ADR 0254 insight: state the two remaining costs, and point decisions 1 and 5 at their corrections

02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md

@@ -97,6 +97,10 @@ anyway, since the unit that cannot run is what the gate names first.
    the machine's own manager, a unit in another account's manager, a unit whose manager is not said, an
    account *not in the group* or not read) is judged as before, and the module is not yet healthy. A
    resource still starting is not yet healthy, as before.
+
+   > **Narrowed — 2026-10-08.** Read with the dated correction under "What the gate cannot tell" in the
+   > consequences: only a move whose build puts an account in a group its previous build did not is
+   > excused, and what that costs while a login stays owed.
 2. **The gate passes a module that waits for a person, and carries the wait.** The reading counts as a
    pass. The verdict says the wait ("… and it waits for a person: relogin needed on the laptop: …"), in the
    plan, in the gate's record and in each carried build's verdict. Nothing is put back for it, so the group
@@ -119,6 +123,10 @@ anyway, since the unit that cannot run is what the gate names first.
    own", it is not put back, and the walk's note names it. What was found wanting is put back as ADR
    0236 §3 says, and the walk stops as ADR 0236 says.
 
+   > **Completed — 2026-10-08.** Read with the dated correction under "A failed send keeps the passes" in
+   > the consequences: a module found broken is put back at once, every module of a failed send leaves it
+   > with a verdict, and what that costs.
+
 ## Consequences
 
 - **Issue 318's walk passes.** The laptop's send passes after its three judgings, the lighting module's
@@ -149,8 +157,9 @@ anyway, since the unit that cannot run is what the gate names first.
   > **The cost, accepted:** while a login stays owed, a later build of the same module adds no group,
   > so its wait is not excused. It fails at the gate's bound and is put back, and its walk holds the other
   > walks behind it as issue 318 described, until the operator logs in again. The module's
-  > `relogin-needed` condition says what to do the whole time. The decision stands. What changed is what
-  > it covers.
+  > `relogin-needed` condition says what to do the whole time. And that later build stays marked failed at
+  > its gate after the login: the login does not bring it back. A newer build, or a person's push, is the
+  > way (ADR 0236 §3). The decision stands. What changed is what it covers.
 
 - **A failed send keeps the passes of its healthy modules only after the settle time, in the walk path.**
   In the walk of the builds waiting for a gate, a module that was healthy for the passes asked, at least
@@ -165,7 +174,10 @@ anyway, since the unit that cannot run is what the gate names first.
   > #146, from the review of the fix. A module found broken is marked failed and **put back at once**, in
   > the judging that found it, so that no resend declares again a build a witness has just reverted. The
   > send goes on judging the other modules: its verdict, failed, waits until each of them has its own, or
-  > until the gate's bound. A fault before the settle time no longer strands the modules beside it. In a plan's own tier path, the
+  > until the gate's bound. A fault before the settle time no longer strands the modules beside it. **The
+  > cost:** putting a module back is a send to the machine, and the modules beside it may read not yet
+  > healthy while it applies, which starts their count of passes again. Late in the bound, that can push
+  > them past it, and they are put back with the send. In a plan's own tier path, the
   > module the gate is kept on keeps its pass when it passed on its own, as the others of its tier already
   > did. At the verdict, every module of a failed send has one: a pass if it passed on its own, otherwise it
   > is put back with what failed. A pass is counted only the gate's spacing after the one before. Each