The operator's agent is a module: three records and to-be 36 for the claude-code successor

The predecessor's agent module was retired and its six files stayed on both workstations telling
every session to use tools that no longer exist. Before a successor module is written, the design
needs the decisions it rests on and nothing in the record stated them:

- ADR 0169 (reconstructed) records what the controller shipped on 2026-09-27 without a record: the
  operator account is a node fact stated by the operator, the home is derived unless stated, a
  resource may be placed under it owned by the account, and a node with no account refuses one.
- ADR 0170 generalises to-be 29 §3's found-vs-owned boundary to every directory under a home: the
  module owns the directory and the files it places, writes into the tool's own files for its few
  keys, never declares a credential's content, and holds everything else as found — a predecessor's
  leftovers included, which the operator removes once.
- ADR 0171 draws the licence line the operator asked to have drawn rather than assumed: the mesh
  binds and delivers (to-be 14 and 15 stand), the module alone writes the credential file, refresh
  stays central (ADR 0050), a switch is the binding changed through a controller seat verb asked
  for via the console, and the token-carrying shell helper is retired. The controller learns
  nothing about the agent; that is what "no part" means.

To-be 36 is the module's design: the ownership map per path, the fate of the six predecessor
files, what the three instruction documents say, the licence tools and skill, the console as a
node-scoped provision, the package gap stated honestly, and the order of the build. To-be 14, 29
and 34 carry dated notes; the glossary gains "operator account".

00-META/glossary.md

@@ -9,6 +9,11 @@ another — and a mesh you cannot name precisely is a mesh two people describe d
 
 - **node** — a machine in the mesh. There are 0..n of them, and each runs the host agent. A node is
   just a machine that has joined; being one implies nothing about what it runs.
+- **operator account** — the login name of the person who works on a node, stated on the node
+  record; empty for a machine nobody logs into. Everything the mesh places under a person's home is
+  resolved against this account's home and owned by it
+  ([ADR 0176](../02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)).
+  Not "the user" (ambiguous with a module's own account) and not a name a definition carries.
 - **control-node** — the one node that also holds the `mesh-controller` seat. There is exactly one
   per mesh. "control-node" is not a separate kind of machine — it is a node that additionally runs
   the controller (and, today, the foundation). Lose it and the other nodes keep running what they

01-RESEARCH/018-the-operators-machine-as-modules/00-overview.md

@@ -0,0 +1,80 @@
+---
+status: active
+initiated: 2026-10-02
+touches:
+  - 02-DECISIONS/0040-what-a-module-is.md
+  - 02-DECISIONS/0011-managed-files-are-generated-never-edited.md
+  - 02-DECISIONS/0132-a-seat-carries-the-tools-its-holder-must-serve.md
+  - 02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md
+  - 02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md
+  - 02-DECISIONS/0161-what-deserves-a-seat.md
+  - 03-DESIGN/01-to-be/05-the-node-host.md
+  - 03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md
+  - 03-DESIGN/01-to-be/33-the-tools-the-mesh-answers.md
+  - 03-DESIGN/01-to-be/34-the-console.md
+  - 03-DESIGN/00-as-is/10-module-catalogue.md
+  - 04-ISSUES/160-a-machine-says-little-about-itself-and-only-when-asked/00-report.md
+  - 04-ISSUES/168-a-setting-reaches-every-file-and-contribution/00-report.md
+became: []
+---
+
+# 018 — The operator's machine as modules
+
+**What.** The mesh owns the whole machine, not only the services on it. Everything a person
+configures on a node — the login manager, the display server, the window manager, the shell, the
+terminal, the launcher, the notifier, the audio setup, the boot images, the downloads folder, the
+agent at the terminal — is a module: a package, the files it owns under `/etc` and under the
+operator's home, the seat it holds, the tools it serves. One default configuration per module,
+varied per node only through settings rendered into the file or a kept operator region, never
+through an edit. The servers take the universal modules (shell, prompt, git, the agent); the
+workstations take those and the graphical stack, which a capability the machine reports gates.
+This effort writes that behaviour down, measures what the predecessor's desktop modules actually
+contain, and settles what the mesh must gain before the first of them can be written.
+
+**Why.** The predecessor is retired on every node. What it still owned on the two workstations —
+about thirty modules' worth of dotfiles, user units and `/etc` files — is now owned by nothing:
+no generator regenerates them, and a fix to one of them is a hand edit that nothing records. The
+migration scoped these modules out as *the workstation's own environment*, and
+[to-be 29](../../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) names them as the last
+thing the predecessor was keeping alive. To-be 29 covers one directory, `~/.ssh`, and draws a
+boundary inside it. The operator wants no boundary: the machine is the mesh's, as far as it makes
+sense to configure it. That is a wider scope than any design states, and it reaches three records
+that were written for services: what a module is, where a module's tools run, and what a managed
+file may be.
+
+**What it touches.** The module definition ([ADR 0040](../../02-DECISIONS/0040-what-a-module-is.md)),
+seats and their contracts ([ADR 0132](../../02-DECISIONS/0132-a-seat-carries-the-tools-its-holder-must-serve.md)),
+where a module's tools run ([ADR 0150](../../02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md),
+[ADR 0152](../../02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md),
+[to-be 33](../../03-DESIGN/01-to-be/33-the-tools-the-mesh-answers.md) §6), the host's vocabulary
+([to-be 05](../../03-DESIGN/01-to-be/05-the-node-host.md)), managed files and settings
+([ADR 0011](../../02-DECISIONS/0011-managed-files-are-generated-never-edited.md),
+[issue 168](../../04-ISSUES/168-a-setting-reaches-every-file-and-contribution/00-report.md)),
+and the catalogue's shape ([as-is 10](../../03-DESIGN/00-as-is/10-module-catalogue.md)).
+
+**Documents.**
+
+- [01 — The intended behaviour](01-the-intended-behaviour.md): the operator's wish, written as
+  how the mesh behaves, in the mesh's own words.
+- [02 — What exists, and what is missing](02-what-exists-and-what-is-missing.md): the
+  predecessor's desktop modules measured; which records already say what is wanted; the gaps.
+- [03 — One tool executor per node](03-one-tool-executor-per-node.md): where a module's tools
+  run. The direction the operator set, the evidence for it, and what it supersedes.
+- [04 — The seats of the environment](04-the-seats-of-the-environment.md): the roles a machine
+  has once, their candidate contracts, and what gates each.
+
+**What this must settle before it graduates.**
+
+1. A module is one *managed thing*, software or not, and every module may serve tools — or ADR
+   0040 already says this and only its examples are narrow.
+2. One tool executor per node, host-side, module-agnostic; which records it supersedes and
+   in what form the console continues.
+3. Per-node variation is a setting rendered into the file or a kept region, never an edit —
+   ADR 0011 stands — and issue 168 is fixed before any environment module carries a setting.
+4. User-scoped units on the host's `service` shape, and a service-manager seat whose holder
+   serves the tools about them.
+5. The operator account stated on every node; today no node record carries one.
+6. The seats of the environment and their verbs, one record per seat, slowly, because a
+   seat's tools bind every future holder.
+7. Where the environment modules live: this catalogue, or one of their own as the media chain
+   has; and whether a third-party organisation's tooling belongs in a public catalogue at all.

