CAT-C10, CAT-V1: the modules' readmes say the rename, the retirement and retire

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-config/README.md

@@ -56,6 +56,26 @@ value as a set does, keeps who approved it beside the value (`approved`), and as
 warrant in its hand-act log. A Decline, an expiry or the router's refusal sets nothing. `action` `proposals` lists
 them, newest first; with `proposal`, one read whole, with whether the router's ask is the one composed from it.
 
+## A value renamed, a value no longer read (design 32, novox/hq ADR 0609)
+
+- A declaration's `renamed-from` moves the value set under the old name to the new one on each node, with its trust (it
+  moves whole, and a trusted new name over a value set without the Approve is refused), saying `renamed`
+  (module, from, to, at) once. A **rename window** opens per node and keeps the old name answering the new value in
+  `mesh-config_resolved` until that node's node-engine runs a build that reads the new name: judged at start, on the
+  status view's `delivered`, and for a returning node-engine on the node-engine seat's `manifest-reads-changed` after
+  `manifest-reads` answers (one that does not serve it states nothing, and its window stays open). State `renames`.
+- The seat verb `renames` answers the open renames and the nodes holding each open (the checker asks it); the tools
+  `config_renames` (all, with the closed windows), `config_rename_again` (move by hand after a refusal) and
+  `config_rename_close` (drop a node by hand, a hand act).
+- On the indexer's `manifest-accepted` it asks the indexer's `indexer_config_readers`; an indexer that does not serve
+  it answers "not known" and nothing retires. A value (or secret) nobody reads is **retiring** once no node runs a
+  build that reads it: `retiring` is said and the operator is asked once; the value is removed only on the Approve
+  (a secret through the seat mesh-vault's `retire`, with a hand act naming node, module, name and ask), `retired`
+  said per node. State `retiring`; the tool `config_retiring` lists, asks again and cancels.
+- Findings (state `findings`, read by the condition keeper): `rename-refused`, `rename-window-held` and
+  `retirement-held` (seven days, naming the node), `retiring-unanswered` (asked twice).
+- The events `renamed`, `retiring` and `retired` are carried by the stream `config-events`, kept seven days.
+
 ## Files it does not know
 
 Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).

modules/mesh-vault/README.md

@@ -229,6 +229,15 @@ restart; it is on until switched off, and `own_drift` shows it.
 - `provisioner.retirement` (ADR 0230 §35) — `waiting`, `settled`, `approved`, `rejected`, `retired`,
   `reenabled`, `deleted`, naming holders, never a value.
 
+## Retiring an own secret: `retire` (design 32)
+
+`retire` removes one module's own secret on a node because no manifest reads it any more, and says `own-retired`
+(node, module, name, ask, caller). Two proofs: the caller is on the vault's trusted list `retire-callers` (the holder of
+the seat `mesh-config` alone, a file the mesh writes from the config value, read at start; a list that cannot be read
+allows nobody), and `warrant` is the id of a hand act that caller recorded through `mesh-hand-acts` for this verb,
+naming exactly the node, module, name and the ask of the operator's Approve, within a day. A bus account and the tool
+runner's `ledgers` are never retired this way. A waiter on `rotated` or `own-replaced` does not wake on it.
+
 ## The tools
 
 `secret_export`, `secret_holders`, `secret_verify` answer as the TypeScript vault's did, and its custody