To-be 45 §5: match ADR 0318 version 10, so an urgent message is never folded and a backlog gets its answers (issue 271)

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -380,19 +380,22 @@ section; to-be 46 §13 builds what follows from it.
   when an event older than its last reading arrives, the holder reads the open conditions from the
   controller and takes them as its state; an event is acted on only when it is newer than that reading
   (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is
-  recorded as state and never said. A condition open in the holder's state but absent from the
+  recorded as state and never said as its own message. Ends and drops below are recorded in the
+  holder's own history. A condition open in the holder's state but absent from the
   controller's open set ended while the holder was away, and is closed quietly: edited where a channel
   can, never sent to wake a desktop. A clearing of something never said says nothing, and a message
   still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open
-  and unsaid is said once, together, naming all of them. A grace minute follows every start or
-  reassignment: nothing is sent in it except that one message.
+  and unsaid is named once, together, in one digest; when the grace minute ends, each still open and
+  unacknowledged is then sent as its own message with its answers. A grace minute follows every start or
+  reassignment: nothing is sent in it except that one digest, not even a fresh urgent event.
 - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all.
   *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first
-  item and sends it together — alone as itself, several as one digest, one line each; an urgent item
-  breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a warning
-  reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said once, in
-  its own message, and what it holds back waits for the next digest the hour allows, rather than one
-  message per excess item.
+  item and sends it together — alone as itself, several as one digest of headlines, one line each, with
+  no answers; a message that offers answers is never folded into a digest but sent on its own, and an
+  urgent item breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a
+  warning reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said
+  once, in its own message; what it holds back, urgent included, waits until the hour allows, when each
+  message that offers answers is sent on its own with them and only the rest goes as one digest.
 - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything
   shaped like a secret is refused by the holder and raises `channel-refused` instead.
   *Amended:* the mesh's own machine names may appear too; a concrete detail travels as a reference only