Merge pull request 'Design 38: WP3 built — node-tools beside mesh-tools, the three things the plan did not say, and the gate refuses spreading not standing' (#304) from design/38-wp3-built-and-the-gate-softened into main

Two records shared 0187 (issue 155's collision); the branch landing last
renumbers, and this is it. Only the number changes.

00-META/glossary.md

@@ -108,7 +108,7 @@ term retired here may still appear there, and the mapping above is how to read i
   memberships issue; its serving mode on loopback is what was called **the console**
   ([ADR 0175](../02-DECISIONS/0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md)).
   Replaces **"console"** as the module's name; *console* remains the word for the person's end of it.
-- **bundle** — the artifact a module's tools are built into, interpreted or compiled; never an image.
+- **bundle** — the artifact a module's own code is built into — its tools, a seat's implementation, a daemon — in any language the mesh has a toolchain for, interpreted or compiled; never an image. One module may declare several ([ADR 0188](../02-DECISIONS/0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md)).
 - **kept region** — a marked block in a managed file the mesh writes *into*, where the operator's own
   lines survive every push and are given back when the module goes
   ([ADR 0174](../02-DECISIONS/0174-a-node-varies-a-module-through-settings-and-kept-regions-never-an-edit.md)).

02-DECISIONS/0039-what-the-sdk-holds-and-refuses.md

@@ -8,6 +8,8 @@ reconstructed: false
 
 # 39. What the SDK holds, and what it refuses
 
+> **The mechanism changed — 2026-10-02, by [ADR 0188](0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md).** The test of this record — frequent *and* cascading does not belong — stands and now applies to one SDK per language. Where *what it holds* names the broker client and the event consumer, read: the local protocol a tools bundle speaks to the node's runtime; the transport lives in the runtime and in no SDK, which is what keeps a bus change from rebuilding any module in any language.
+
 _Reconciliation note (2026-09-05): supersedes the earlier "repository structure" decision, which the consolidation folded; no standalone record remains to point at, so body references to it now point at the nearest surviving record, [ADR 0015](0015-applications-live-in-their-own-repository.md)._
 
 ## Context

02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md

@@ -9,6 +9,8 @@ extends: 02-DECISIONS/0047-a-module-runs-its-code-as-its-own-process-with-its-ow
 
 # 150. A module's own code runs as supervised processes under the module's one account
 
+> **Widened — 2026-10-02, by [ADR 0188](0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md).** A module's long-lived process is a bundle in any language the mesh has a toolchain for, run as a unit the host writes; this record never said one language and never meant one, and 0188 says so as the rule.
+
 > **The mechanism changed — 2026-10-02, by [ADR 0175](0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md).** For a module's *tools*, read that record: one runtime per node, the node's one account, bundles loaded from the memberships. This record still governs a module's long-lived processes — a daemon, a provisioner, a scheduled ingest — and the account invariant for them.
 
 ## Context

02-DECISIONS/0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md

@@ -9,6 +9,8 @@ extends: 02-DECISIONS/0150-a-modules-own-code-runs-as-supervised-processes-under
 
 # 175. One tool runtime per node serves every module's tools, on the host side
 
+> **The mechanism changed — 2026-10-02, by [ADR 0188](0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md).** Everything decided here stands: one runtime per node, host-side, every module's tools and every held seat's verbs on the memberships' subjects, root the module's concern, any node calls any tool, the console its serving mode. What moved is how the runtime brings a bundle to life. Decision 3 and the consequence *the node tools runtime needs an interpreter on the machine* read as though a bundle were always interpreted code the runtime imports; a tools bundle is now a process in any language that speaks MCP over stdio to the runtime, and importing a TypeScript bundle is the shortcut, not the contract.
+
 ## Context
 
 A module's tools are code the module wrote, one function behind each verb, served on the subjects

