Follow the scanning record's settled shape in design 60: a file under the home folder, the certificate as health

03-DESIGN/01-to-be/60-the-brother-module.md

@@ -99,7 +99,7 @@ is the evidence.
 ## 3. Printing
 
 A caller prints in one call: `printer.print` takes a kept scan by its key, a document it has uploaded, or a file
-on the machine the tool runs on, which the verb uploads and prints in the same call (the file: ADR NNNN, proposed);
+under the operator's home folder, which the verb uploads and prints in the same call (the file: ADR NNNN, proposed);
 with the copies, the sides and the paper. The device process fetches the document from the bucket and sends it to the printer
 in a format the printer itself lists as accepted, read before the job; a document in another format is refused with
 the printer's list (ADR 0468 §5). A document larger than one bus message travels in parts, each under the bus's
@@ -166,7 +166,10 @@ Configure changes the device's pages and never the module's config (ADR 0474, pr
 
 ## 6. Health
 
-The tool side's health is whether the scanner answers; the device process's is its unit. A certificate the device
+The device process's health is its unit. The module's health, as ADR NNNN proposes, compares the certificates the
+printer serves, without a login, with the pinned one, and is unhealthy, naming the new fingerprint, when the printer
+serves one that is not pinned; a printer that does not answer is healthy with a note, and with no printer address set
+the module waits for that setting. Until that is accepted, a changed certificate shows only when a verb is refused. A certificate the device
 serves that is not pinned is refused, and the refusal names the served and the pinned fingerprint. A device serves
 a new certificate after a reset, a firmware update or a certificate's renewal, so a refusal is either that or
 another machine answering in its place; only the operator can tell which, and pins the new fingerprint as a config
@@ -175,8 +178,6 @@ missing page and expects the error.
 
 ## 7. Still open
 
-- **A certificate change said before a call fails.** Today a changed certificate shows only when a verb is refused;
-  the module should raise it as its condition, naming both fingerprints. No decision holds it yet.
 - **Files off the bus.** Documents cross the bus in parts, as proposed (ADR 0468 §3). ADR 0468 is to be revised so that a
   document travels through a signed link to the bucket instead, and only its key crosses the bus.
 - **Restart is not built yet.** `printer.restart` is decided (ADR 0467 §5) and follows `printer.configure`.