Design 29: tools, not serves; WBS 3.9 partly done

The manifest already uses serves for a provision's facts, so a module's
tools take their own key. Declaring them is itself new — until now a
module's tools existed only in a runtime environment variable.

03-DESIGN/01-to-be/28-building-the-bus.md

@@ -237,10 +237,17 @@ pays for itself furthest away.
 - [ ] 3.8 **the declaration model** of [design 29](29-what-a-module-declares.md): local names
       derived to subjects, the three namespaces, permissions computed from a declaration, and a
       manifest that contains no subject
-- [ ] 3.9 **seats declared by modules** — registration creates a seat's streams and refuses a
-      `mesh-*` name, a duplicate declarer, an undeclared `uses`, and a holder that does not
-      satisfy the protocol; assignment creates the holder's work-queue consumer and refuses a
-      second holder
+- [~] 3.9 **seats declared by modules** — the manifest now carries `seats` (name, scope,
+      accepts/emits/serves, retention) and `uses`, and registration refuses a `mesh-*` name, a
+      duplicate declarer, an undeclared `uses` or claim, a seat with no protocol, a scope
+      mismatch, and a holder that does not answer what its seat promises. **Still to do**:
+      creating a seat's streams at registration and its holder's work-queue consumer at
+      assignment, which need the JetStream client wired in.
+
+      The refusal for an unknown claim *moved* rather than disappeared — the parser cannot judge
+      it from one manifest any more, because another module may legitimately declare that seat,
+      so it is registration's. The test that encoded the old rule was rewritten rather than
+      deleted, and a second one pins the case the parser could not distinguish.
 - [ ] 3.10 **the ten seat renames**, carried as a migration with a mapping rather than an edit,
       and the beds that name seats moved with them