ADR 0254 insight: a broken module goes back at once, and only a move that adds a group is excused, at a stated cost

02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md

@@ -141,11 +141,17 @@ anyway, since the unit that cannot run is what the gate names first.
   > **Progressive insight — 2026-10-08.** This consequence described the first build of the fix
   > (mesh-controller PR #142), and its review found it too wide. It said that while the relogin is pending
   > every later build of the module is excused, and that the walk carries each of them on. Since
-  > mesh-controller PR #146 the wait excuses **only the build whose own send put the account into its
-  > wait**: the account resource must have said *relogin needed* since the gate began judging, with two
-  > seconds allowed for the clocks. A later build sent while the login is still owed is judged as before,
-  > and fails at the bound if the account's manager still fails. The decision stands. What changed is
-  > what it covers.
+  > mesh-controller PR #146 the wait excuses **only a move that puts an account in a group its previous
+  > build did not**. The controller reads that from the two builds' manifests, which it keeps, not from
+  > when the machine says the wait began: that time lives in the node-engine's memory, and its restart, a
+  > change of its words or a clock's skew would move it.
+  >
+  > **The cost, accepted:** while a login stays owed, a later build of the same module adds no group,
+  > so its wait is not excused. It fails at the gate's bound and is put back, and its walk holds the other
+  > walks behind it as issue 318 described, until the operator logs in again. The module's
+  > `relogin-needed` condition says what to do the whole time. The decision stands. What changed is what
+  > it covers.
+
 - **A failed send keeps the passes of its healthy modules only after the settle time, in the walk path.**
   In the walk of the builds waiting for a gate, a module that was healthy for the passes asked, at least
   the settle time after the send, keeps its pass when another module of the send fails. What still
@@ -156,13 +162,13 @@ anyway, since the unit that cannot run is what the gate names first.
   them. A walk that fails still stops, and the next one still waits for a person's release (ADR 0236).
 
   > **Progressive insight — 2026-10-08.** The two gaps named above were closed by mesh-controller PR
-  > #146, from the review of the fix. A module found broken now stays broken for the rest of the judging.
-  > The send's verdict waits until every other module of the send has its own, or until the gate's bound:
-  > a fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
+  > #146, from the review of the fix. A module found broken is marked failed and **put back at once**, in
+  > the judging that found it, so that no resend declares again a build a witness has just reverted. The
+  > send goes on judging the other modules: its verdict, failed, waits until each of them has its own, or
+  > until the gate's bound. A fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
   > module the gate is kept on keeps its pass when it passed on its own, as the others of its tier already
   > did. At the verdict, every module of a failed send has one: a pass if it passed on its own, otherwise it
-  > is put back with what failed. A pass is counted only the gate's spacing after the one before. The cost:
-  > a broken module is put back when the rest of its send are judged, up to the bound, not at once. Each
+  > is put back with what failed. A pass is counted only the gate's spacing after the one before. Each
   > carried build's verdict carries only its own wait. A provider waiting for a login lists the consumers
   > held under it, and is urgent while any is. The decision stands: one verdict per send, and each module
   > keeps its own pass.

03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md

@@ -168,8 +168,9 @@ account that is *relogin needed* (ADR 0252), and units of that module failing in
 that same account, read **waits for a person**: the build did what it should, and the operator has one
 step left. The reading counts as a pass and is carried in the verdict; nothing is put back for it, so the
 account group the build added stays. Anything else unhealthy of the module beside it is judged as above.
-Only the build whose own send put the account into its wait is excused; a later build sent while the login
-is still owed is judged as above.
+Only a move that puts an account in a group its previous build did not is excused, as the controller reads
+it from the two builds' manifests. A later build sent while the login is still owed is judged as above, and
+fails at the bound until the operator logs in again.
 The node-engine names the account on every resource that runs in an account's own manager, which is how
 the controller tells such a unit from one that is broken.
 
@@ -177,8 +178,8 @@ the controller tells such a unit from one that is broken.
 The gate also counts, per module, the judgings in a row that found it healthy or waiting for a person;
 when the send fails, a module whose count reached the passes asked keeps a pass, said "on its own", and is
 neither put back nor left as a move no gate has seen for every other walk to wait on. A module found broken
-holds the send's verdict until the modules beside it have their own, or the bound, so every module of a
-failed send leaves it with a verdict: its own pass, or put back.
+is marked failed and put back at once, and the send's verdict waits until the modules beside it have their
+own, or the bound, so every module of a failed send leaves it with a verdict: its own pass, or put back.
 
 ## 6. A provider down is said once