02-DECISIONS/0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md

@@ -0,0 +1,127 @@
+---
+topic: what runs on it
+status: accepted
+date: 2026-10-02
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md
+---
+
+# 188. A module's own code is bundles in any language, and a tools bundle speaks MCP to the runtime
+
+## Context
+
+[ADR 0175](0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md) put one
+tool runtime on every node and said a module brings its tools as a bundle. The runtime that exists
+is written in TypeScript and brings a bundle to life by **importing it into its own process**, which
+only JavaScript can be. The SDK ([ADR 0039](0039-what-the-sdk-holds-and-refuses.md)) is one
+TypeScript package. The builder knows three toolchains — TypeScript, Go, Python — and every one of
+the 35 catalogue modules with tools wraps them in a container on the runtime's TypeScript image.
+Nothing in the records says a module's code may be written in anything else, and nothing refuses a
+module that wraps its own code in an image to get around that.
+
+The operator's direction, stated on 2026-10-02 and repeated: *the SDK is the most important part;
+we must not limit developers; tools can be written in any possible language — Rust, C, Go,
+JavaScript. A service in Go or Rust as a systemd unit must be possible too. One module can deliver
+all kinds of bundles: one for its tools, one for a seat's implementation, one for a daemon. Support
+the bare minimum first, as a skeleton; a full implementation comes when the work requires it.*
+
+Measured against that: the `bundle` artifact kind already names a language and the `process`
+resource already runs a command from an unpacked bundle as a unit the host writes
+([ADR 0150](0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md)), so a Go
+daemon as a native service is possible today and one module in the catalogue does it. What is not
+possible is a tool in any language but one, and what is not written is that any of this is the
+rule.
+
+## Considered Options
+
+1. **One SDK, one language, as now.** Rejected: it limits who can write a module to one
+   ecosystem, which the operator declines, and it is what made every module's tools a container
+   on one image.
+2. **A full bus client per language.** Each SDK speaks the bus itself; the runtime only
+   supervises. Rejected: a transport in every SDK is what ADR 0039 refuses, and a bus change
+   would then rebuild every module in every language — the cascade, multiplied.
+3. **A tools bundle is a process the runtime launches and speaks a small local protocol to,
+   and that protocol is MCP over stdio.** Chosen. The runtime already speaks MCP outward (the
+   console); speaking it inward to a child process is the same vocabulary. Every language that
+   has an MCP server library can write a tools bundle today with no mesh SDK at all, and the
+   mesh's own SDK for a language is a thin convenience over it. The transport stays in the
+   runtime, so a bus change rebuilds nothing.
+4. **A protocol of the mesh's own design.** Rejected: a second way to describe a tool, its
+   schema and its call, inventing what MCP already settled, for no gain.
+
+## Decision
+
+**1. A module's own code is bundles, in any language the mesh has a toolchain for, and never an
+image.** A `bundle` names its language and what it is for. Images are for third-party software a
+module installs — a database, a forge — never for code the module wrote. One module may declare
+several bundles: its tools, its implementation of a seat's verbs, a daemon, a step. Each is built
+alone and delivered alone, as [ADR 0156](0156-an-artifact-is-what-a-build-produces-and-the-store-is-named-for-its-scope.md)
+already has it.
+
+**2. A bundle the runtime serves is a process that speaks MCP over stdio.** The node's runtime
+launches it as the bundle names it — an interpreter and a file, or a binary — with the runtime's
+environment, asks `tools/list`, and answers each call on the bus by `tools/call`. A tool whose name
+is `<seat>.<verb>` is the module's implementation of that seat's verb; any other name is the
+module's own tool. Everything the runtime does with what it is told — subjects from the membership,
