Design 38: WP3 built — node-tools beside mesh-tools, the three things the plan did not say, and the gate refuses spreading not standing

03-DESIGN/01-to-be/38-building-the-operators-machine.md

@@ -135,6 +135,14 @@ with the shortcut off answers the same.
    mechanism that keeps the old pattern from returning by habit. ADR 0188 widens it, after WP4:
    a module whose own code is an image artifact is refused, whatever image it is built on.
 
+   *Amended 2026-10-02, at WP3.* The gate refuses the pattern **spreading**, not standing: a module
+   new to the catalogue in that shape, or one that had already moved to a bundle and returns to it,
+   is refused; a module the catalogue already holds in that shape — judged from the manifest it
+   holds and what that module's newest build stood on — is rebuilt without complaint. The day the
+   runtime arrives some thirty such modules stand, each moves in its own change from WP4 on, and a
+   gate refusing every rebuild in the meantime would stop the catalogue's pipeline to make a point
+   this record already makes.
+
 **Proof.** Composition tests: a node with three assigned modules, one holding a seat, yields one
 process, three archives, one node principal whose grants are the union, and the same three
 memberships as before. The gate's test: the packet-filter manifest as it is today is refused once
@@ -155,6 +163,16 @@ runtime's `serve` keeps answering MCP on loopback; the person's end of it keeps
 wrote, `tools/list` on loopback answers as before, and the controller's verbs answer through it.
 This is the first live step, and it is reversible by re-assigning `mesh-console`.
 
+*Decided 2026-10-02:* `mesh-tools` keeps its name as the module the TypeScript images come from, and
+`node-tools` is a second module in the same repository ([ADR 0069](../../02-DECISIONS/0069-a-module-is-a-repository-and-a-path-within-it.md))
+rather than a rename — the thirty-five manifests that build `on` `mesh-tools` stay true. Three things
+WP3 found that the plan did not say: a TypeScript bundle must carry its dependencies and a
+`package.json` naming its files as ES modules, which the toolchain now copies in from its own image;
+the runtime's credential must be owned by the account the runtime runs as, which the controller
+composes; and `MESH_TOOL_MODULES` is empty on a node where the runtime is the only bundle, which the
+runtime accepts. *Built 2026-10-02* (mesh-tools `c46f950`, mesh-controller `ca7e81e` `773b561`
+`729a5f9`); the live proof follows node by node.
+
 ## WP4 — The first holder moves: the packet filter
 
 *mesh-catalog. Half a day. The live proof of ADR 0175.*