Distribution and the forge hold their caller list from its config watch, not an ask per call (issue 1966)

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

modules/distribution/cmd/distribution-tools/contract_test.go

@@ -57,7 +57,7 @@ func TestTheVerbsSpeakTheSeatsContract(t *testing.T) {
 			t.Errorf("%s's body %s is not the contract's: %v", event, b, err)
 		}
 	}
-	// The caller list is read on each call: one that cannot be read answers no verb, and registry_callers says it as read.
+	// The caller list is read held: one never read answers no verb, and registry_callers says it as read.
 	unread := func() (holder.Callers, error) { return nil, errors.New("config refused") }
 	for _, tool := range tools(&holder.Verbs{}, kept[holder.Window]{}, unread) {
 		if tool.Name == holder.ImageSeat+"."+holder.VerbVersions {

modules/distribution/cmd/distribution-tools/main.go

@@ -248,7 +248,7 @@ func arg[T any](args map[string]any) (T, error) {
 
 func str(args map[string]any, k string) string { s, _ := args[k].(string); return strings.TrimSpace(s) }
 
-// tools are distribution's tools over v; each call that checks a caller reads the caller list on that call (callers:
+// tools are distribution's tools over v; each call that checks a caller reads the caller list held (callers:
 // the config value as mesh-config resolves it now), so an operator's change of it holds from the next call on.
 func tools(v *holder.Verbs, windows kept[holder.Window], callers func() (holder.Callers, error)) []stdio.Tool {
 	now := func() (*holder.Verbs, error) {