01-RESEARCH/018-the-operators-machine-as-modules/01-the-intended-behaviour.md

@@ -0,0 +1,99 @@
+# 01 — The intended behaviour
+
+*Written 2026-10-02 from the operator's words, in the mesh's words. What is wanted, before what
+exists. Where a sentence restates a record, the record is named; where it goes further, that is
+said.*
+
+## The machine is the mesh's
+
+**Everything configurable on a node is declared by a module.** Not only the services the mesh
+runs: the login manager, the display server, the window manager, the bar, the launcher, the
+notifier, the compositor, the lock screen, the terminal emulator, the clipboard, the shell and its
+prompt, the editor, the audio setup, the boot images, the package manager's configuration, the
+agent a person runs at a terminal, and the folders a person works in — a downloads folder that is
+tidied, backed up, distributed to other nodes and asked questions of. System folders and the
+operator's home alike. The operator is the only person on every node, so the mesh manages the
+person's machine, not a machine with a person on it.
+
+This is [ADR 0040](../../02-DECISIONS/0040-what-a-module-is.md)'s definition applied without
+the service bias its examples carry. A module is one managed thing, named once, described
+completely by its manifest. It may have a package, files, a container, a unit, a binary, a seat it
+holds, and tools it serves — any one of these, or all, or two. There is **no kind of module**: zsh
+has a package, files, a seat claim and the tools that claim obliges it to serve; downloads has a
+folder, a process and tools; nftables has a package, files, a service, a seat and tools. The
+difference is what each declares, not what each is.
+
+**The home has no boundary.** [To-be 29](../../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md)
+owns one directory under the home and draws a line inside it between the mesh's and the person's.
+Here the line is drawn only by what the modules declare: every file some module places is the
+mesh's; what no module declares is found and left alone, exactly as the adoption rules already
+say for a machine. The reach is bounded by sense, not by a rule — the mesh configures what can
+be configured, and a person's documents, projects and history are data under
+[ADR 0051](../../02-DECISIONS/0051-shared-data-is-the-operators.md), not configuration.
+
+**A module names no node and no path.** The operator account is a node fact and the home is
+derived from it ([to-be 29](../../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) §1–2,
+shipped in the controller; its record is proposed in an open change). A module places a file
+*under the home, owned by the account*, and the same manifest lands on a server and a laptop.
+
+## One default, varied by settings, never by edits
+
+**One module, one default configuration.** The window manager module ships the configuration
+that is right for every node. There are no flavors: the predecessor's one desktop module carried
+four, one per class of machine, and what differed between them is what settings are for.
+
+**A node varies a module in exactly two ways.** A **setting**, declared by the module with its
+type, meaning and default (proposed alongside the container-runtime records), set for the mesh
+or for one node, and rendered into the file at composition — the value is in the file, not in an
+environment variable the file reads. Or a **kept region**: a block in a file the mesh writes
+*into*, where the operator's own lines survive every push
+([ADR 0102](../../02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md)). An
+edit to a managed file outside such a region is not a third way; it is overwritten, as
+[ADR 0011](../../02-DECISIONS/0011-managed-files-are-generated-never-edited.md) says, and the
+predecessor's habit of adopting disk drift back into its database is not carried over.
+
+The predecessor's theming — some ninety environment variables substituted into templates at sync
+time, with tools to list and set them — is the same idea with the wrong rendering. The knobs
+become declared settings; the file carries the value.
+
+## Roles a machine has once are seats, and seats carry tools
+
+**A role a machine fills at most once is a node-scoped seat**, declared by a module
+([ADR 0121](../../02-DECISIONS/0121-a-system-seat-is-named-for-its-scope-and-modules-define-their-own.md),
+[ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md)): the login shell, the
+display session, the display server, the terminal emulator, the launcher, the notifier, the
+compositor, the lock screen, the service manager, the boot loader. Several modules may be able to
+hold one — zsh, fish and bash can all hold the login shell — and the assignment on each node says
+which does. Installing a shell is installing software; holding the seat is being *the* shell.
+
+**A seat's contract is its tools** ([ADR 0132](../../02-DECISIONS/0132-a-seat-carries-the-tools-its-holder-must-serve.md)).
+Every holder of the login-shell seat serves `execute`, which takes one string, the command, and
+runs it on the node the seat is scoped to. Every holder of the boot seat serves "rebuild the boot
+images", so *"rebuild your boot images"* is a verb addressed to a machine, not a one-off step in
+a hook. Every holder of the service-manager seat answers for the units on the machine, system and
+user scope. A module may serve its own tools beside the seat's
+([ADR 0170](../../02-DECISIONS/0170-the-firewall-seat-serves-its-verbs.md) §2): show the rendered
+configuration, set a theme value, report status.
+
+**Any tool may be called from any node.** The operator's statement, and the grant model it
+implies: the executor on each node may call everything, as the console already may. A verb that
+needs root on the machine is the module's concern — the tool escalates, the executor and the
+caller do not know.
+
+## Servers and workstations differ by capability, not by catalogue
+
+The same catalogue serves every node. A module declares what it needs — a graphical session, a
+display server, a container runtime — and the machine reports what it has, as the profile already
+reports eight capabilities today ([issue 160](../../04-ISSUES/160-a-machine-says-little-about-itself-and-only-when-asked/00-report.md)).
+Assignment refuses the wrong placement by name
+([ADR 0161](../../02-DECISIONS/0161-what-deserves-a-seat.md) §3). So every node takes the shell,
+the prompt, git and the agent; only a node with a graphical session can take the display server,
+and only a node holding the display server can take a window manager. Nothing in a module says
+"workstation".
+
+## What the operator would say to the mesh
+
+*Set the login shell on the build node to fish. Rebuild the laptop's boot images. Show me the
+window manager's effective configuration on the desktop and where each value comes from. Give
+the downloads folder on the laptop to the home server. Run `uptime` on every node.* Each of these
+is a seat verb or a module tool, addressed to a node, answered by whatever holds the role there.

01-RESEARCH/018-the-operators-machine-as-modules/02-what-exists-and-what-is-missing.md

@@ -0,0 +1,91 @@
+# 02 — What exists, and what is missing
+
+*Measured 2026-10-02 on one installation: two workstations, two servers, all four converged to
+the mesh; the predecessor retired on the last workstation the day before. Numbers are from the
+machines and the repositories, not from memory.*
+
+## 1. What the predecessor's desktop looks like
+
+The predecessor's catalogue on the laptop held **34 modules**, of which **28** are the operator's
+environment rather than services. By what they declare:
+
+| shape | count | examples |
+|---|---|---|
+| package only | 9 | browser, mail client, process monitor, media player, file manager, chat |
+| package + `/etc` files + system service | 5 | login manager, display server, power and thermal daemons, package manager configuration |
+| package + files under the home | 6 | shell and prompt, the agent at the terminal, scripts, the sync client, a music player |
+| files under the home + user units + hooks | 2 | the desktop environment, audio |
+| third-party organisation tooling | 6 | out of scope here |
+
+**The desktop module alone** declares **88 files**, **4 flavors** (the window-manager stack, and
+one per class of machine), **2 user units** with a hook to enable them, 8 files under `/etc`, a
+wallpaper shipped as an asset, and reads **about 90 environment variables** as theme knobs,
+substituted into its templates at sync time and set through a theming tool. Its hook exists
+because *shipping a unit file does not run it*: one unit had been deployed for months and ran on
+one machine only, because somebody had enabled it there by hand.
+
+**The shell module** ships `~/.zshrc`, the prompt configuration, an `~/.ssh/config` that the
+predecessor generated from its registry, and a `LOGIN_SHELL` variable applied with `chsh` by a
+hook. Two flavors: the prompt theme, and autocompletion.
+
+**Other modules write into the desktop module's files.** The chat client places i3 and notifier
+snippets into `config.d` directories the desktop module owns, and its launch flags, window
+placement and notification colours are each a variable with a default.
+
+**One-off steps live in hooks** across the set: enable user units, `chsh`, create a swap file,
+`mkinitcpio`, enable a vendor VPN service the package ships disabled. Every one is state the
+host could declare or a verb a seat could serve; none is today.
+
+## 2. What the migration did with them
+
+The migration's module to-do scoped the whole set out as *desktop / workstation ricing — the
+workstation's own environment* and *node/OS tooling — managed on the node, never catalogue*. The
+last workstation's runbook then split the same set three ways: **A**, system scope, which the
+host's vocabulary can express today (the login manager, the display server, the power daemons,
+the package manager, the container runtime); **B**, under a home or a user unit, waiting on
+to-be 29; **C**, package only, the operator's call. The migration log closes the workstation with
+*the operator's desktop awaiting its design*.
+
+Two things followed from scoping them out. Nothing regenerates those files now, so a fix is a hand
+edit — the login manager's session script was fixed this way on the day of writing, and recorded
+in a repository nothing deploys from. And the one piece of this family written as a mesh module,
+the ssh client, was closed on hold in the catalogue until the controller carried the account fact.
+
+## 3. What the records already give
+
+| wanted | record | state |
+|---|---|---|
+| one module per managed thing; every module may have tools | [ADR 0040](../../02-DECISIONS/0040-what-a-module-is.md) | accepted; examples are services, and the shell is named as a *shared* seat |
+| a module declares its own node-scoped seat | [ADR 0121](../../02-DECISIONS/0121-a-system-seat-is-named-for-its-scope-and-modules-define-their-own.md), [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md) | accepted |
+| a seat's contract is its tools; a holder may add its own | [ADR 0132](../../02-DECISIONS/0132-a-seat-carries-the-tools-its-holder-must-serve.md), [ADR 0170](../../02-DECISIONS/0170-the-firewall-seat-serves-its-verbs.md) | accepted; one node seat serves verbs live |
+| a capability the machine reports gates a holder | [ADR 0161](../../02-DECISIONS/0161-what-deserves-a-seat.md) §3 | accepted; the profile already reports `graphical-session` |
+| the account as a node fact; a file under the home owned by it | [to-be 29](../../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) §1–2 | built in the controller; its record proposed in an open change |
+| inside a home: owned, written into, written by the module, found | proposed in the same change | proposed |
+| a setting declared with type, meaning, default and cost | proposed with the container-runtime records | proposed |
+| a managed file is derived; an edit is overwritten | [ADR 0011](../../02-DECISIONS/0011-managed-files-are-generated-never-edited.md) | accepted |
+| the mesh writes into a shared file, never over it | [ADR 0102](../../02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md) | accepted |
+| a module names no path; the host resolves the home | [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md) | accepted |
+| the `user` shape: a login shell is declared state | [to-be 05](../../03-DESIGN/01-to-be/05-the-node-host.md) | designed; used by no module |
+
+## 4. What is missing
+
+1. **The account is recorded nowhere.** The node record has the column; on all four nodes it
+   is empty. Every home-scoped module is unassignable until the operator states it.
+2. **User-scoped units.** The host's `service` shape has no user scope. To-be 29 says it
+   plainly: *a workstation's per-user daemons have no form the mesh can send.* The desktop
+   module's two units, the audio masks, the power module's memory guard and the thermal
+   daemon's profile switcher all need it.
+3. **One-off steps.** `mkinitcpio`, `chsh`, creating a swap file. Each is either declared
+   state the host lacks a shape for, or a verb a seat should serve. An action in a declaration
+   is refused over the link, and rightly.
+4. **Settings leak** ([issue 168](../../04-ISSUES/168-a-setting-reaches-every-file-and-contribution/00-report.md)):
+   a setting reaches every mergeable file and every contribution of its module. Ninety theme
+   knobs on that mechanism would reach ninety files. The proposed settings record says a setting
+   names the file it lands in; that has to ship first.
+5. **Where tools run.** Every module that serves a tool today does so from its own container
+   per node. See [03](03-one-tool-executor-per-node.md).
+6. **A seat's verbs are undecided for every seat but three.** To-be 33 leaves which verbs each
+   seat serves as *a decision per seat, slowly*. The environment adds a dozen seats.
+7. **Catalogue placement.** The media chain left this catalogue for its own; whether the
+   environment does the same, and whether a third-party organisation's tooling belongs in a
+   public catalogue, are unasked.

