hour allows, when each
+  message that offers answers is sent on its own with them and only the rest goes as one digest.
 - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything
   shaped like a secret is refused by the holder and raises `channel-refused` instead.
   *Amended:* the mesh's own machine names may appear too; a concrete detail travels as a reference only