+a held seat's verbs, the `tools` answer, a bundle that fails named and the others serving — stays as
+[ADR 0175](0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md) and
+[ADR 0160](0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md)
+have it. A TypeScript bundle may still be imported into the runtime's own process; that is a
+shortcut over the same contract, not a second contract, and a TypeScript bundle written against
+the protocol is served the same way as any other.
+
+**3. A bundle that is a service is a `process`**, run by the host as a unit, in whatever language it
+is compiled from, exactly as the host's own bundle already is. Nothing new is decided here; it is
+said so that it is the rule and not an example.
+
+**4. One thin SDK per language, and the test of ADR 0039 applies to each.** An SDK for a language
+holds the MCP-over-stdio loop, the tool-definition type and the few primitives a module's code
+needs; it holds no transport, no module's client and nothing volatile. Where a language has a
+sound MCP library, the SDK wraps it rather than re-implementing it. The languages are those that
+make sense to write a module in; the first set is TypeScript, Go, Python, Rust and C, and the set
+grows when a module needs one, not before.
+
+**5. Skeleton first.** Each piece — a toolchain, a launcher, an SDK — exists at the bare minimum
+that lets one bundle in that language be built, delivered and answer one tool on the live mesh.
+Anything beyond that is added when a module needs it. A skeleton that is not proven by one bundle
+answering is not a skeleton; it is a promise.
+
+## Consequences
+
+- The runtime gains a launcher beside its loader. The loader, the memberships, the seats and the
+  failure handling built for ADR 0175 stand; the launcher is the one new step.
+- The builder gains a toolchain per language, each at the skeleton: compile, pack, name the
+  entrypoint. Rust and C are new; a language that compiles to a binary says its operating system
+  as a Go bundle already does.
+- An existing MCP server in any language is already a valid tools bundle. What the mesh adds is
+  the subjects, the seats and the memberships around it.
+- The gate [to-be 38](../03-DESIGN/01-to-be/38-building-the-operators-machine.md) WP2 adds —
+  refusing a tools container built on the runtime's image — widens: a module whose own code is
+  an image artifact is refused at registration, naming this record.
+- What got harder: a tools bundle is now a process per module on the node rather than code in
+  one process, so the runtime supervises children and restarts one that dies. The one-process
+  shape ADR 0175 counted on for the TypeScript shortcut remains available for it.
+- ADR 0039's "what the SDK holds" now reads per language; its refusals are unchanged and are the
+  reason option 2 was rejected.
+
+## How it is checked
+
+| Rule | Checked by |
+|---|---|
+| A module's own code is never an image | the catalogue's registration check: a manifest with a `bundle` kind of own code *and* an image artifact built from the module's own directory is refused, naming this record |
+| A tools bundle in a language other than TypeScript answers on the bus | the runtime's tests: a bundle written against the protocol in a second language, launched, its tool called over a real bus |
+| A TypeScript bundle written against the protocol is served like any other | the same tests, with the TypeScript shortcut off |
+| Each SDK is thin | each SDK's own README states what it holds under ADR 0039's test, and its size is in the mesh's records |
+| Live | a tool in a compiled language answers from the node's runtime on one machine |
+
+## References
+
+- [ADR 0175](0175-one-tool-runtime-per-node-serves-every-modules-tools-on-the-host-side.md),
+  [ADR 0039](0039-what-the-sdk-holds-and-refuses.md),
+  [ADR 0150](0150-a-modules-own-code-runs-as-supervised-processes-under-one-account.md),
+  [ADR 0156](0156-an-artifact-is-what-a-build-produces-and-the-store-is-named-for-its-scope.md),
+  [ADR 0160](0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md)
+- [To-be 38](../03-DESIGN/01-to-be/38-building-the-operators-machine.md) — the work packages this
+  record widens
+- The Model Context Protocol's stdio transport — the local protocol a tools bundle speaks

