Take only acknowledgements from a desk click, and make each answer a one-time ticket

Review found that any process of the operator's account can choose a dunst action,
so a click could release or stop a delivery in the operator's name; that tokens
lived for ever; that a warning's answers died in ten seconds; and that a restarted
notifier left dead buttons (hq ADR 0258).

modules/messenger/cmd/messenger/sync.go

@@ -57,12 +57,14 @@ func (h *Holder) Sync(open []Condition, asked time.Time) SyncResult {
 		old := h.open[c.Key]
 		var r *Record
 		known := old != nil
+		wasQuiet := false
 		switch {
 		case old != nil && old.Seen.After(asked):
 			h.mu.Unlock()
 			res.Skipped = append(res.Skipped, c.Key)
 			continue
 		case old != nil:
+			wasQuiet = needsNothing(old) && !old.told()
 			if !old.Cleared.IsZero() {
 				// Ended here, open there: back to open, quietly — the reading is not an event.
 				old.Cleared = time.Time{}
@@ -98,6 +100,9 @@ func (h *Holder) Sync(open []Condition, asked time.Time) SyncResult {
 			urgent = append(urgent, r)
 		case !known && now.Sub(r.Raised) <= FreshFor:
 			fresh = append(fresh, r)
+		case wasQuiet && !needsNothing(r):
+			// Kept quiet as needing nothing; its words now need the operator (ADR 0258).
+			fresh = append(fresh, r)
 		default:
 			res.State = append(res.State, r.Key)
 		}