01-RESEARCH/018-the-operators-machine-as-modules/03-one-tool-executor-per-node.md

@@ -0,0 +1,88 @@
+# 03 — One tool executor per node
+
+*The direction the operator set on 2026-10-02, the evidence it rests on, and what it supersedes.
+A direction, not yet a decision: the record is written when this effort graduates.*
+
+## Where tools are served today
+
+[To-be 33](../../03-DESIGN/01-to-be/33-the-tools-the-mesh-answers.md) names three families — a
+role's tools on the seat, a module's own tools on the module, the mesh's own verbs on the
+controller seat — and [ADR 0160](../../02-DECISIONS/0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md)
+says a runtime serves the subjects its membership issues. What *runs* that runtime is
+[ADR 0150](../../02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md):
+one supervised process per module, under the module's own account, carrying that module's
+compiled tools. Measured on the live mesh:
+
+| who answers | how it runs | count |
+|---|---|---|
+| the mesh's own verbs | the controller binary, on its node | 17 verbs |
+| the store seat | the store's own runtime | 2 verbs |
+| the packet-filter seat | **a container per node**, built on the tool-runtime base image, with the network namespace and `NET_ADMIN`, on all four nodes | 3 verbs and 1 own tool |
+| every module's own tools | the module's container, one per node it runs on | 67 tools across the catalogue |
+| the console | a container per node, loopback MCP, `invokes: *` | serves none, calls all |
+| the host | — | serves nothing; answers no question about the machine |
+
+**The packet-filter holder is the case to look at.** The module is a package, three files and a
+system service. To serve three verbs it also declares a built image and a container on every
+node whose only job is to answer them. Scaled to the environment — a shell, a prompt, a launcher,
+a notifier, a compositor, a login manager, a service manager, a boot loader, a downloads folder —
+that is one container per module per node for software that is itself not a container, and the
+operator's judgement is that tools should not run inside a container at all.
+
+## The direction
+
+**One tool executor per node, on the host side.** A process the host supervises, the way the
+launcher supervises the host ([ADR 0005](../../02-DECISIONS/0005-the-node-host.md)): not a
+container, one bus credential for the node, module-agnostic. It loads the tool code of every
+module assigned to the node and serves each module's tools and each held seat's verbs on the
+subjects the membership issues — nothing changes in what [ADR 0159](../../02-DECISIONS/0159-a-tool-call-names-the-machine-and-a-holder-serves-its-seats-verbs.md)
+and [ADR 0160](../../02-DECISIONS/0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md)
+say about subjects, grants and memberships; what changes is that one process subscribes for the
+node instead of one per module.
+
+- **A module brings its tools as a built artifact**, a bundle the pipeline produces, never an
+  image. The executor knows bundles and subjects; it knows nothing of zsh or nftables.
+- **A tool is code the module wrote**, one function behind an MCP verb. `execute` on the shell
+  seat is a function with a string argument. The executor does not declare, template or
+  interpret tools; it runs them.
+- **Root is the module's concern.** A tool that must change the packet filter or rebuild boot
+  images escalates itself. The executor does not run as root for everyone, and the caller does
+  not know.
+- **Any node may call any tool on any node.** The executor's credential may call everything,
+  as the console's already does; per-module grants on the calling side are not kept.
+- **The mesh's own verbs stay with the controller** ([ADR 0154](../../02-DECISIONS/0154-the-meshs-own-verbs-are-the-controller-seats-tools.md)),
+  and a mesh-scoped seat's verbs run on the node that holds it
+  ([ADR 0121](../../02-DECISIONS/0121-a-system-seat-is-named-for-its-scope-and-modules-define-their-own.md)).
+  No hub is added; the controller's node is already one.
+
+**The console is the executor, renamed.** It already runs on every node with a credential that
+may call everything, and it already serves the mesh's tools to whoever is on the machine over
+MCP on loopback ([ADR 0152](../../02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md)).
+It moves out of its container into the host's process tree, gains the serving half, and takes a
+name that says what it is — *the node's tool runtime* or simply *node tools*; "console" names
+the operator's half only.
+
+## What it supersedes, and what it keeps
+
+| record | effect |
+|---|---|
+| [ADR 0047](../../02-DECISIONS/0047-a-module-runs-its-code-as-its-own-process-with-its-own-account.md), [ADR 0150](../../02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md) | superseded *for tools*: one process per node runs every module's tool code, under one account. A module's long-running service — a daemon, a container — is untouched; the executor runs tools, not services. The record must say why one account for every module's tools is acceptable: every tool may be called from every node anyway, and root is taken by the tool, not granted to the process |
+| [ADR 0152](../../02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md) | kept in substance — a module, assigned per node, loopback MCP, the machine's login is the authority — changed in form: host-side, not a container; serves as well as calls; renamed |
+| [to-be 33](../../03-DESIGN/01-to-be/33-the-tools-the-mesh-answers.md) §6, [to-be 34](../../03-DESIGN/01-to-be/34-the-console.md) | amended the same way |
+| [ADR 0170](../../02-DECISIONS/0170-the-firewall-seat-serves-its-verbs.md) §3, *a container may ask for a capability* | moot for that holder: the verbs run on the host side and escalate as they need |
+| the container-runtime seat, proposed in an open change: *the holder runs as a supervised process and serves the verbs locally to the host and on the bus* | consistent — a supervised process serving verbs is what the executor is; the open question is whether that holder keeps its own process or serves through the executor like everyone else |
+| the tool-runtime base image | no longer the way tools reach a node; may remain the way a module's *service* is built |
+
+## What stays open
+
+- **The executor's language.** The host is a static Go binary and loads no plugins, so the
+  executor is a sibling process, and its language decides the language of every tool bundle.
+  One decision, taken once.
+- **How a bundle reaches the node.** An artifact of the module's build, delivered as the host
+  delivers everything else; whether it is a file resource in the declaration or a thing the
+  executor fetches by digest.
+- **Reload.** A push that adds or upgrades a module's bundle reaches a running executor as a
+  reload, not a restart, or every tool on the node blinks on every push.
+- **The host's own questions.** [Issue 160](../../04-ISSUES/160-a-machine-says-little-about-itself-and-only-when-asked/00-report.md)
+  wants a machine to say more about itself. With an executor on every node, "what is this
+  machine made of" is a seat verb like any other, served there.

01-RESEARCH/018-the-operators-machine-as-modules/04-the-seats-of-the-environment.md

@@ -0,0 +1,65 @@
+# 04 — The seats of the environment
+
+*Candidates, not decisions. To-be 33 says which verbs a seat serves is a decision per seat,
+taken slowly, because a seat's tools bind every future holder. This document lists the roles the
+operator's machine has once, who could hold each, what gates it, and a first verb or two — so
+each record has a starting point.*
+
+## The rule for what is a seat here
+
+A role the machine fills **at most once** is a node-scoped seat, declared by the module family
+that fills it ([ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md)). A thing
+several of which coexist without contention — editors, browsers, media players — is not a seat;
+each is a module with its own tools, and nothing is singular about it. A seat is held by one
+assignment per node; other modules of the same family may be installed beside it without
+holding it ([ADR 0040](../../02-DECISIONS/0040-what-a-module-is.md) §1, read with the sharper
+distinction: *installed* is not *holding*).
+
+## Candidate seats
+
+| seat | holders | gated by | first verbs |
+|---|---|---|---|
+| **login shell** | zsh, fish, bash | nothing: universal | `execute(command)`; `show-config`; the holding itself sets the account's login shell through the host's `user` shape |
+| **service manager** | systemd | the `service-manager` capability the profile reports | units: list, status, start, stop, restart, enable, journal; **user scope** on each |
+| **boot** | grub, systemd-boot | a machine that boots itself (not a container host) | `rebuild-images`; `entries` |
+| **package manager** | pacman, apt | the `package-manager` capability | search, installed, upgrade, orphans; today a capability the host uses, not a seat anyone holds |
+| **display server** | xorg, wayland compositors that are their own server | the `graphical-session` capability | `displays`; `layout` |
+| **display session** | i3, sway | the display server seat held on the node; i3 needs x11, sway needs wayland | `reload`; `workspaces`; `windows`; `move` |
+| **terminal emulator** | xterm, alacritty, foot | display session | `open`; `font` |
+| **launcher** | rofi, dmenu | display session | `show`; `theme` |
+| **notifier** | dunst, mako | display session | `send`; `history`; `rule` |
+| **compositor** | picom | display server (x11 only) | `restart`; `effects` |
+| **lock screen** | i3lock, swaylock | display session | `lock` |
+| **bar** | i3status-rust, waybar | display session | `reload`; `blocks` |
+| **login manager** | lemurs, greetd | graphical session | `sessions`; `default-session` |
+| **audio** | pipewire, pulseaudio | the machine reports a sound device | `sinks`, `sources`, `default`, `volume`, `mute` |
+| **clipboard** | greenclip, cliphist | display session | `history`; `clear` |
+
+Not seats, modules with their own tools: the editor, the browser, the mail client, the file
+manager, the media player, the chat client, the agent at the terminal, the downloads folder, the
+scripts folder, the sync client, the power and thermal daemons that are specific to one machine's
+hardware.
+
+## What the table implies
+
+**Capabilities come first.** `graphical-session`, `service-manager` and `package-manager` are
+reported today. *A display server is held* is not a capability but a seat being held, and a
+module that needs it declares a dependency on the seat, not on a capability: *i3 needs the
+display server seat held by xorg*. Whether a held seat can gate another's assignment is a
+question for the controller's resolver, and the first environment module after the shell will
+ask it.
+
+**The service manager comes early.** Four of the predecessor's modules ship user units, and the
+executor itself is a unit. User scope on the host's `service` shape is a host change whichever
+module holds the seat; the seat's holder answers the questions about units, it does not apply
+them — the host does, as it does for every declared resource.
+
+**The shell comes first.** Universal, no capability, one verb that is immediately useful on
+every node, and the `user` shape already makes the login shell declared state. It is the module
+that proves the pattern: a package, files under the home owned by the account, a seat claim,
+tools served by the executor, settings for the few things that vary per node, and a kept region
+for the operator's own lines.
+
+**The login manager is the first system-scope one**, because it needs nothing new: a package,
+two files under `/etc`, a service — the same shape the ssh daemon module has today — and the
+session script it owns is the file that was hand-fixed the day this effort opened.