02-DECISIONS/0188-a-provider-declares-what-it-derives-for-each-consumer.md

@@ -1,130 +0,0 @@
----
-topic: the mesh
-status: accepted
-date: 2026-10-02
-deciders: jochen
-reconstructed: false
-extends: 02-DECISIONS/0048-a-provider-creates-the-credential-the-mesh-minted.md
----
-
-# 188. A provider declares what it derives for each consumer, and the mesh tells both ends
-
-## Context
-
-An arrangement between a consumer and a provider is delivered entirely by the mesh. Where the
-provider is, which port it answers on, what name the consumer must present, where its password
-is — each arrives as a fact the consumer reads from its binding, or as `${bound:…}` filled into a
-file before the declaration leaves the control plane. The provider invents none of it and hands
-none of it back ([ADR 0048](0048-a-provider-creates-the-credential-the-mesh-minted.md)).
-
-One kind of value escapes that. Where the **provider names the resource** — a bucket, a database,
-a vhost — the name is derived from the consumer, per consumer, and the mesh has no way to carry
-it. `serves` is a literal block in the provider's definition: the same values for every consumer.
-A provisioner's contract takes a provision and returns nothing. So a value the mesh's own rule
-produced reaches neither end as a statement; it is recomputed at one end and transcribed at the
-other.
-
-The object store is the instance ([issue 124](../04-ISSUES/124-a-consumer-cannot-be-told-what-its-provider-derived/00-report.md)).
-Its provisioner normalises the login the mesh minted into a bucket name and creates, checks and
-removes exactly that; the rule lives in twenty lines of the module's own TypeScript. Its three
-consumers each write the answer into their own definition by hand. Two transcribed it correctly;
-one named a predecessor's bucket, and would have authenticated successfully and been refused on
-every object, which reads like a credential fault and is not one.
-
-Even corrected, the transcriptions are wrong in a second way. Each is `mesh-<node>-<slug>`, so
-each **names the machine the module happens to run on today** — a definition stating a fact about
-one installation, which [ADR 0155](0155-a-definition-names-no-installation-and-how-that-is-checked.md)
-forbids and whose check does not catch because the name is not a domain. Move any of the three to
-another machine and its configuration points at a bucket its key cannot open.
-
-The shape is not the object store's. A database provisioner that prefixed names, a queue provider
-that scoped vhosts, any provider that derives a resource from who is asking: each forces the
-consumer to reproduce somebody else's rule and keep it in agreement by hand.
-
-## Decision
-
-**1. A served value may name the consumer the mesh is serving.** A `serves` block, which is
-literal today, may interpolate the mesh's own statement of who the consumer is:
-
-- `${consumer:as}` — the identity the mesh minted for this consumer, exactly as the login it is
-  told to present ([ADR 0049](0049-a-consumers-identity-fits-the-tightest-backend.md));
-- `${consumer:as:dns}` — the same identity written as a DNS label.
-
-Nothing else. **The mesh learns no protocol here; it spells its own name in an alphabet it already
-knows.** The identity is the mesh's, minted by the mesh, already capped at twenty characters
-because of what an S3 access key accepts; `dns` is that same name with its separator written `-`
-instead of `_`, which is the whole of the difference between the mesh's identifier alphabet and
-the one buckets, vhosts and hostnames use. A provider that needs a prefix or a suffix writes it
-around the placeholder, because a served value is a string.
-
-The rejected alternative is **the provider returning values from provisioning** — the natural
-channel, since the provider is what derived them. It is rejected for three reasons, in order of
-weight. It inverts the delivery the mesh is built on: a grant would carry data the provider wrote
-rather than only data the mesh minted, and [ADR 0048](0048-a-provider-creates-the-credential-the-mesh-minted.md)
-removed exactly that second path once already. It makes a consumer's declaration incomplete until
-its provider's reconcile loop has run, so a consumer could not be composed before a provider
-answered — a bootstrap order the mesh does not have and does not want. And it puts the rule where
-nothing can check it: a value that arrives from a running process cannot be refused at resolution,
