Take only acknowledgements from a desk click, and make each answer a one-time ticket

Review found that any process of the operator's account can choose a dunst action,
so a click could release or stop a delivery in the operator's name; that tokens
lived for ever; that a warning's answers died in ten seconds; and that a restarted
notifier left dead buttons (hq ADR 0258).

modules/messenger/README.md

@@ -49,14 +49,18 @@ operator can do themselves. **A warning that needs nothing is not sent**: it sta
 controller's conditions, the history says it was kept quiet, and it is said the moment it needs the
 operator (urgent at its bound, or its words now say "Needs you:"). An urgent condition is always said.
 
-**A notification offers answers** (`cmd/messenger/answers.go`): the condition's actions (Release, Stop,
-Start, Restart, Silence for a week) and Details. On the desk they are dunst's actions (a middle click on
-the notification, or its context menu); the dunst module says the chosen one as its event
-`dunst.action-chosen`, and this module calls the action's seat verb itself, with a why naming the
-operator, the channel and the label, then edits the notification to say what came of it. Details shows
-the summary, the key and since when, on the machine that asked; a line the content rule refuses is said
-withheld. A message that offers answers is never folded into a digest. Telegram shows the words but no
-buttons yet (to-be 46 phase 6).
+**A notification offers answers** (`cmd/messenger/answers.go`), limited by novox/hq ADR 0258: **a desk
+click performs only an acknowledgement**. Any process of the operator's account can choose a dunst action
+(`dunstctl action`), so a click proves nothing about who chose. Until answers are authorised (to-be 46
+phase 5) the only answers offered and performed are **Details** and **Silence for a week** (the allow-list
+`answerable`); release, stop, start and restart are said in words ("Needs you: release it, or stop it.")
+and offered as no answer. Each answer is a token made for one message of one condition: bound to the
+machines it was shown on, good for a day, used once, refused for a condition cleared or silenced, and one
+event is acted on once. A refused answer is said on the desk where it was chosen, never dropped. When the
+dunst bundle says it started (`dunst.started`), the open notifications that offer answers are shown there
+again with fresh tokens. A silence is recorded with the cause `operator-answer`, which the hand-act log
+does not count as a repair. A warning kept quiet is also said once after a day. Telegram shows the words
+but no buttons.
 
 | When | What |
 |---|---|