ADR 0278: the check as a whole takes up to a minute, kept alive by the tool runner (issue 387); one judgement at a time

Review found the two questions together exceed the consumer's ack wait, which the
tool runner did not extend; the record says so and names the fix it waits on.

02-DECISIONS/0278-the-issue-tracker-checks-every-new-issue-for-a-duplicate-through-a-judgement-the-agent-makes-without-tools.md

@@ -35,7 +35,12 @@ in 2.2 seconds. Ollama provides `model-access` on the home server only, and the
 **The bounds that shape the design.** A tool call on the bus is answered within 30 seconds or the asker hears a
 timeout (the tool runner's request bound). An event a module consumes is redelivered after 30 seconds without
 an acknowledgement, five times at most; after that the controller raises its `max-deliveries` condition and
-keeps the event in `DEAD_LETTERS` until a person delivers it again. A module that runs only its bundle declares
+keeps the event in `DEAD_LETTERS` until a person delivers it again. The tool runner gives a handler two minutes,
+but said nothing to the bus while the handler worked, so an event handled for longer than 30 seconds was offered
+again while it was handled, and events waiting in the runner's buffer ran out their 30 seconds before they were
+handed over: a burst of opens would have ended in `max-deliveries` with nothing failed. Found in this record's
+review and opened as issue 387; the tool runner now keeps an event alive while its handler works and holds one
+at a time, and this record's code is merged only after that fix. A module that runs only its bundle declares
 no health ([ADR 0240](0240-a-module-says-how-it-is-healthy-and-the-node-engine-judges-it.md) rule 8), and a
 module's health is the only way it raises a condition of its own
 ([ADR 0256](0256-a-machines-hardware-condition-is-read-by-one-module-on-every-machine-and-a-fault-is-said-through-its-health.md)).
@@ -91,10 +96,13 @@ account"): only research 042's pass and the grooming passes made by hand on 2026
 against every **older** issue that is not resolved: at `open`, `diagnosing` or `located`. A resolved or wontfix
 issue is never offered, never linked and never changed by the check.
 
-The judgement has two questions, so each answers within the bus's bound however long the backlog grows:
+The judgement has two questions, so each fits a tool call's 30 seconds however long the backlog grows; the
+check as a whole may take up to a minute, which the tool runner allows a handler (issue 387):
 
 1. **A shortlist by titles.** The new issue's title and report against every candidate's number and title; the
-   answer names at most five numbers that could be the same question or closely related.
+   answer names at most five numbers that could be the same question or closely related. The titles fill at
+   most 48 KiB of the question, newest first; when the backlog holds more, the note on the issue says how many
+   were offered of how many.
 2. **A verdict on the reports.** The new issue and each shortlisted issue whole, each report cut at 8 KiB; the
    answer is one of `duplicate` (the same question: one answer closes both), `related` (the same area or a
    cause in common, two questions) or `none`, with the issue it names, whether it is **certain**, and the reason
@@ -110,7 +118,8 @@ An empty shortlist is a verdict of `none` without the second question.
 | `duplicate` not certain, or `related` | the new issue is linked `relates-to` the older one; both gain a note saying so and why; nothing moves |
 | `none` | the new issue gains a note: checked against so many issues, none the same |
 
-The older issue is never moved, so the check never closes both sides. A verdict naming an issue that was not
+The older issue is never moved, so the check never closes both sides. The tracker asks one judgement at a
+time, and the backlog's pass (§6) waits while a new issue's check is waiting; one verdict is applied at a time. A verdict naming an issue that was not
 offered is a failed judgement (§4), never acted on. The tracker's own code for the verbs does each step, so each
 refuses what the verb refuses and says its event; the store is never written around them. Each note and link
 records its author as `duplicate-check`, the way an import records `import` (ADR 0275 §5).