02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md

@@ -113,6 +113,22 @@ That is a difference a take shows, not a fault, and is decided when it bites.
 | `node show` lists filters with owners; `status` names a converged machine something else filters and is not well; the preview lists filters and fates | controller tests over a fixture report |
 | Live | the home server's record names the predecessor's chain in the runtime's user chain as *other*; `status` names the machine; after the operator removes the chain, the next report drops it and `status` is well |
 
+## Built and proven live, 2026-10-02
+
+> **Progressive insight — 2026-10-02.** The decision stands; these are the facts of its building.
+
+Built in mesh-host 67 (every refusing table and legacy chain classified with an owner, reported with
+every apply; the found firewall retired on every converged apply, *found inactive* kept apart from
+*disabled by the mesh*, a skipped step said) and mesh-controller 211 (kept per node, shown on `node
+show`, named by `status` and not well, previewed with fates). The live row was read at 10:10Z: the home
+server's record named the predecessor's chain in the legacy filter's user chain as *other*, beside two
+chains a retired front end left in the IPv6 legacy filter; the control node's record named the same two
+leftovers; the laptop and the workstation read *the mesh alone*; `status` named both machines. The five
+rule sets were removed at 12:46Z through the packet filter seat's `remove` verb
+([ADR 0170](0170-the-firewall-seat-serves-its-verbs.md)), and the next report read *the mesh alone* on
+all four machines. The control node's record still says the mesh retired its front end, which issue 143
+records as a hand's work: the host trusts its record, and from this build on the distinction is kept.
+
 ## References
 
 - [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0103](0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md), [ADR 0140](0140-the-filter-constrains-what-arrives-from-outside.md), [ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md), [ADR 0163](0163-taking-a-module-over-is-a-comparison.md)

02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md

@@ -0,0 +1,66 @@
+---
+topic: the mesh
+status: accepted
+date: 2026-10-02
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
+---
+
+# 175. The found front end is uninstalled once a machine is converged
+
+## Context
+
+[ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md) retires the firewall a machine
+was found with by disabling it, never flushing it, and keeps its configuration on disk so that
+returning the node to adopted can enable it again. [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)
+made the host keep it retired and say so. Both machines of this mesh that had a front end have been
+converged for days; neither is going back. What remained of the front end on each — its package,
+its unit enabled for boot on one, its empty chains still wired into the kernel's hooks, a chain of
+its container integration still dropping traffic on the IPv6 path until the day before this record
+— was not a rollback path. It was software nobody runs, left where a reader finds it and asks
+whether the machine has two firewalls.
+
+The operator asked on 2026-10-02 that it be disabled and uninstalled. Disabled it already was. For
+uninstalled, the host had no word: a package could be declared present and not absent.
+
+## Decision
+
+**1. A package may be declared absent.** `absent: true` on a package resource has the host remove
+the package when it is installed and leave alone a machine that never had it, through the machine's
+own package manager, dependencies untouched. A declaration that stops saying a package is absent
+installs nothing: there is nothing to undo.
+
+**2. The module that holds the packet filter seat declares the front end it replaced absent**, after
+its own filter is loaded, so the mesh's table is in force before the front end's package goes. On a
+converged machine the front end is therefore gone, not merely off; on an adopted machine nothing of
+this runs, because the filter module is assigned by the flip and not before.
+
+**3. Returning such a machine to adopted enables nothing.** A machine with no firewall needs no
+openings ([ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md)); the host records the
+front end as *removed*, says so once, and asks nothing of a command that is not there. What
+ADR 0100 kept on disk for a return is kept only as far as the package manager keeps a changed
+configuration file; the rollback path it described is given up on purpose.
+
+## Consequences
+
+- The host's vocabulary grows by `absent` on a package; an older host refuses a declaration
+  carrying it, so the host rolls before the module.
+- The nftables module's declaration gains one resource; on the two machines of this mesh that were
+  found with ufw, the next push removes it.
+- `node show` reads *found firewall: ufw, removed* on those machines from then on.
+- ADR 0100's sentence about a return to adopted restoring the found firewall holds only while the
+  front end is installed, which after this record it is not on a converged machine.
+
+## How this is checked
+
+| Rule | Checked by |
+|---|---|
+| An absent package is removed when present, left when not, and read back | host tests over a fake package manager |
+| An uninstalled front end is recorded as removed and nothing is asked of it | a host test with ufw missing on a converged apply |
+| Live | the two machines report ufw gone: `pacman -Q ufw` has no answer, `node show` says removed, `status` is well |
+
+## References
+
+- [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), [ADR 0170](0170-the-firewall-seat-serves-its-verbs.md)
+- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md)

02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md

@@ -0,0 +1,118 @@
+---
+topic: what runs on it
+status: accepted
+date: 2026-09-27
+deciders: jochen
+reconstructed: true
+extends: 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
+---
+
+# 176. The operator account is a node fact, and a home is a placement root
+
+*Reconstructed. The controller shipped this on 2026-09-27 and
+[to-be 29](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) recorded it as built without a
+decision behind it. This record states what was decided, from the code and the design, and adds the
+two rules the code left implicit — what an empty account means for a module, and that the account is
+stated rather than discovered. Written 2026-10-02.*
+
+## Context
+
+[ADR 0112](0112-a-module-definition-names-no-node-mesh-or-path.md) took every host path out of a
+module definition and gave a module's *system* data a place: a directory the mesh resolves under the
+node's root, owned by the module. It said nothing about the other half of a filesystem — the files
+that belong under a person's home and are owned by that person. The predecessor wrote several of
+those: the ssh client configuration, the shell's configuration, an agent's instruction files. It knew
+whose home it was writing into because each of its node records carried a login name. The mesh took
+the machine facts over and dropped the human one.
+
+The loss was found the ordinary way: `ssh <node>` logged into the home-server under the workstation's
+own login name, because nothing in the mesh said the home-server's account was a different one
+([to-be 29](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md),
+[issue 172](../04-ISSUES/172-the-ssh-client-block-matches-one-spelling-of-a-machine/00-report.md)).
+
+What the controller does since 2026-09-27: a node record carries an operator account and, optionally,
+its home; the account and its home are machine facts a definition may name in a resource's path, owner
+and content; a roster file may say it lives under the home, and is then rendered per node, placed under
+that node's account's home, owned by the account, and left out on a node with no account. On
+2026-10-02 **all four nodes of the live mesh carry an empty account**: the fact exists and nobody has
+stated it, so no home-scoped resource can land anywhere yet.
+
+## Considered Options
+
+1. **The definition names the login.** `owner: <name>` in the module. Rejected: it is the installation
+   written into a definition, which ADR 0112 forbids and
+   [ADR 0155](0155-a-definition-names-no-installation-and-how-that-is-checked.md) checks for, and it is
+   wrong on the first machine whose login differs — which is exactly the machine that surfaced this.
+2. **The host discovers the account.** The first non-system user, or whoever ran the enrolment.
+   Rejected: a guess. A shared machine has several people on it, a server may have none, and a host
+   deciding whose files these are is a decision the mesh then cannot see, state or correct.
+3. **The account is a fact the operator states on the node record, and the home is derived from it
+   unless stated.** Chosen.
+
+## Decision
+
+**A node has an operator account: the login name of the person who works on it.** It is stated by the
+operator on the node record, the way a node's address or mode is held there, and it is empty for a
+machine nobody logs into. Empty is a real state, not a missing value. The mesh holds the fact because
+everything below derives from it, and because it is precisely the fact that was lost when the
+predecessor's records were not carried over.
+
+**The account's home is derived unless stated.** The superuser's home for the superuser, the
+distribution's conventional per-user home otherwise; a node whose account lives elsewhere states its
+home. One place computes the default, so a fact and the record cannot disagree about it.
+
+**A resource may be placed under the home, owned by the account.** This is ADR 0112's move one level
+over: as a module's system directory is resolved under the node's root, a file under a person's home is
+resolved against the account's home, and owned by the account rather than by root or a module's own
+account. A definition names the account and its home as machine facts, never as a path; a roster fact
+may say it is a home file and is then placed and owned the same way. The controller resolves both at
+composition, and the host chowns what it creates.
+
+**A node with no account cannot carry a home-scoped resource, and says so.** A roster fact that lives
+under the home is left out of that node's declaration rather than written to nowhere. A resource naming
+the account fact on such a node is refused at composition, naming the fact the machine does not have.
+A module that writes a person's files is thereby unassignable to a machine with no person on it, which
+is the right refusal.
+
+**One account per node is what this record decides.** Several people on one machine is left open, with
+the constraint that allowing it must not force the common case — one workstation, one person — to name
+anything.
+
+## Consequences
+
+- **The operator states the account before any home-scoped module lands.** Today none is stated, so the
+  first assignment of such a module begins with four node records.
+- The roster carries each node's account, so a composed ssh configuration logs in as the right person
+  on every machine — the gap that surfaced this, closed by the same fact.
+- A family of modules becomes writable: everything the predecessor placed under a home — ssh client,
+  shell, the agent's instruction files — is now a module naming a fact rather than a path
+  ([to-be 29 §2](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md)).
+- **What got harder:** a definition cannot say "my user's home" without the mesh knowing who the user
+  is, so a module of this family is refused on a freshly enrolled machine until a person is named on
+  it. That is a prompt, not an obstacle.
+- **Not decided here:** several accounts per node; a service unit running as the account rather than
+  as root or a module; a one-off step run as the account. Each is a record of its own.
+
+## How it is checked
+
+| Rule | Checked by |
+|---|---|
+| A resource's path and owner resolve the account and its home | controller tests on machine-fact resolution: a file naming the account facts lands under the account's home, owned by the account |
+| The home is derived unless stated | a controller test: the superuser's home for the superuser, the conventional home otherwise, the stated home when one is stored |
+| A home roster fact is left out on a node with no account | a controller test on roster composition: the file is absent from that node's declaration and present on a node with an account |
+| A resource naming the account on a node with no account is refused by name | a controller test on machine-fact resolution: the refusal names `account` and lists the facts the machine does have |
+| No definition names a home path | ADR 0112's catalogue test on host paths, which a `/home` or `/root` literal fails |
+
+## References
+
+- [to-be 29](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) — the design this record
+  gives a foundation to, and its "what has shipped" section
+- [ADR 0112](0112-a-module-definition-names-no-node-mesh-or-path.md) — the system-path placement
+  this mirrors; [ADR 0155](0155-a-definition-names-no-installation-and-how-that-is-checked.md) — why
+  a login name may not be in a definition
+- [ADR 0120](0120-a-roster-fact-carries-its-format-as-a-template.md) — the roster fact a home file
+  may be
+- [ADR 0177](0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md) — what
+  the mesh may and may not do inside the home this record lets it reach
+- mesh-controller `internal/inventory/nodes.go` (the account and its home on the node record),
+  `internal/catalogue/machine_into_files.go` and `roster.go` (resolution and the home fact)

