Carry ADR 0309 and ADR 0319 in one paragraph of to-be 27, replacing the 0309 paragraph alone (issue 415)

03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md

@@ -5,6 +5,7 @@ code: [mesh-controller internal/catalogue]
 updated: 2026-10-12
 decisions:
   - "ADR 0312"
+  - "ADR 0319"
   - "ADR 0309"
   - "ADR 0262"
   - "ADR 0225"
@@ -232,19 +233,25 @@ gains a setting by shipping its current value as the default, and `settings` lis
 source: the default, the mesh, or the node. The first module to use it is the notifier, whose font size
 and width are preferences. *How it is checked:* the table in ADR 0262.
 
-*A setting left unset reads a value the modules share (2026-10-12, ADR 0309, changing ADR 0164 §7 and §8 and
-ADR 0262 §3, §7, §8 and §10; the build is tracked by issue 415):* every module keeps declaring each setting it
-takes, so any one module can still be set apart, and a setting may also name a mesh-wide value it shares with
-other modules, such as `desktop.font-size`; the desktop modules are the first to declare the shared names they
-read. When none of a module's own layers sets one of its settings, the setting reads the mesh-wide value of its
-shared name, and only when that is unset too the module's own default. Read from the bottom, last winning: the
-module's default, the shared value, the module's mesh-wide layer, the node's. `settings` sets and clears a
-shared value without naming a module, and still refuses a write without a module that names no declared shared
-name. Both the listing of one module and the listing of preferences across all modules name the shared name as
-a value's source, beside the default, the mesh and the node. Setting a shared value is held to the strictest
-rule among the settings that read it, so a trusted setting (ADR 0277) is never gone round through its shared
-name. Whether a shared value is a number, a colour or a string is left to the typed-settings work, issues 346
-and 410. *How it is checked:* the table in ADR 0309.
+*A value several modules share is set once (2026-10-12, ADR 0309, changing ADR 0164 §7 and §8 and ADR 0262
+§3, §7, §8 and §10, and ADR 0319, changing ADR 0164 §4 and §9 and ADR 0309 §2, §3, §5 and §6; the build is
+tracked by issue 415):* a module keeps every setting it takes, and a preference may also name a mesh-wide
+**shared name**, such as `desktop.font-size`. Unset in every layer of its own module, the preference
+reads the shared value, and only when that is unset too its default; read from the bottom, last
+winning: the default, the shared value, the module's mesh-wide layer, the node's. So a person sets
+the interface font size once and every module that names it follows, while any one module or node
+can still be set apart in its own layer. A shared value is a fourth place of change beside the three
+of ADR 0164 (a new default no longer reaches an assignment whose shared value is set), and the plan
+of a change to it names every assignment, of every module that reads it,
+whose effective value moves. It is set and cleared through the `settings` verb without a module, and
+both `settings` listings name the shared name as a value's source beside the default, the mesh and the
+node. **A shared value reaches no trusted setting** (ADR 0319): a trusted setting may not declare a
+shared name, and registration refuses one that does, so a shared value is never trusted and needs no
+warrant; a trusted setting is set in its own module's layer, on the operator's warrant (ADR 0277) or at
+the terminal, as before. A trusted setting that a stored manifest still declares with a shared name
+never reads the shared value, and both listings say why beside it. Whether a shared value is a
+number, a colour or a string waits for the typed-settings work (issues 346 and 410). *How it is
+checked:* the tables in ADR 0309 and ADR 0319.
 
 *The operator's value travels only where it is asked for (2026-09-30,
 [issue 173](../../04-ISSUES/173-a-modules-settings-reach-every-fact-it-contributes/00-report.md)):*