Phase 1.2 done, and it is the same surprise as 1.1

A session as a licence consumer needed no change either: the two
sessions are two modules, so the existing (node, module) binding already
names them apart. 14-model-access.md's "a step toward it and not it" is
true of a worker and not of a session, and the difference is that there
is one session per node rather than many per machine.

Records what stays open: the worker half of that gap is real and
unaffected, and belongs with 0003, which is unbuilt.

Two tasks in a row that were already possible. Both were written from
the design rather than from the code — the review's own finding arriving
in the plan it produced. The remaining Phase 1 items should be checked
against the code before being started rather than after.

03-DESIGN/01-to-be/14-model-access.md

@@ -83,11 +83,23 @@ per machine, which is a step toward it and is not it.
 
 *2026-08-31: this gap now has named consumers rather than hypothetical ones.*
 [ADR 0026](../../02-DECISIONS/0026-the-mesh-has-a-session-of-its-own.md) puts two sessions on the
-control-plane node — the node's own and the mesh's — each bound in its own right. **A per-machine
-binding cannot express that at all**, not merely awkwardly: the two sessions share a machine and
-must be able to hold different licences. See
+control-plane node — the node's own and the mesh's — each bound in its own right. See
 [`15-the-agent-session.md`](15-the-agent-session.md).
 
+**And for sessions the gap is already closed, which was not obvious.** A binding is per module per
+machine, and this document called that *a step toward it and not it* — reasoning that a machine
+cannot name an agent. It cannot; but the two sessions are **two modules**, because they are the
+same mechanism started in different context roots and a context root is what a module delivers.
+So `(node, module)` tells them apart, and asking for a licence per session needed no new consumer
+identity. Checked rather than argued: two sessions on one machine hold different licences, each is
+given its own key, and releasing one leaves the other.
+
+**What is still open is the rest of the gap, and it is the harder half.** A *worker* is not one
+per machine — many can run on one, from one module — so `(node, module)` cannot name them apart
+and this reasoning does not extend to them. That belongs with
+[ADR 0003](../../02-DECISIONS/0003-agents-are-persistent-employees.md), which is unbuilt, and it
+is the reason this section stays open rather than being struck out.
+
 **Switching is a reaction, not a declaration.** A licence that hits its limit and must be swapped is
 a response to something observed. Expressing it as a declaration would make the declaration mean
 *whatever is working right now*, which is not a thing anybody declared. It belongs with