diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
index d610e3ea..7e271802 100644
--- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
+++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
@@ -535,3 +535,17 @@ written; they are cited as "design 39 bus-and-switch B*n*".
 - **B44** (§12's leases, review round 1): the carry-over carries each lease still live at its run, as a `leases` key with
   its remaining lifetime, so the new manager never refreshes a licence the old one holds a refresh lease on, whatever the
   order in which the delivery stops one and starts the other; an expired lease is counted read and not written (P3, P7).
+- **C1** (the operator, 2026-11-12: "the licence manager module should have a service part and a tools part"; met live
+  when the manager, run inside the machine's tool runner, was issued none of its own logs): the module declares
+  `runs-as claude-licence-manager` with an account of its own, as the vault and the mail reader do. Its own runtime runs
+  the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part
+  beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's.
+  The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7).
+- **C2** (review of C1: the key-pair file the manager wrote in its state directory under the tool runner's account,
+  which the node-engine does not hand to the new owner): when the manager cannot read the key pair it finds, it makes a
+  new one in its place and says so in its journal; every use passes the public key per ask, so nothing depends on the
+  old pair (P3, P7). The node-engine handing a program-written directory's contents to a new owner (every module that
+  moves to `runs-as`) is noted on its issue, not built here.
+- **C3** (met live after C1: the manager, now in its own runtime, was still issued none of its logs): the two logs
+  `usage` and `audit` are declared in the manifest's `logs` section, the form the runtime on main issues today; the
+  states stay templates. The move of logs to templates is design 47 milestone G's (P7).