ADR 0234, to-be 46: let the operator answer, and let only the controller act on an answer

Research 028 graduates: the mesh needs to ask as well as tell, over
channels that are seats rather than code inside one notifier, and an
action a person must approve cannot rest on a desk click an agent can
forge. TOTP verified by the controller is the proof; a key stays optional.
Amends to-be 45 section 5 as ADR 0227 left it to.

00-META/glossary.md

@@ -82,6 +82,17 @@ another — and a mesh you cannot name precisely is a mesh two people describe d
   capacity-1 seat is exclusive (one holder); a higher-capacity seat is a **bench** (several holders
   coexist). The first bench is `mesh-dns-resolver`, a *replicated* mesh seat: one holder per machine,
   each on record and each answering the same names ([ADR 0223](../02-DECISIONS/0223-the-mesh-has-two-resolvers-and-a-machine-lists-only-them.md)).
+  The second sort is the **kinded** bench: holders are different modules, each claiming one **kind**,
+  and a verb's subject carries the kind. `channel` and `intake` are the only ones
+  ([ADR 0234](../02-DECISIONS/0234-the-mesh-holds-a-conversation-with-its-operator.md)).
+- **channel / intake** — the two kinded benches the mesh talks to its operator through: `channel`
+  sends, `intake` turns what arrives into one envelope. A holder of either declares **capabilities**
+  from the fixed vocabulary `channel-capabilities/1`. Not "notifier" (that is the desktop's node seat,
+  one holder of kind `desktop`) and not "bot" (that is one service's account).
+- **ask** — a request for the operator's input, of a declared kind (yes-no, one-of, text, number, date,
+  acknowledge). An **authorising ask** is one whose answer performs an action; the controller holds it
+  and checks its **proofs** (a verified sender, a TOTP code, optionally a security key's touch)
+  ([ADR 0234](../02-DECISIONS/0234-the-mesh-holds-a-conversation-with-its-operator.md)).
 - **claim** — a module taking a spot on a seat. `claims: [{name, scope}]` in a manifest. A
   mesh-scoped exclusive claim is how the mesh says "there is one of me". A foundation seat is
   named after the server it guards: the `mesh-controller`, `postgres` and `lavinmq` modules claim