ADR 0254 insight: a broken module goes back at once, and only a move that adds a group is excused, at a stated cost

02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md

@@ -141,11 +141,17 @@ anyway, since the unit that cannot run is what the gate names first.
   > **Progressive insight — 2026-10-08.** This consequence described the first build of the fix
   > (mesh-controller PR #142), and its review found it too wide. It said that while the relogin is pending
   > every later build of the module is excused, and that the walk carries each of them on. Since
-  > mesh-controller PR #146 the wait excuses **only the build whose own send put the account into its
-  > wait**: the account resource must have said *relogin needed* since the gate began judging, with two
-  > seconds allowed for the clocks. A later build sent while the login is still owed is judged as before,
-  > and fails at the bound if the account's manager still fails. The decision stands. What changed is
-  > what it covers.
+  > mesh-controller PR #146 the wait excuses **only a move that puts an account in a group its previous
+  > build did not**. The controller reads that from the two builds' manifests, which it keeps, not from
+  > when the machine says the wait began: that time lives in the node-engine's memory, and its restart, a
+  > change of its words or a clock's skew would move it.
+  >
+  > **The cost, accepted:** while a login stays owed, a later build of the same module adds no group,
+  > so its wait is not excused. It fails at the gate's bound and is put back, and its walk holds the other
+  > walks behind it as issue 318 described, until the operator logs in again. The module's
+  > `relogin-needed` condition says what to do the whole time. The decision stands. What changed is what
+  > it covers.
+
 - **A failed send keeps the passes of its healthy modules only after the settle time, in the walk path.**
   In the walk of the builds waiting for a gate, a module that was healthy for the passes asked, at least
   the settle time after the send, keeps its pass when another module of the send fails. What still
@@ -156,13 +162,13 @@ anyway, since the unit that cannot run is what the gate names first.
   them. A walk that fails still stops, and the next one still waits for a person's release (ADR 0236).
 
   > **Progressive insight — 2026-10-08.** The two gaps named above were closed by mesh-controller PR
-  > #146, from the review of the fix. A module found broken now stays broken for the rest of the judging.
-  > The send's verdict waits until every other module of the send has its own, or until the gate's bound:
-  > a fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
+  > #146, from the review of the fix. A module found broken is marked failed and **put back at once**, in
+  > the judging that found it, so that no resend declares again a build a witness has just reverted. The
+  > send goes on judging the other modules: its verdict, failed, waits until each of them has its own, or
+  > until the gate's bound. A fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
   > module the gate is kept on keeps its pass when it passed on its own, as the others of its tier already
   > did. At the verdict, every module of a failed send has one: a pass if it passed on its own, otherwise it
-  > is put back with what failed. A pass is counted only the gate's spacing after the one before. The cost:
-  > a broken module is put back when the rest of its send are judged, up to the bound, not at once. Each
+  > is put back with what failed. A pass is counted only the gate's spacing after the one before. Each
   > carried build's verdict carries only its own wait. A provider waiting for a login lists the consumers
   > held under it, and is urgent while any is. The decision stands: one verdict per send, and each module
   > keeps its own pass.