mesh-knowledge: review every proposal in a judgement of its own, and serve no review verb (hq issue 425, ADR 0290 as updated)

The mesh proves which machine called, not which agent on it (hq issue 365), so a review verb could not tell a
reviewer from the author. Each version proposed is now judged by claude-code.claude_code_judge in a separate
call that sees only the record, the records it links and the rules: approve accepts (or asks the operator for a
needs-operator record), changes keeps it proposed with the findings for its author, and a judgement that cannot
be had or read leaves it proposed, says so, and never counts as approval.

modules/mesh-knowledge/README.md

@@ -8,8 +8,8 @@ it makes, with its own status and source. Every version of every record is kept,
 
 An agent asks what holds and gets the clauses in force, the records they come from, what changed them since, and
 how to read the reasoning, all in one call under 4 KiB. A record is proposed and checked when it is written, then
-reviewed by someone who did not write it, then accepted. When its author says it needs the operator, it is
-accepted only on the operator's Approve, given on a channel that proves who answered.
+reviewed by the knowledge base itself, in a judgement of its own, then accepted. When its author says it needs the
+operator, it is accepted only on the operator's Approve, given on a channel that proves who answered.
 
 ## The verbs (seat `knowledge-base`)
 
@@ -21,8 +21,7 @@ accepted only on the operator's Approve, given on a channel that proves who answ
 | `links` | `number`, `kind` | the record's typed links, out and in |
 | `history` | `number`, `kind`, `from`, `to`, `bound` | every version; with `from` and `to`, the difference between the two, line by line |
 | `reserve` | `kind`, `for` | the next decision or research number, asked of the issue tracker (`issue-tracker.reserve`); spent whether or not its record is accepted |
-| `propose` | the record whole | proposed, or refused naming every rule it breaks; an accepted record changes only by a progressive insight (`insight`) |
-| `review` | `number`, `verdict` (approve or changes), `findings` | accepted, asked of the operator, or kept proposed with the findings |
+| `propose` | the record whole | proposed, or refused naming every rule it breaks; an accepted record changes only by a progressive insight (`insight`). Each version proposed is then reviewed by the knowledge base itself (below) |
 | `import` | `dry-run`, `commit` | hq's decision records and research efforts at the commit the records module stands at, each whole at its own number |
 | `return` | `number`, `reason` | drafted clauses sent back to be drafted again |
 
@@ -39,11 +38,11 @@ The rules about callers:
 
 - A proposal is revised only by its author, as the runtime proves them.
 - A number reserved by a proven caller is proposed only by that caller.
-- A review is refused from anyone who wrote any version of the record.
-- A review is refused for a record that has a version whose writer was unproven: who wrote it cannot be told
-  from who reviews it, so its author proposes it again under a new number.
+- A record that has a version whose writer was unproven is never reviewed, and so never accepted: who wrote it
+  cannot be told, and no one revises it, so its author proposes it again under a new number.
 
-Until the runtime proves callers, **every review is refused**.
+No agent reviews a record: the mesh proves which machine called, not which agent on it (hq issue 365), so the
+review is the knowledge base's own (ADR 0290 rule 4).
 
 ## What a record holds
 
@@ -84,10 +83,21 @@ record it goes out from.
    A progressive insight keeps its record's date, so a correction to an older record is not refused by a rule
    that never held it, and it keeps the links the accepted record holds. A new record is dated no earlier than the day its number was reserved.
 3. Revise it by proposing again; every version is kept.
-4. A `review` by someone else either approves it or asks for changes. On approve the record and its clauses are
-   accepted and in force. Every clause it changes moves to `changed`, and every record it supersedes moves to
-   `superseded`, each as a new version of that record. A record marked `needs-operator` is first asked of the
-   operator: an ask with Approve and Decline, both at the level approve, each bound to this version's digest. It is
+4. The knowledge base reviews every version proposed itself. It asks the agent module's judge
+   (`claude-code.claude_code_judge` on this node) one question, in a separate call with no tools, that holds only
+   the record, the records it links and the rules, and answers `approve` or `changes` with findings. The background
+   work asks it at once, before the next step of any drafting, one judgement at a time.
+   - On `changes` the record stays proposed, the findings kept with the version they judged (`get` shows them).
+     Its author revises it by proposing it again, and that version is reviewed again.
+   - A judgement that cannot be had (the judge unreachable, or an answer that is not `approve`, or `changes` naming
+     no finding) leaves the record proposed and says so on it (`get`'s `review`). It is never taken as an
+     approval. It is asked again after 10, then 20 minutes; after 3 tries the record says its author proposes it
+     again to have it reviewed again.
+   - A record revised while it is judged is not decided on the version judged; the newest is judged next.
+   - On approve the record and its clauses are accepted and in force. Every clause it changes moves to
+     `changed`, and every record it supersedes moves to `superseded`, each as a new version of that record. A record marked `needs-operator` is first asked of the
+   operator (an ask that cannot be published is taken back, and the record is reviewed again later): an ask with
+   Approve and Decline, both at the level approve, each bound to this version's digest. It is
    accepted only on the router's warrant for Approve, read back from the router's own record and held to the ask
    composed again. A record changed after it was asked finds the digests differ, and nothing is accepted. The
    warrant is kept with the record.
@@ -127,8 +137,9 @@ the consolidated schema for a fresh database is `schema.sql`. A test holds the t
 
 ## Its processes
 
-- **the bundle**: the verbs, `knowledge_health`, the operator's answers heard, and once a minute the router's
-  record read, reservations never proposed withdrawn, and the drafting worker. It never changes the schema, and
+- **the bundle**: the verbs, `knowledge_health`, the operator's answers heard, and once a minute (and at once when
+  a record is proposed) the router's record read, reservations never proposed withdrawn, the reviews of proposals,
+  and the drafting worker. It never changes the schema, and
   refuses to serve while the schema is behind.
 - **`prepare`** (run once): brings the schema to this version.
 - **`keep`** (judged by its unit): judges the whole record set every five minutes and keeps the findings.
@@ -141,7 +152,7 @@ the consolidated schema for a fresh database is `schema.sql`. A test holds the t
 
 | Setting | Default | What it does |
 |---|---|---|
-| `judge-model` | `sonnet` | the model the drafting and confirming judgements ask |
+| `judge-model` | `sonnet` | the model the review, drafting and confirming judgements ask |
 | `drafting` | `on` | `off` stops drafting and confirming clauses |
 | `reserved-for` | `168h` | how long a reserved number waits for its proposal before it is withdrawn |
 
@@ -149,8 +160,9 @@ the consolidated schema for a fresh database is `schema.sql`. A test holds the t
 
 - assignment to the control-node, and a postgres provider for its `postgres-database` provision;
 - the issue tracker serving `issue-tracker.reserve` (hq issue 424, merged as mesh-catalog#204) on the mesh;
-- the runtime proving the caller (hq issue 365: mesh-tools#27 and mesh-controller#224 delivered) before any review
-  is taken;
+- the runtime proving the caller (hq issue 365: mesh-tools#27 and mesh-controller#224 delivered), or every
+  proposal stays unreviewed;
+- the agent module on the control-node holding a licence, or every review waits and says so;
 - the import run once, then checked against hq record by record (hq issue 426).
 
 ## Tests