02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md

@@ -0,0 +1,117 @@
+---
+topic: what runs on it
+status: accepted
+date: 2026-10-02
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md
+---
+
+# 177. Inside a home, the mesh owns the directory and the files it places, writes into the tool's own files, and holds everything else as found
+
+## Context
+
+[ADR 0176](0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md) lets a module
+place files under a person's home. A home is unlike any directory the mesh has written into so far:
+it is shared with the person, and with every program the person runs. The agent's configuration
+directory on the laptop makes the point. On 2026-10-02 it holds thirty entries. The predecessor placed
+five of them (an instruction file, a conventions rule, a settings file it merged into, two skills); a
+sibling module placed a sixth (the node's identity rule). The agent itself writes the other
+twenty-four: its settings, its credentials, its history, the memory of every project it has worked in,
+its plugins, its session logs. Several of those are what [to-be 15](../03-DESIGN/01-to-be/15-the-agent-session.md)
+calls memory *written by the session itself and declared by nobody*: a mechanism that regenerated the
+directory would erase a season of it, silently, while reporting success.
+
+The predecessor's own module recorded the hazard in the other direction. Its settings file was first
+shipped as *replace*, and every `/model` choice a person made inside a session was reverted to the
+template's value on the next synchronisation — on every node, indefinitely, with no indication why. It
+was changed to *merge*, and the comment explaining why is still in its manifest.
+
+**And the generator is gone while its output stayed.** The predecessor was retired from the laptop on
+2026-10-01. Its six files are still on both workstations, with their content telling every session to
+use tools that no longer exist. Nothing owns them; nothing will ever rewrite or remove them.
+
+[To-be 29 §3](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) drew the line for one directory,
+`~/.ssh`: the mesh owns the directory and the files it places; it holds the person's private keys and
+personal drop-ins as found. That was argued from the lockout `~/.ssh` can cause. The argument here is
+the same shape with a different stake — the person's work rather than the person's way in — and it has
+to hold for every directory the family of home-scoped modules will touch, so it is a rule, not a
+section.
+
+## Considered Options
+
+1. **The module owns the directory whole**, regenerating it from the definition. Rejected: it destroys
+   the memory, history and local settings the agent writes for itself, which is the failure to-be 15
+   names and the predecessor's settings file demonstrated at small scale.
+2. **The module owns only the files it names, and nothing about the directory.** Rejected: *owning one
+   file beside foreign ones is not owning anything* (to-be 29). The directory must exist, with the right
+   owner and mode, before the tool first runs on a fresh machine; and a credentials file in a
+   world-readable directory is a credentials file in the wrong directory.
+3. **The module owns the directory and the files it places; a file the tool writes for itself is
+   written into, never over; everything else is held as found.** Chosen.
+
+## Decision
+
+**A home-scoped module owns the directory it declares: its existence, owner and mode.** The host creates
+it if absent, owned by the account, and never removes it while it holds anything
+([ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md)). Inside it, every path the module touches
+is in exactly one of four classes, and **the class is visible in the definition from the shape
+declared**, not inferred from what happened to be on disk:
+
+| class | declared as | the host's rule |
+|---|---|---|
+| **owned** | a file with content, or a roster fact | written whole, regenerated, removed when undeclared; a file found there with no record of the mesh making it is kept once before it is written over ([ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md)) |
+| **written into** | a file written *into* a structured document | only the keys the definition names are set, every other key is kept, and each set key is given back when undeclared (ADR 0102). The key list is the module's and is short |
+| **written by the module's own process** | a secret the mesh delivers to the module, and a step that writes the file from it | the file's content is never a declared file's content, because a declaration travels in the clear on the bus and the host records it; the module's process writes it, owned by the account, atomically. [ADR 0178](0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md) says how for a credential |
+| **found** | nothing | never read, never rewritten, never removed. The person's memory, history, projects, local settings, their own rules and skills |
+
+**A file the tool writes for itself is written into, never over.** The agent's settings file and its
+own state file are the tool's; the mesh has one or two facts to state in each. Setting those keys and
+nothing else is what lets a person's `/model` choice survive a push, and what lets the mesh's keys be
+taken back cleanly when the module goes.
+
+**A predecessor's output is found.** A file placed by a generator that no longer exists is, to the
+mesh, a file it has no record of making. Where the successor module keeps the path, declaring it
+*adopts* it: the host keeps the original once and writes the mesh's. Where the successor does not keep
+the path, the mesh does not remove the file, because it removes nothing it did not make; **the operator
+removes it, once**, and the module's definition names those paths in its own documentation so the step
+is not forgotten. This is the first instance of the one-off setup step to-be 29 leaves open, and the
+rule chosen for it is that it is a person's act, listed, not a module's.
+
+**The rule is the family's.** An ssh client module, a shell module, an agent module each declare their
+directory and classify their paths this way. A module that cannot say which class a path is in has not
+finished its definition.
+
+## Consequences
+
+- A person's work under their home survives every push and every unassign. The mesh's own files come
+  and go with the module; the mesh's keys in the tool's files come and go with it; the directory stays.
+- **Stale files survive too.** Two workstations keep three predecessor files each until a person removes
+  them — a visible cost, accepted over a mesh that deletes under a person's home. A module author who
+  renames one of the mesh's own files has the ordinary path: the old resource id is undeclared and the
+  host removes what it made ([ADR 0118](0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md)).
+- A module's definition is longer by a classification, and a reviewer has one more question per path.
+  That is the point: *which parts are managed must be explicit rather than inferred* (to-be 15).
+- **What got harder:** a module cannot seed a person's preference once and leave it. A seeded file
+  ([ADR 0087](0087-a-seeded-file-is-created-once.md)) is the shape for that, and it is available to
+  this family unchanged; what is refused is a seed the module later wants to change, because what grew
+  in it is the person's.
+
+## How it is checked
+
+| Rule | Checked by |
+|---|---|
+| The directory is created owned by the account and kept when the module goes | host tests of a directory resource with an owner (ADR 0051's and 0118's), and the family's lab check below |
+| An owned file found with no record is kept once, then written | host tests of ADR 0102's kept-original rule |
+| Only the declared keys of a written-into file change, and are given back | host tests of ADR 0102: declared keys set, the rest kept, restored when undeclared |
+| Nothing found is touched | the family's lab check: a machine with a seeded home holding a person's file beside a predecessor's; after apply the person's file is byte-identical, the predecessor's is kept as the original, the mesh's keys are set and the person's keys in the same file remain; after unassign the mesh's files are gone, the keys are restored, the person's files are untouched and the directory stands |
+| Every path a home-scoped module touches is classified | a catalogue review rule for this family: each path is a directory, a file, a file written into, a secret-and-step, or absent — the first module written to it is [to-be 36](../03-DESIGN/01-to-be/36-the-operators-agent-on-a-machine.md) |
+
+## References
+
+- [to-be 29 §3](../03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md) — the same boundary drawn for `~/.ssh`
+- [to-be 15](../03-DESIGN/01-to-be/15-the-agent-session.md) — a session's memory is declared by nobody
+- [ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md), [ADR 0087](0087-a-seeded-file-is-created-once.md),
+  [ADR 0118](0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md), [ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md) — the mechanics each class rests on
+- [ADR 0051](0051-shared-data-is-the-operators.md) — the third case the host had no word for: what it neither made nor configured
+- the predecessor's `claude-code` module manifest, whose comment on `strategy: merge` records the reverted `/model` choice

