Design 38: WP3 proven live on all four machines; the three issues it found

03-DESIGN/01-to-be/38-building-the-operators-machine.md

@@ -2,7 +2,7 @@
 layer: to-be
 status: in-progress
 code: [mesh-tools, mesh-controller, mesh-host, mesh-catalog]
-updated: 2026-10-02
+updated: 2026-10-03
 decisions:
   - 02-DECISIONS/0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md
   - 02-DECISIONS/0173-the-operators-machine-is-the-meshs-and-a-module-is-what-it-declares.md
@@ -171,7 +171,13 @@ WP3 found that the plan did not say: a TypeScript bundle must carry its dependen
 the runtime's credential must be owned by the account the runtime runs as, which the controller
 composes; and `MESH_TOOL_MODULES` is empty on a node where the runtime is the only bundle, which the
 runtime accepts. *Built 2026-10-02* (mesh-tools `c46f950`, mesh-controller `ca7e81e` `773b561`
-`729a5f9`); the live proof follows node by node.
+`729a5f9`). *Proven live 2026-10-02/03, on all four machines*: the console's container is gone,
+`node-tools` runs as a unit the host wrote, as the operator's account, `tools/list` on each loopback
+answers with the same 219 tools as before, and the controller's verbs answer through it; `mesh-console`
+retired from the catalogue. Three things the step found are issues
+[203](../../04-ISSUES/203-a-fresh-assignment-is-pushed-before-its-credential-exists/00-report.md),
+[204](../../04-ISSUES/204-a-controller-handover-re-sent-every-node-a-stale-declaration/00-report.md) and
+[205](../../04-ISSUES/205-a-package-resource-fails-against-a-stale-package-database/00-report.md).
 
 ## WP4 — The first holder moves: the packet filter