-only discovered wrong later, which is the failure this record exists to end.
-
-**2. The mesh resolves it once, per consumer, and tells both ends from the one resolution.** At the
-moment a consumer's declaration is composed, the mesh knows exactly who the consumer is. There, and
-only there, the placeholders are filled. The result reaches:
-
-- the **consumer**, as the served facts in its binding file and as `${bound:<provision>:<key>}` in
-  any file it writes — unchanged mechanisms, carrying one more key;
-- the **provider**, as `serves` on that consumer's entry in its contributions file, so the
-  provisioner is *told* the name rather than recomputing it.
-
-**The provider stops deriving in code and starts declaring.** One statement, filled once, delivered
-to both ends: the two cannot disagree, because there is no second computation to disagree with.
-
-**3. A served value stays settled before it is per-consumer.** Settings still compose into `serves`
-([ADR 0174](0174-a-node-varies-a-module-through-settings-and-kept-regions-never-an-edit.md)), and the consumer
-placeholders are filled after that, so an operator may set a prefix and the mesh still derives the
-rest. A `${consumer:…}` naming a fact or an alphabet the mesh does not have is refused when the
-definition is parsed, with what it may say.
-
-**4. A consumer may no longer name the resource its provider derives.** With the value delivered,
-a literal in a consumer's definition is not merely redundant — it is the one thing that can
-disagree with what the provider will actually create. The three object-store consumers lose their
-hand-written bucket names in this change.
-
-## Consequences
-
-- One more thing a definition may say, and one less thing a module may be wrong about. The
-  vocabulary grows by a placeholder; the catalogue loses three literals that named this
-  installation's control node.
-- A provider's naming rule becomes readable in its definition instead of in its source. `minio`'s
-  `bucketFor` goes; the manifest says `"bucket": "${consumer:as:dns}"` and the provisioner uses
-  what it is given.
-- A provider that already serves consumers keeps serving them: the derived value equals what the
-  code derived, so no bucket, database or login changes name. This is a change of **who says it**,
-  not of **what is said**.
-- The mesh now holds a rule in another system's alphabet — one rule, `dns`, stated once. A second
-  alphabet is a decision, not an addition: the cost of each is that the mesh must be right about
-  somebody else's naming, and that cost is only worth paying where the mesh already mints the name.
-
-## How this is checked
-
-- A served value naming an unknown fact or alphabet is refused at parse, with the list of what it
-  may say — tested on both halves of the message.
-- Resolving a consumer whose provider derives a value puts that value in the consumer's binding
-  file, in its `${bound:…}` substitutions, and in the provider's contributions entry for that
-  consumer — one test asserting the three agree, because agreeing is the whole point.
-- Two consumers of one provider on one machine get two different derived values, and neither gets
-  the other's.
-- A catalogue-wide test refuses a consumer definition that writes a literal where its provider
-  derives: the provider's `serves` names the key, so the catalogue can say which definitions
-  transcribe one.
-- `dns` is checked against the identity the mesh actually mints, not against an invented string:
-  the test derives an identity with `ConsumerIdentity` and asserts the label it becomes.
-
-## References
-
-- [issue 124 — a consumer cannot be told a value its provider derived for it](../04-ISSUES/124-a-consumer-cannot-be-told-what-its-provider-derived/00-report.md)
-- [ADR 0048 — a provider creates the credential the mesh minted, and seals nothing](0048-a-provider-creates-the-credential-the-mesh-minted.md)
-- [ADR 0049 — a consumer's identity fits the tightest backend](0049-a-consumers-identity-fits-the-tightest-backend.md)
-- [ADR 0174 — a node varies a module through settings and kept regions, never through an edit](0174-a-node-varies-a-module-through-settings-and-kept-regions-never-an-edit.md)
-- [ADR 0155 — a definition names no installation, and how that is checked](0155-a-definition-names-no-installation-and-how-that-is-checked.md)
-- [design 27 — a module requires, the mesh resolves](../03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md)