02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md

@@ -0,0 +1,142 @@
+---
+topic: what runs on it
+status: accepted
+date: 2026-10-02
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0024-model-access-is-a-provision.md
+---
+
+# 178. The mesh binds and delivers a licence; the module alone writes the tool's credential; a switch is the binding changed, asked for through the console
+
+## Context
+
+**The operator's stance, set on 2026-10-02:** the controller has no part in the agent module. The
+module owns the agent's directory under the operator's home and every related file, handles them
+itself, and carries a licence-switching function as the predecessor's did.
+
+**What the predecessor's switching actually was.** A registry of accounts held server-side; a tool,
+callable from a session, that decrypted the chosen account's token on the server, refreshed it if near
+expiry, and wrote the agent's credentials file on the target node — never returning the token. Beside
+it, a shell helper that ran the agent with a token read from a plaintext file in the operator's own
+configuration directory, one token per account, on every workstation; and an enrolment helper that
+logged in once in a throwaway home and registered what came out. So the central half did the
+refreshing and the writing; the node held nothing it could refresh with; and the convenience path kept
+every account's token readable on disk wherever it was wanted.
+
+**What the mesh has.** [To-be 14](../03-DESIGN/01-to-be/14-model-access.md) is built as far as it goes:
+a licence is a named record with a vendor; a consumer is a module on a node and is put on one licence;
+the access token is sealed per holder and delivered to the holder's machine; for a refreshable grant
+the manager node alone holds the refresh token, encrypted, and refreshes centrally — the one stated
+carve-out of [ADR 0050](0050-model-access-is-vendor-agnostic.md). The controller has commands to add a
+licence, put a consumer on it, release it, accept a key, set a manager, set and refresh a grant. **None
+of them is a verb on the `mesh-controller` seat**, so none can be asked for through the console
+([ADR 0154](0154-the-meshs-own-verbs-are-the-controller-seats-tools.md) exposes eighteen commands and
+not these). The catalogue has the manager module and a consumer module that already writes an
+access-token-only credentials file at a path it is told; both are assigned to nothing.
+
+**Why refresh is central and must stay so.** A refreshable grant rotates its refresh token on use. Two
+machines each refreshing one account's grant race: the second refresh presents a token the first
+retired. The predecessor refreshed centrally for this reason, and ADR 0024 kept that half on purpose
+(*the hard half of this already — and it works*). ADR 0050 narrowed the consequence to one node.
+
+**The two designs are not in conflict, and the line has to be drawn in a record.** The controller
+resolving *whose* home a file lands in ([ADR 0176](0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md))
+and *which* licence a consumer holds (to-be 14) is what the controller does for every module. "No
+part" cannot mean that, or the module could not be assigned. It can mean — and this record says it
+means — that **the controller learns nothing about the agent**: no file shape, no path, no key, no
+word beyond the vendor adapter it already has.
+
+## Considered Options
+
+1. **The module keeps its own registry of accounts and tokens**, the stance read literally. Rejected: a
+   second secret store outside the vault ([ADR 0113](0113-the-vault-makes-every-secret.md)); a refresh
+   token on every workstation, widening ADR 0050's one-node carve-out to every machine a person sits
+   at; and two records of one licence, which drift.
+2. **The agent refreshes itself**: the mesh delivers a full grant once at a switch and the agent's own
+   refresh keeps it alive. Rejected: the refresh race above, between the agent and the manager and
+   between two machines on one account; and every node then holds a refresh token, which ADR 0050
+   decided no node does.
+3. **The mesh binds and delivers; the module writes; a switch is the binding changed, asked for through
+   the console.** Chosen.
+
+## Decision
+
+**The consumer is the module on the machine: the operator's interactive sessions on that node, under
+that account, hold one licence at a time.** That is to-be 15's `(node, module)` identity, with the
+agent module as the module. Two machines may hold different licences, the ordinary case. The mesh's own
+sessions on a machine are other modules and hold theirs in their own right.
+
+**The mesh delivers; the module writes.** The module requires `model-access`. The mesh resolves the
+licence the consumer is on, delivers the access token sealed to the machine as a secret in the module's
+own state, and delivers the non-secret facts — the licence's name, what it serves — beside it. **The
+module's own process writes the agent's credentials file** from the delivered secret: under the
+account's home, owned by the account, readable by nobody else, written atomically, and access-token-only
+— a refresh token found there is removed, because a node never holds one (ADR 0050). The file's content
+is never a declared file's content ([ADR 0177](0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md)).
+The step runs when the delivered secret changes and on a schedule as a backstop, so a refreshed token
+reaches the file without anyone asking.
+
+**The controller learns nothing about the agent.** Where the file is, what shape it has, what the
+agent calls its keys, how it is told about the console — all of that is the module's definition and
+code. The controller contributes the facts it contributes to every module: the account, the home, the
+licence, the delivery.
+
+**A switch is the binding changed.** Putting the consumer on another licence is the mesh's existing
+act — *use this licence, for this consumer* — and it becomes a verb on the `mesh-controller` seat the
+way the other verbs did (ADR 0154): the command it already has, served on the bus, listed by the
+console. The module serves two tools of its own: one that reports which licence the machine holds and
+when its token expires, and one that invokes the seat's verb for a named licence and then waits until
+the credentials file carries the new licence's token, answering with the licence's name — **never the
+token, in any answer, log or event**. A skill in the agent's directory wraps the second so a person
+asks in a sentence. Switching remains a reaction, not a declaration (ADR 0024): a person asks for it,
+and nothing in the declaration language grows a conditional.
+
+**Enrolling an account is the mesh's act on the manager node.** A new licence is added by name, its
+grant obtained by a login in a throwaway home on the manager node and adopted sealed to that node's
+key, as the manager module already does. No token is pasted into a prompt, printed, or passed as an
+argument (to-be 14's rule for keys).
+
+**The shell helper that read tokens from a file is retired, not replaced.** A second concurrent
+session on the same machine under a different licence would need a second consumer identity — the
+unbuilt half of to-be 14's gap — and is not provided here. Stated so it is not rediscovered as a bug.
+
+**A licence the mesh no longer grants is withdrawn** at the binding (ADR 0024). The credentials file
+the module wrote is the module's own output: unassigning the module leaves it, like the agent's other
+files, and the access token in it expires within hours. Releasing the consumer from the licence is the
+act that ends its access.
+
+## Consequences
+
+- The agent on a workstation authenticates with a token the mesh delivered and refreshes centrally,
+  and no workstation holds a refresh token or any other account's token.
+- **The manager must run.** The refresh path exists in the catalogue and is assigned to nothing; it is
+  a prerequisite of this record, on the control node, and the first thing the build proves.
+- **The controller gains a verb, not knowledge.** The licence commands become seat verbs, each
+  running the command it names, as ADR 0154 did for the others; nothing in them is about the agent.
+- A switch is a round trip — binding, composition, push, apply — rather than the predecessor's direct
+  write: seconds to a minute, and reported when done rather than assumed.
+- **What got harder:** running two sessions on one machine under two accounts at once, which the
+  retired helper allowed by keeping tokens readable. The price of not keeping them so.
+
+## How it is checked
+
+| Rule | Checked by |
+|---|---|
+| The module's definition declares no secret in a file's content, and requires `model-access` | a catalogue test on the module's definition |
+| The credentials file is access-token-only, owned by the account, atomic | the consumer module's existing unit tests on the strip and the write, carried into this module; a live check that the file names no refresh token |
+| A switch through the console changes the licence and the token, and no answer carries a token | a live check: the bound facts name the new licence, the file's fingerprint changes, the tool's answer and the module's log contain neither token |
+| The controller's licence verbs run the commands they name and carry no agent vocabulary | the seat verb's test, as for the eighteen before it |
+| The refresh path is live before the module is | the manager assigned on the control node and a refresh observed in the licence's record, before the module's first assignment |
+| No workstation holds a refresh token | the live check above, on every machine the module is assigned to |
+
+## References
+
+- [ADR 0024](0024-model-access-is-a-provision.md), [ADR 0050](0050-model-access-is-vendor-agnostic.md),
+  [ADR 0055](0055-model-access-is-answered-by-a-licence-or-a-node.md) — what a licence is, who refreshes, what answers
+- [to-be 14](../03-DESIGN/01-to-be/14-model-access.md), [to-be 15](../03-DESIGN/01-to-be/15-the-agent-session.md) — the consumer identity and the gap this leaves where it is
+- [ADR 0154](0154-the-meshs-own-verbs-are-the-controller-seats-tools.md), [ADR 0152](0152-the-operators-surface-is-a-module-the-console.md) — how a verb reaches a person
+- [ADR 0113](0113-the-vault-makes-every-secret.md) — why there is no second registry
+- [ADR 0177](0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md) — the class the credentials file is in
+- the predecessor's `claude-code` module: its switch tool, its shell helpers and the rules of its skill
+- mesh-catalog `modules/anthropic-manager`, `modules/anthropic-consumer` — the refresh and the write, as built

02-DECISIONS/README.md

@@ -182,6 +182,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0169** — [A machine joins through the tunnel, and the bus is never public](0169-a-machine-joins-through-the-tunnel-and-the-bus-is-never-public.md)
 - **0170** — [The firewall seat serves its verbs, and a foreign rule set is removed through one of them](0170-the-firewall-seat-serves-its-verbs.md)
 - **0172** — [The lab is a module, and runs a bed when the mesh asks](0172-the-lab-is-a-module-and-runs-a-bed-when-the-mesh-asks.md)
+- **0175** — [The found front end is uninstalled once a machine is converged](0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md)
 
 ### Its tiers, from the bottom up
 
@@ -272,6 +273,9 @@ python3 00-META/checks/index.py            fail if stale
 - **0150** — [A module's own code runs as supervised processes under the module's one account](0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md)
 - **0152** — [The operator's surface is a module the mesh assigns: the console](0152-the-operators-surface-is-a-module-the-console.md)
 - **0155** — [A definition names no installation: how that is checked, and the three ways a value that did gets out](0155-a-definition-names-no-installation-and-how-that-is-checked.md)
+- **0176** — [The operator account is a node fact, and a home is a placement root](0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)
+- **0177** — [Inside a home, the mesh owns the directory and the files it places, writes into the tool's own files, and holds everything else as found](0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md)
+- **0178** — [The mesh binds and delivers a licence; the module alone writes the tool's credential; a switch is the binding changed, asked for through the console](0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md)
 
 ### How it is built
 

03-DESIGN/01-to-be/08-connectivity.md

@@ -9,6 +9,7 @@ code:
   - mesh-host internal/apply (the service that reflects a rule set)
 updated: 2026-10-02
 decisions:
+  - 02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md
   - 02-DECISIONS/0170-the-firewall-seat-serves-its-verbs.md
   - 02-DECISIONS/0169-a-machine-joins-through-the-tunnel-and-the-bus-is-never-public.md
   - 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
@@ -772,6 +773,11 @@ the host reports as *other* is reached through the packet filter seat's `remove`
 by name on the bus; the seat also serves `rules` and `reload`, and its holder's runtime declares the
 `NET_ADMIN` capability on the machine's network. See design 33.
 
