Keep no secret-shaped question, and hold the two-question cap across nodes (issue 589, review 105)

A question was kept on the bus before the router judged its words, so a token in
it reached a bucket every node reads: every word, the options' too, is now held
to the secret shapes and invisible characters before anything is kept, and a
refused question keeps none of its words. The cap was check-then-create and
failed open: each open question now holds one of two slot keys taken by create
or compare-and-set, refusing when a slot cannot be read. A question the router
never recorded frees its slot after two minutes instead of at expiry. by is
required; wording matches ADR 0332.

modules/claude-code/README.md

@@ -68,7 +68,7 @@ must see, a node that joins later included — kept, so it carries no secret eit
 | what this node should hold | the licence manager's `bindings` state, this node's key; on a newer generation this module asks `anthropic-licence-manager.current` for its token, sealed to the key it sends, and writes it access-token-only — so the agent here never refreshes. A node that was off reads its key when it is back |
 | an MCP server registered through this module before registering was refused (hq issue 340) | a key in the module's `servers` state — `all.<server>` for every node, `<node>.<server>` for one; every node watches it and renders what applies to it, a node's own entry over the one for every node. A node that joins later, or was off, reads the whole current set at start; unregistering is a delete. Nothing adds a key any more: a new tool server is the operator's, in the `mcp_servers` setting at the controller's terminal |
 | a proposed instruction section (hq ADR 0274) | a key in the module's `proposals` state per proposal, the ask published on `operator-channel` under this module's name, and the router's record of it read under that name alone; what a node approved is its own file, never the bus |
-| a session's question to the operator (hq ADR 0332) | a key `q-…` in the module's `questions` state per question, the ask published on `operator-channel` under this module's name, and the router's record of it read under that name alone; the router's word that it ended without a choice is kept on the question |
+| a session's question to the operator (hq ADR 0332) | a key `q-…` in the module's `questions` state per question, the ask published on `operator-channel` under this module's name, and the router's record of it read under that name alone; the router's word that it ended without a choice is kept on the question; two slot keys `slot-1`, `slot-2` name the questions open |
 | the agent's configuration (hq ADR 0216) | a key in the module's `config` state per registration — `mesh.<kind>.<name>` for every node, `node.<node>.<kind>.<name>` for one, `home.<node>.<kind>.<name>` for one account's own directory — the item and its files in one value, at most 256 KiB. Every node watches it and renders what applies to it, a node item over a mesh item of the same kind and name. A hook, settings, or an item that would run something by itself is never taken, whenever it was put there (hq issue 340) |
 
 ## The mesh's tools first (hq ADR 0245)
@@ -164,17 +164,22 @@ router's record. The text is never logged.
 **A session asks the operator a question on Telegram** (hq ADR 0332, issue 589). An agent that needs a decision while
 the operator may be away from the terminal calls `claude_code_ask` with a headline, the context in plain words, two to
 four options (a label and what choosing it means, exactly one recommended, with why), what it does if nobody
-answers, its name as who@node, and an expiry of 5 to 1430 minutes (60 when absent). The ask is published under this
+answers, its name as who@node (required), and an expiry of 5 to 1430 minutes (60 when absent). The ask is published under this
 module's name on `operator-channel`; every option is at the level approve and binds the digest of the question and of
-itself, so only a channel that proves who answered (Telegram) carries it, never the desk. The tool waits a few seconds
-for the router's word and answers with the question's key, or the router's refusal (the content rule: no path,
+itself, so only a channel that proves who answered (Telegram) carries it, never the desk. Anything shaped like a
+secret, or a character a phone does not show, in any of its words is refused before anything is kept. The tool waits
+a few seconds for the router's word and answers within seconds with the question's key, or the router's refusal (the content rule: no path,
 address, host name, commit id or secret's shape; `messenger_check` tests words first). `claude_code_answer` with the
 key says waiting, chosen (the option, who answered, on which channel, when), ended without a choice (expired,
 refused, cancelled, replaced), or not proven: the answer is read from the router's own record and held to the
 question as `questions` keeps it, so a question rewritten after it was asked, a warrant for another ask or a choice
-after expiry is never read as a choice. One call waits at most 60 s; a session reads a question at most once a
-minute. At most two questions wait at once, mesh-wide, so they never take the module's last open ask from a
-proposal. An answer is the operator's word to the session and authorises nothing; a question never defaults.
+after expiry is never read as a choice. One call waits at most 60 s; the tool asks a session to read a question at
+most once a minute, and nothing enforces it. At most two questions wait at once, mesh-wide: each holds one of two
+slot keys in `questions`, taken by create or compare-and-set, so two nodes asking at once cannot both take the last,
+and a slot that cannot be read refuses the question. Questions alone never fill the router's three open asks, so one
+is left for a proposed instruction section while two are open. A question the router holds no record of two minutes
+after it was asked (its refusal not heard here) frees its slot and reads as ended. A refused question keeps none of
+its words. An answer is the operator's word to the session and authorises nothing; a question never defaults.
 
 The home scope is registered through the tools **only where the home belongs to an agent account of its own**
 (hq ADR 0266, issue 340), and only for the node whose module serves the call. Where the agent runs as the operator,