02-DECISIONS/README.md

@@ -188,7 +188,6 @@ python3 00-META/checks/index.py            fail if stale
 - **0185** — [A control plane behind its seat's row serves what it can](0185-a-control-plane-behind-its-seats-row-serves-what-it-can.md)
 - **0186** — [A ban list never holds a neighbour, and the mesh's own bans are its own wherever they hang](0186-a-ban-list-never-holds-a-neighbour.md)
 - **0187** — [A dead tracker is not the machine's failure](0187-a-dead-tracker-is-not-the-machines-failure.md)
-- **0188** — [A provider declares what it derives for each consumer, and the mesh tells both ends](0188-a-provider-declares-what-it-derives-for-each-consumer.md)
 
 ### Its tiers, from the bottom up
 
@@ -286,6 +285,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0181** — [The operator account is a node fact, and a home is a placement root](0181-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)
 - **0182** — [Inside a home, the mesh owns the directory and the files it places, writes into the tool's own files, and holds everything else as found](0182-inside-a-home-the-mesh-owns-what-it-places-and-holds-the-rest-as-found.md)
 - **0183** — [The Anthropic licence manager is a module holding a seat; it hands each node's agent its token over the bus, sealed; the controller and the host have no part](0183-the-anthropic-licence-manager-is-a-module-and-hands-tokens-to-the-agent-over-the-bus.md)
+- **0188** — [A module's own code is bundles in any language, and a tools bundle speaks MCP to the runtime](0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md)
 
 ### How it is built
 

03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md

@@ -2,7 +2,7 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller internal/catalogue]
-updated: 2026-10-02
+updated: 2026-09-30
 decisions:
   - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
   - 02-DECISIONS/0155-a-definition-names-no-installation-and-how-that-is-checked.md
@@ -14,7 +14,6 @@ decisions:
   - 02-DECISIONS/0084-which-provider-serves-a-consumer.md
   - 02-DECISIONS/0046-a-module-configuration-is-its-assignments-not-its-manifest.md
   - 02-DECISIONS/0038-the-mesh-assigns-the-port.md
-  - 02-DECISIONS/0188-a-provider-declares-what-it-derives-for-each-consumer.md
 ---
 
 # 27 — A module requires, the mesh resolves
@@ -207,22 +206,6 @@ name when nothing sets it. That is the contract half of this design's operator p
 the placeholder allows: the definition says which values reach which requirement, and nothing else
 does. *How it is checked:* the unit tests named in issue 173, and the plan comparison that closed it.
 
-*A provider says once what it derives for each consumer (2026-10-02,
-[ADR 0188](../../02-DECISIONS/0188-a-provider-declares-what-it-derives-for-each-consumer.md),
-[issue 124](../../04-ISSUES/124-a-consumer-cannot-be-told-what-its-provider-derived/00-report.md)):*
-where a provider **names the resource** it gives each consumer — a bucket, a database, a vhost — the
-name is derived per consumer, and a literal `serves` block could not carry it. A served value may
-now name the consumer the mesh is serving: `${consumer:as}`, the identity the mesh minted, and
-`${consumer:as:dns}`, that same identity written as a DNS label. Nothing else — **the mesh learns no
-protocol here; it spells its own name in an alphabet it already knows.** Settings are laid on first,
-so an operator may still set a prefix and the mesh derives the rest. The mesh fills it at the one
-moment it knows who the consumer is, and the one filled value reaches both ends: the consumer, as
-its binding's served facts and as `${bound:<provision>:<key>}` in any file it writes; the provider,
-as `derived` on that consumer's entry in its contributions file, so its provisioner is told the name
-rather than recomputing it. A consumer that writes the derived value into its own definition instead
-of asking for it is refused, naming the placeholder to use. *How it is checked:* the unit tests in
-ADR 0188's "how this is checked", each run against the unchanged controller first.
-
 ## How a definition reads what was resolved
 
 **One form, naming a requirement and a field of its contract.** A definition that needs the database's
@@ -231,9 +214,7 @@ name in a configuration file writes the same thing: the requirement's name and t
 controller fills it at resolution.
 
 This one form replaces the placeholders that exist today, one per mechanism: bound values, secrets,
-ports and machine facts. It subsumes the consumer placeholder too — a value a provider derives is
-read by the consumer exactly as any other field of the contract is, and `${consumer:…}` is only
-how the *provider* states the rule.
+ports and machine facts.
 