+*2026-10-02, [ADR 0175](../../02-DECISIONS/0175-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md):*
+once a machine is converged, the front end it was found with is uninstalled, not merely disabled — the
+packet filter's holder declares its package absent after the mesh's filter is loaded, and a return to
+adopted then enables nothing. The rollback path ADR 0100 kept on disk is given up on purpose.
+
 ## 5 — Certificates
 
 **Two authorities, kept separate on purpose.**

03-DESIGN/01-to-be/14-model-access.md

@@ -4,9 +4,10 @@ status: in-progress
 code:
   - mesh-controller internal/licences
   - mesh-controller cmd/mesh-controller/licence.go
-updated: 2026-09-05
+updated: 2026-10-02
 decisions:
   - 02-DECISIONS/0024-model-access-is-a-provision.md
+  - 02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md
   - 02-DECISIONS/0009-modules-and-the-graph.md
   - 02-DECISIONS/0054-model-usage-is-recorded-at-two-grains.md
   - 02-DECISIONS/0055-model-access-is-answered-by-a-licence-or-a-node.md
@@ -96,6 +97,13 @@ So `(node, module)` tells them apart, and asking for a licence per session neede
 identity. Checked rather than argued: two sessions on one machine hold different licences, each is
 given its own key, and releasing one leaves the other.
 
+*2026-10-02:* the operator's own interactive agent on a workstation is a consumer the same way —
+`(node, claude-code)`, one licence at a time per machine, delivered by the mesh and written by the
+module, switched through the console
+([ADR 0178](../../02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md),
+[36 — The operator's agent on a machine](36-the-operators-agent-on-a-machine.md)). The licence commands
+become verbs on the controller's seat for it; none was one before.
+
 **What is still open is the rest of the gap, and it is the harder half.** A *worker* is not one
 per machine — many can run on one, from one module — so `(node, module)` cannot name them apart
 and this reasoning does not extend to them. That belongs with

03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md

@@ -5,8 +5,10 @@ code:
   - mesh-controller internal/inventory
   - mesh-controller internal/catalogue
   - mesh-controller cmd/mesh-controller
-updated: 2026-10-01
+updated: 2026-10-02
 decisions:
+  - 02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md
+  - 02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md
   - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
   - 02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md
   - 02-DECISIONS/0051-shared-data-is-the-operators.md
@@ -171,6 +173,14 @@ fact, the home as a placement root, and what the mesh may and may not do under a
 decision this document names but no record states. They are the next records to write, before the
 family of §2 modules is built.
 
+*2026-10-02:* two of them are written. [ADR 0176](../../02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)
+records the account as a node fact and the home as a placement root, reconstructed from what shipped;
+[ADR 0177](../../02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md)
+generalises §3's boundary to every directory under a home. The first member of the §2 family is
+designed in [36 — The operator's agent on a machine](36-the-operators-agent-on-a-machine.md). Still
+unwritten: user-scope units, several accounts per node, and the CA. On the same day every node of the
+live mesh still carried an empty account.
+
 ## Why now, and why not yet
 
 **Why it matters:** when HAL retires, the generators that keep `~/.ssh`, shell config and the

03-DESIGN/01-to-be/34-the-console.md

@@ -28,6 +28,14 @@ module's credential and listens on loopback. It has no state, no provision, no s
 the bus, which it gets the way every module does: a credential the mesh minted for `<node>.mesh-console`,
 sealed to the machine, delivered as the module's own secret.
 
+*2026-10-02:* it gains one provision, at node scope — the MCP endpoint on loopback, serving the port
+the machine gave it — so that a module whose software must be told where the console is requires that
+and is coupled to an endpoint rather than to a module's name
+([ADR 0027](../../02-DECISIONS/0027-a-provision-names-what-the-consumer-is-coupled-to.md)). The first
+consumer is the operator's agent, [36 — The operator's agent on a machine](36-the-operators-agent-on-a-machine.md) §6;
+a machine without the console refuses such a module by name. Nothing else above changes: no seat, no
+state, no tools of its own.
+
 Its manifest says three things nothing else in the catalogue says together:
 
 - `invokes: ["*"]` — it calls every tool on the mesh, and the bus grants exactly that publish side;

