diff --git a/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md b/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
index 61d732b4..5a6bdbbd 100644
--- a/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
+++ b/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
@@ -237,6 +237,13 @@ met, and when. It carries no secret.
 
 - **The asker acts once per ask id**, keeping that in its own record, and only on a warrant from its own
   `decided` subject.
+- **A warrant authorises one act, as the person was shown it** (added on 2026-10-09, before the code was
+  merged). Every option above `acknowledge` carries the digest of exactly what the asker performs when it is
+  chosen — the verb, the machine and every argument (`binds`); an ask without it is refused at the router.
+  The router puts the digest of the ask as it took it in the warrant. The asker acts only when that digest
+  is the one of the ask it keeps, and only when the act it is about to perform is the one the option bound:
+  an ask published again under the same id, or a record of the act changed after the ask, is refused and
+  nothing is done.
 - **Its record of the act names the warrant**: a hand-act's `by`, `via`, `ask` and `proofs` (ADR 0234 §8),
   a delivery's transition, a silence's why. The hand-act log counts it as a person's decision, not a repair.
 - **The controller only asks and acts.** For a condition that needs the operator it asks with the
@@ -324,6 +331,17 @@ router issues no approve warrant, and the condition says what to change.
   runs as that can become root without a person, **and** a tool an agent may call that runs a command
   given to it as an account that can. It fails until both are closed; the second is decided separately
   (the login shell's reach, and what an agent's calls are granted).
+- **Since 2026-10-09 the second way is closed on the control node**:
+  [ADR 0268](0268-the-login-shells-execute-is-withheld-on-the-control-node-until-a-call-to-it-needs-a-persons-approval.md)
+  withholds `execute` there through its holder's setting. The self-check counts the login shell only where
+  `execute` is served, failing closed: served while the holder's setting for that machine is `serve`, or
+  while the bus hears the verb answered there, or while the bus cannot be asked. The first way closes with
+  ADR 0266 (hq pull request 225, not yet merged): agents on the control node run under an account of their
+  own, without sudo.
+- **What cannot be measured is not a pass** (added on 2026-10-09). A machine where a trusted party runs and
+  the self-check cannot measure who can become root — the sudo module not assigned there, or not answering —
+  raises the same urgent condition, saying it was not measured, so the router approves nothing proven
+  there until it is.
 - **The controller holds the whole JetStream API** today. Narrowing it to the streams and buckets it owns is
   planned work of its own; until then the controller is trusted with every record.
 - **On the X11 desk an agent can read a code as it is shown or typed** (ADR 0234's accepted risk). The hour
@@ -374,7 +392,13 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
 - **Harder:** an asker must keep which warrants it acted on; the shared library carries it.
 - **Harder:** the controller composes two new grant rules, and an asking module must use the seat in its
   manifest to be granted anything.
-- **The bot token moves** from the messenger's own secret to the `telegram` module's.
+- **The bot token moves** from the messenger's own secret to the `telegram` module's, given at the desk
+  (`give`, §10 step 7). **Nothing the channel or the router trusts is a setting**
+  ([issue 342](../04-ISSUES/342-a-password-is-taken-as-a-setting-and-outranks-the-vaults/00-report.md): a
+  password, token or key is not a setting). The operator's Telegram account is the router's identity list,
+  written by linking alone; no chat id is configured anywhere. The two settings these modules keep — the
+  router's time zone and the desk channel's machines — are the terminal's, as every mergeable file's are
+  since [issue 340](../04-ISSUES/340-an-agent-can-plant-a-hook-in-every-agent-session-on-the-mesh/00-report.md).
 - **Accepted risk:** a linked Telegram account, if taken, can approve (announced, reversible), never
   destroy. Linking before a TOTP factor exists carries the X11 risk in §7.
 
@@ -402,8 +426,11 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
 | While an agent can become root without a person where the router or a verified channel runs, it is said and nothing proven there approves | controller probe test (fails with agents as the operator's account, and with the login shell running as an account with passwordless sudo; passes once neither holds); the sudo module's `sudo_escalation` test; router test refusing approval |
 | A tool call never publishes an intake event or a proof | tool runner test: only a bundle's own channel reaches the seat publish, for its own kind |
 | The asker acts once per warrant and records the warrant | shared library test; controller test reading the hand-act after a warrant |
+| A warrant authorises only the act its option bound, for the ask as it was shown | shared library tests (`TestAWarrantAuthorisesOnlyTheActItsOptionBound`); controller test (`TestAWarrantPerformsOnlyTheActItsOptionBound`); router test (the warrant names the ask's digest) |
+| The self-check counts the login shell only where `execute` is served, and what it cannot measure fails | controller probe tests (`TestTheLoginShellCountsOnlyWhereExecuteIsServed`, the unmeasured case) |
+| The whole flow, before anyone uses it | the lab's proof `asks` (mesh-lab): a real bus with the controller's composed grants, the router and the Telegram channel in runtimes of their own accounts, a fake Telegram API — approve acted once, decline, expiry, a replayed tap, a tap from another account, a forged warrant, an ask under another name, an ask from a module that may not ask |
 | The controller holds no channel code | review; the controller's module imports no channel package |
-| End to end | live drill: a held delivery released from the phone; the hand-act reads "the operator, via telegram, user id verified" |
+| End to end | live drill after rollout (mesh-lab `asks/live-acceptance.md`): a harmless ask approved on the phone, acted once; the hand-act reads "the operator, as telegram identity …", via telegram, user id verified |
 
 ## References