 **The seat placeholder stays, for the controller alone.** The controller composes its own
 declaration and reaches the store and broker it made before any module existed, so it cannot be

03-DESIGN/01-to-be/38-building-the-operators-machine.md

@@ -11,6 +11,7 @@ decisions:
   - 02-DECISIONS/0177-a-unit-may-be-user-scoped-and-the-service-manager-is-a-node-seat.md
   - 02-DECISIONS/0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md
   - 02-DECISIONS/0149-the-live-mesh-is-the-test-bed.md
+  - 02-DECISIONS/0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md
 ---
 
 # 38. Building the operator's machine
@@ -97,6 +98,19 @@ what `tools` answers, and the others serve. The runtime reads `MESH_OPERATOR_ACC
 five tools and two seat verbs answer on their subjects; `tools` names the failed bundle; a
 membership republished mid-run re-subscribes without a restart.
 
+*Built and proven 2026-10-02* (mesh-tools, branch `feat/the-operators-machine`, commit `6390d1d`).
+
+**WP1b — the launcher beside the loader** ([ADR 0188](../../02-DECISIONS/0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md)).
+*mesh-tools, mesh-sdk. A day for the skeleton.* A bundle whose entry is not JavaScript is launched
+as a child process with the runtime's environment and spoken to over MCP on stdio: `tools/list`
+once, `tools/call` per call; a tool named `<seat>.<verb>` is the seat's implementation. A child
+that exits is named as a failed bundle and restarted on the next call. The TypeScript import stays
+as the shortcut. Beside it, one skeleton SDK per language of the first set — the stdio loop and the
+tool-definition type, nothing else — each proven by one bundle in that language answering one tool
+in the runtime's test. **Proof.** The runtime's test: a bundle in a second language, launched, its
+tool answering on its subject over a real bus; the TypeScript fixture served through the protocol
+with the shortcut off answers the same.
+
 ## WP2 — The controller composes one runtime per node
 
 *mesh-controller. Two to three days; the largest package.*
@@ -111,12 +125,23 @@ membership republished mid-run re-subscribes without a restart.
    declaration gains an `archive` placed under a directory the controller derives, so the host
    fetches and unpacks it as it does any artifact. The bundle's digest is what the build recorded.
 3. **The runtime's process.** One `process` per node running the runtime from its own bundle
-   (WP3), `MESH_TOOL_MODULES` composed from the unpacked entrypoints, `MESH_OPERATOR_ACCOUNT` and
+   (WP3), `MESH_TOOL_MODULES` composed from the unpacked entrypoints — each as
+   `<module>=<path>`, and the runtime decides from the file whether it is loaded or launched
+   (WP1b) — `MESH_OPERATOR_ACCOUNT` and
    `MESH_OPERATOR_HOME` from the account fact, `restart-on` naming every bundle so a push that
    changes one restarts it. A node with no account composes the runtime without the two words.
 4. **The gate.** A manifest declaring `tools` and a container built on the runtime's base image is
    refused at registration once the runtime module is registered, naming this record. It is the
-   mechanism that keeps the old pattern from returning by habit.
+   mechanism that keeps the old pattern from returning by habit. ADR 0188 widens it, after WP4:
+   a module whose own code is an image artifact is refused, whatever image it is built on.
+
+   *Amended 2026-10-02, at WP3.* The gate refuses the pattern **spreading**, not standing: a module
+   new to the catalogue in that shape, or one that had already moved to a bundle and returns to it,
+   is refused; a module the catalogue already holds in that shape — judged from the manifest it
+   holds and what that module's newest build stood on — is rebuilt without complaint. The day the
+   runtime arrives some thirty such modules stand, each moves in its own change from WP4 on, and a
+   gate refusing every rebuild in the meantime would stop the catalogue's pipeline to make a point
+   this record already makes.
 