03-DESIGN/01-to-be/36-the-operators-agent-on-a-machine.md

@@ -0,0 +1,257 @@
+---
+layer: to-be
+status: designed
+code: []
+updated: 2026-10-02
+decisions:
+  - 02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md
+  - 02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md
+  - 02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md
+  - 02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md
+  - 02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md
+  - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
+  - 02-DECISIONS/0155-a-definition-names-no-installation-and-how-that-is-checked.md
+  - 02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md
+  - 02-DECISIONS/0050-model-access-is-vendor-agnostic.md
+  - 02-DECISIONS/0109-a-package-registry-seat-is-one-per-ecosystem.md
+---
+
+# 36 — The operator's agent on a machine: the `claude-code` module
+
+**The agent a person runs at a terminal, put on the machine by the mesh, instructed by the mesh,
+pointed at the console, and authenticated with a licence the mesh delivers.** It is the first member of
+the family [to-be 29 §2](29-a-node-has-operator-accounts.md) names — the modules that place files under
+an operator's home — and the smallest, so it is where the pattern is proven before the shell, the
+terminal and the desktop follow.
+
+What it replaces: the predecessor's module of the same name, which installed the agent's package and
+placed five files under the operator's home, and a sibling that placed a sixth. The predecessor is
+retired; those six files are still on both workstations telling every session to use tools that no
+longer exist. That is the symptom this design answers, and it answers it by making the files a module's
+again rather than by editing them.
+
+## 1. What it is
+
+A module, `claude-code`, universal tier: assigned to every node a person logs into, which is every node
+with an operator account ([ADR 0176](../../02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)).
+It declares the agent's package, owns the agent's configuration directory under the account's home, and
+requires two things: `model-access`, for the licence
+([ADR 0178](../../02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md)),
+and the console on the same machine, for the tools
+([ADR 0152](../../02-DECISIONS/0152-the-operators-surface-is-a-module-the-console.md)). It names no
+node, no path and no login: the account and its home are machine facts, the node's name is a machine
+fact, the node's role is a setting on the assignment, and the console's address is what the console
+serves.
+
+**The controller has no part in it beyond what it has in every module.** It resolves the account, the
+home, the licence and the console's port, and delivers them. It holds nothing about the agent: no file
+shape, no key name, no path. The one controller change this design asks for is not about the agent at
+all — the licence commands become verbs on the controller's seat, as the other commands did
+([ADR 0154](../../02-DECISIONS/0154-the-meshs-own-verbs-are-the-controller-seats-tools.md)).
+
+## 2. What it owns under the home, and what it leaves alone
+
+Every path the module touches is in one of the four classes
+[ADR 0177](../../02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md)
+draws, and the class is visible from the shape the definition declares. The agent's directory is
+`~/.claude`; its own state file is `~/.claude.json` beside it.
+
+| path | class | declared as |
+|---|---|---|
+| `~/.claude/` | owned directory | a directory, owner the account, readable by the account alone |
+| `~/.claude/CLAUDE.md` | owned | a file: how a session on this mesh works (§4) |
+| `~/.claude/rules/00-mesh.md` | owned | a file: this node's identity (§4) |
+| `~/.claude/rules/conventions.md` | owned | a file: the rules of the repositories (§4) |
+| `~/.claude/skills/mesh-licence/SKILL.md` | owned | a file: the licence skill (§5) |
+| `~/.claude/settings.json` | written into | the agent's settings; the mesh's key is `attribution`, and only that (below) |
+| `~/.claude.json` | written into | the agent's own state; the mesh's key is the console's entry under the servers the agent speaks to (§3) |
+| `~/.claude/.credentials.json` | written by the module's process | a delivered secret and a step (§5) |
+| everything else | found | nothing — the person's memory, history, projects, local settings, plugins, their own rules and skills |
+
+**Which keys of the settings file are the mesh's.** A key is the mesh's when it encodes a rule of the
+mesh, and the person's when it is a preference. `attribution` — the trailers the agent adds to commits
+and pull requests — encodes the repositories' convention and is the mesh's. The model, the spinner, the
+drafts, the automation mode and everything else are the person's, and the predecessor's experience with
+the model key is the evidence: a mesh that sets a preference reverts a person's choice on every push. A
+preference the operator wants on every machine belongs to the family's dotfiles module, not here.
+
+**The agent's own state file is written into for one key.** The agent is told about the console as one
+entry among the servers it speaks to, in the file where it keeps that list. Everything else in that
+file — the account it is logged in as, its caches, its history of projects — is the agent's, and
+ADR 0102's rule is exactly what keeps it: the mesh sets one key and gives it back on undeclare.
+
+## 3. The predecessor's six files
+
+They were placed by a generator that no longer exists; to the mesh they are found. ADR 0177 says what
+happens to each kind, and this is the list:
+
+| file | fate |
+|---|---|
+| `CLAUDE.md`, `rules/conventions.md` | **adopted.** The module declares the same paths; the host keeps the found original once and writes the mesh's content ([ADR 0102](../../02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md)) |
+| `settings.json` | **written into.** The values the predecessor merged and the person changed since — the model among them — stay; the mesh sets its one key |
+| `rules/00-hal-mesh.md` | **removed by the operator, once.** Its successor is `rules/00-mesh.md`; the old name carries the predecessor's and stays otherwise |
+| `skills/hal-switch-license/SKILL.md` | **removed by the operator, once.** Its successor is `skills/mesh-licence/SKILL.md` |
+| `skills/cleanup/SKILL.md` | **removed by the operator, once.** A repository hygiene skill naming the predecessor's forge and repository; not the mesh's |
+
+The module's documentation names the three removals, so a person assigning it on a workstation that
+carried the predecessor knows the step. On a fresh machine there is nothing to remove.
+
+**The console's entry changes name.** The agent on both workstations today reaches the console under
+an entry named after this installation. A definition names no installation
+([ADR 0155](../../02-DECISIONS/0155-a-definition-names-no-installation-and-how-that-is-checked.md)), so
+the module writes the entry as `mesh`, and every tool an agent sees is prefixed accordingly. The
+hand-made entry is the person's to remove; until they do, the agent sees the mesh's tools twice.
+
+## 4. What the three documents say
+
+**Prose, not a paste** — the files are the module's; this is what they are for.
+
+**`CLAUDE.md` — how a session on this mesh works.** The console is the only path to the mesh, and its
+tools are the vocabulary: the record is asked through the records module's tools, symptom first — the
+literal error text before a hypothesis — and that is the *search before you dig* rule rewritten for a
+knowledge base that is now the record itself ([ADR 0153](../../02-DECISIONS/0153-the-record-is-read-by-a-module-and-the-console-lists-it.md));
+the mesh is asked and changed through the controller seat's verbs — status, plan, assign, push,
+settings, and licence once it exists; the forge through the forge module's tools. The hard rules are the
+same rules in new words: a file the mesh manages is changed through the verb that owns it or through
+the catalogue, never on disk, and `plan` says what the mesh would write; a store's database is never
+written by hand; main is never pushed; the mesh creates no symlinks and nobody else does either; a
+package is declared, not installed by hand. It uses the glossary's words — controller, foundation,
+node, seat, console — and none of the predecessor's.
+
+**`rules/00-mesh.md` — who this node is.** Two facts and one pointer: the node's name, from the
+machine; the node's role, from the assignment's settings on this node; and that the other nodes are
+asked of the controller's `nodes` verb rather than listed here. The predecessor's rule carried a table
+of every node with its public domain and role; a table is a copy that drifts, and the live answer is
+one tool call away. No address, no public domain.
+
+**`rules/conventions.md` — the rules of the repositories.** Concise commit messages in the imperative,
+focused on why; a branch, a pull request and a human approval for every merge; test before pushing,
+because nodes update unattended; follow the playbooks in the record; shared logic in the SDK; the
+module repository's rules on manifests. Nothing that names a tool of the predecessor's.
+
+**Where the module gets the name and the role.** The name is a machine fact the controller already
+offers a definition. The role is a value a person chooses per node — *the laptop*, *the home-server* —
+and is an operator value on the assignment's node layer, refused by name when unset
+([ADR 0155](../../02-DECISIONS/0155-a-definition-names-no-installation-and-how-that-is-checked.md)).
+So assigning the module to a node is two acts: the assignment, and the node's role in its settings.
+
+## 5. The licence
+
+[ADR 0178](../../02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md)
+decides it; this is the shape.
+
+**The consumer** is `(node, claude-code)`: the operator's interactive sessions on that machine, under
+that account, on one licence at a time. The module requires `model-access` and is put on a licence like
+the consumer module already in the catalogue.
+
+**Delivery and the write.** The mesh delivers the access token sealed to the machine, as a secret in
+the module's own state directory, and the bound facts beside it. A step in the module's own process —
+the consumer module's existing write, carried over — reads the secret and writes
+`~/.claude/.credentials.json`: owned by the account, readable by the account alone, atomically,
+access-token-only. The step names the secret file as what it reads and runs again when it changes
+([ADR 0099](../../02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md)), and on a schedule as
+a backstop, so a refreshed token reaches the file unasked. It runs in the module's own context and
+never as the person.
+
+**Refresh** is the manager module's on the control node, as [ADR 0050](../../02-DECISIONS/0050-model-access-is-vendor-agnostic.md)
+built it. It is assigned to nothing today and is the first prerequisite of the build.
+
+**The two tools** the module serves, listed by the console under the module's name:
+
+| tool | answers |
+|---|---|
+| `licence_status` | which licence this machine's agent holds, from the bound facts; when its access token expires; whether the file on disk matches what was delivered — by fingerprint, never by value |
+| `licence_switch` | asks the controller seat's `licence` verb to put this consumer on the named licence, waits until the credentials file carries the new licence's token, and answers with the licence's name and expiry. Refuses with the mesh's own words when the licence does not exist or the consumer cannot be put on it |
+
+Neither tool, nor the module's log, nor any event it emits, ever carries a token. The module declares
+that it invokes the controller seat's `licence` verb, and nothing else.
+
+**The skill** — `skills/mesh-licence/SKILL.md` — wraps `licence_switch` so a person asks in a sentence,
+and carries the predecessor's rules unchanged in substance: never ask for or print a token; never edit
+the credentials file by hand; the tool writes the file and the record together; with no licence named,
+ask rather than guess.
+
+**Enrolling an account** happens on the manager node: a licence added by name, its grant obtained by a
+login in a throwaway home and adopted sealed to that node's key, as the manager module does. **The
+shell helper** that ran the agent with a token from a plaintext file is retired and not replaced
+([ADR 0178](../../02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md)
+says why).
+
+## 6. The console
+
+The agent reaches the mesh through the console on the machine's loopback
+([to-be 34](34-the-console.md)). The module must tell the agent the console's address, and the port is
+the console's to say: today the console's manifest declares it and the host assigns it, and nothing but
+the console knows what was assigned. So **the console provides a node-scoped provision** — the MCP
+endpoint on loopback — serving its port, and the module requires it. A requirement names what the
+consumer is coupled to ([ADR 0027](../../02-DECISIONS/0027-a-provision-names-what-the-consumer-is-coupled-to.md)):
+the agent is coupled to an MCP endpoint on its own machine, not to a module name. Co-location resolves
+it, and a machine without the console refuses the agent module by name — which is right, because an
+agent without the console is the predecessor's situation again.
+
+This is a change to the console's definition, not to the controller. [To-be 34 §1](34-the-console.md)
+says the console has *no provision*; this is the one it gains, at node scope, and the design is amended
+in the same change.
+
+## 7. Scope, settings and the order of assignment
+
+**Every node with an operator account.** None has one today; the operator states them first. A node
+with no account refuses the module, naming the fact.
+
+**Per node:** the role, in the module's settings on the node layer. **Per mesh:** nothing.
+
+**Order:** the manager on the control node and a refresh observed; the licences the operator uses,
+enrolled; the console's provision and the module in the catalogue; one workstation assigned, the three
+predecessor files removed there, and a new session read to confirm it sees the mesh's instructions and
+the console's tools; then the rest.
+
+## 8. The package
+
+The module declares the agent's package. The distribution every node of the live mesh runs does not
+carry it in its repositories: the two workstations have it from a build the predecessor's helper made
+from the community repository, and nothing updates it since the predecessor retired. On those two the
+declaration is satisfied — the package is present. **On a fresh machine the host's package manager
+refuses it, in its own words, and the module is not applied there.** That is correct and is a gap.
+
+The answer the mesh already has a shape for is a package repository for this ecosystem as a seat
+([ADR 0109](../../02-DECISIONS/0109-a-package-registry-seat-is-one-per-ecosystem.md)), fed by the
+builder with a package it builds from the vendor's release, and trusted by every node's package manager.
+Then `package: claude-code` is answered the way every package is, and updates arrive the way every
+update does. It is not built, and it is not this module's to build: it is a seat and a provider module
+of its own, needed by every package the distribution does not carry.
+
+Rejected as the answer: the vendor's own installer, which puts a self-updating binary under the
+person's home. It is a hand-installed package the mesh cannot see, reproduce or roll back, and it
+updates itself outside the mesh — the arrangement the manifest rule *never install a package by hand*
+exists to end.
+
+## How it is checked
+
+| Check | Defends |
+|---|---|
+| the module's definition names no node, path or login, and declares no secret in a file's content | ADR 0112, ADR 0155, ADR 0178 |
+| on a lab machine with an account, a seeded home holding a person's rule file, the predecessor's three leftovers and a settings file with the person's model: after assign, the mesh's files are present and owned by the account, the person's file and model are byte-identical, the leftovers are untouched, the console's entry is set; after unassign, the mesh's files are gone, the two keys are given back, the directory and everything else stand | ADR 0177 |
+| on a lab machine with no account, the assignment is refused naming the fact | ADR 0176 |
+| the credentials file is owned by the account, readable by it alone, and names no refresh token; a switch through the console changes the licence named in the bound facts and the file's fingerprint; neither the tool's answer nor the module's log holds a token | ADR 0178, ADR 0050 |
+| the console's provision resolves by co-location and a machine without the console refuses the module by name | ADR 0027, ADR 0152 |
+| a new session on the assigned workstation lists the console's tools under the `mesh` prefix and answers "which node am I" from the identity rule | the exit of the build |
+| the package is reported present on the workstations and refused in the package manager's words on a machine without it | §8, honestly |
+
+## What this does not settle
+
+- **Several operator accounts on one node.** ADR 0176 decides one; the module follows.
+- **A parallel session under another licence on the same machine.** The retired helper allowed it by
+  keeping tokens readable; a clean form needs a second consumer identity (to-be 14's open half).
+- **The package repository seat.** §8 names it and leaves it to its own design.
+- **The rest of the family** — shell, terminal, desktop, user-scoped services — each a module of the
+  same shape, each proving nothing new about ownership and something new about its own tool.
+
+## References
+
+- [ADR 0176](../../02-DECISIONS/0176-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md),
+  [ADR 0177](../../02-DECISIONS/0177-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md),
+  [ADR 0178](../../02-DECISIONS/0178-the-mesh-binds-and-delivers-a-licence-and-the-module-writes-the-tools-credential.md) — the three decisions this rests on
+- [to-be 29](29-a-node-has-operator-accounts.md) — the family; [to-be 14](14-model-access.md),
+  [to-be 15](15-the-agent-session.md) — the licence and the consumer; [to-be 34](34-the-console.md) — the console
+- the predecessor's `claude-code` module and its sibling's identity rule — what is replaced, read from the workstations on 2026-10-02
+- mesh-catalog `modules/anthropic-consumer` — the write this module carries over; `modules/anthropic-manager` — the refresh it depends on