To-be 45 §5: say what the operator-channel holder now does about history (issue 271, ADR 0318)

PR #88 (merged 2026-10-06) already fixed the holder to read open state first,
coalesce bursts and hold a start grace minute, after a new consumer replayed a
morning's 96 settled events as fresh alerts. §5 still only said a rate cap; this
names the rules actually built, under ADR 0318.

03-DESIGN/01-to-be/45-a-core-that-cannot-fail-silently.md

@@ -2,8 +2,9 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab]
-updated: 2026-10-11
+updated: 2026-10-12
 decisions:
+  - "ADR 0318"
   - "ADR 0293"
   - "ADR 0289"
   - "ADR 0285"
@@ -375,7 +376,23 @@ section; to-be 46 §13 builds what follows from it.
   (warning); on `condition-cleared`, by editing the first message where the channel can. A silenced
   condition sends nothing. Urgent goes to both channels; warning to the desktop notifier when the
   operator's session is there, otherwise to Telegram.
+  *Amended 2026-10-12, ADR 0318:* **history is never news.** On start, every ten minutes, and at once
+  when an event older than its last reading arrives, the holder reads the open conditions from the
+  controller and takes them as its state; an event is acted on only when it is newer than that reading
+  (five seconds of clock slack) and its own `at` is no more than ten minutes old — otherwise it is
+  recorded as state and never said. A condition open in the holder's state but absent from the
+  controller's open set ended while the holder was away, and is closed quietly: edited where a channel
+  can, never sent to wake a desktop. A clearing of something never said says nothing, and a message
+  still waiting is dropped the moment its clearing is read. Every urgent condition a reading finds open
+  and unsaid is said once, together, naming all of them. A grace minute follows every start or
+  reassignment: nothing is sent in it except that one message.
 - **Rate:** at most twenty messages an hour; the excess is folded into one message naming them all.
+  *Amended 2026-10-12, ADR 0318:* a channel holds what it has to say for thirty seconds from the first
+  item and sends it together — alone as itself, several as one digest, one line each; an urgent item
+  breaks a thirty-second quiet at once. The desktop keeps a gentler rhythm than Telegram: a warning
+  reaches it at most once every fifteen minutes, never an urgent one. Reaching the cap is said once, in
+  its own message, and what it holds back waits for the next digest the hour allows, rather than one
+  message per excess item.
 - **What may leave the mesh:** roles and words. A message carrying an address, a path or anything
   shaped like a secret is refused by the holder and raises `channel-refused` instead.
   *Amended:* the mesh's own machine names may appear too; a concrete detail travels as a reference only