 **Proof.** Composition tests: a node with three assigned modules, one holding a seat, yields one
 process, three archives, one node principal whose grants are the union, and the same three
@@ -138,6 +163,16 @@ runtime's `serve` keeps answering MCP on loopback; the person's end of it keeps
 wrote, `tools/list` on loopback answers as before, and the controller's verbs answer through it.
 This is the first live step, and it is reversible by re-assigning `mesh-console`.
 
+*Decided 2026-10-02:* `mesh-tools` keeps its name as the module the TypeScript images come from, and
+`node-tools` is a second module in the same repository ([ADR 0069](../../02-DECISIONS/0069-a-module-is-a-repository-and-a-path.md))
+rather than a rename — the thirty-five manifests that build `on` `mesh-tools` stay true. Three things
+WP3 found that the plan did not say: a TypeScript bundle must carry its dependencies and a
+`package.json` naming its files as ES modules, which the toolchain now copies in from its own image;
+the runtime's credential must be owned by the account the runtime runs as, which the controller
+composes; and `MESH_TOOL_MODULES` is empty on a node where the runtime is the only bundle, which the
+runtime accepts. *Built 2026-10-02* (mesh-tools `c46f950`, mesh-controller `ca7e81e` `773b561`
+`729a5f9`); the live proof follows node by node.
+
 ## WP4 — The first holder moves: the packet filter
 
 *mesh-catalog. Half a day. The live proof of ADR 0175.*

04-ISSUES/124-a-consumer-cannot-be-told-what-its-provider-derived/00-report.md

@@ -1,9 +1,9 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-26
-located-in: [mesh-controller internal/catalogue, mesh-sdk src/provisioner, mesh-catalog modules/minio]
-fixed-by: 02-DECISIONS/0188-a-provider-declares-what-it-derives-for-each-consumer.md
-amended-design: 03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md
+located-in: [mesh-controller internal/catalogue/declaration.go, mesh-sdk src/provisioner, mesh-catalog modules/minio]
+fixed-by:
+amended-design:
 ---
 
 # 124 — A consumer cannot be told a value its provider derived for it, so it transcribes one
@@ -63,27 +63,3 @@ compares it to what the provider will actually create. The one wrong instance wa
 - What would have caught the wrong instance? A test that resolves a consumer's grant and compares the
   bucket in its own configuration against the one the provider would create is a check that could
   exist today, for any interface, without the mechanism above.
-
-## Answered, 2026-10-02 — [ADR 0188](../../02-DECISIONS/0188-a-provider-declares-what-it-derives-for-each-consumer.md)
-
-The channel is the provider's own `serves` block, which may now name the consumer the mesh is
-serving: `${consumer:as}` and `${consumer:as:dns}`. The mesh fills it once, where it knows who the
-consumer is, and delivers the one filled value to both ends — the consumer's binding and its
-`${bound:…}` substitutions, and the provider's contributions entry, so a provisioner is told the
-name rather than deriving it. Each open question above, answered:
-
-- **Should a provider return values from provisioning?** No. It would make a grant carry data the
-  provider wrote, make a consumer's declaration wait on its provider's reconcile loop, and put the
-  rule where nothing can refuse it. The reasoning is in the record.
-- **Or should `serves` say a value is derived?** Yes, and the mesh performs the derivation — but it
-  learns no protocol doing it. The only fact is the identity the mesh itself minted, in one of two
-  alphabets it already knows.
-- **Should a consumer that names the resource be refused?** Yes. A consumer's file that already
-  contains the value the mesh is about to derive for it is refused at resolution, naming the
-  placeholder to write instead. That is the check this report asked for, and it is exact rather than
-  heuristic: a derived value carries the identity minted for this consumer on this machine, which
-  nothing else would spell out.
-
-minio's `bucketFor` is gone; its manifest serves `"bucket": "${consumer:as:dns}"`. The three
-consumers' hand-written bucket names are gone with it — each of them also named the machine the
-module happens to run on, which is the second thing wrong with a transcription.