messenger: approve only on the controller's recent word that root is free, and close the review's gaps (hq ADR 0259)

The review of 2026-10-09: the router read the absence of an agent-root condition as a pass, and its minute
hung on a break-glass file, taking the work it already held. An approval now rests on the controller's
verb root-free, asked live for the router's machine and the channel's, failing closed on every other
answer, and a stale word on the kinds promises no verified sender. Break-glass runs in the minute, says
on every channel what root did, and ends the router's own open questions. An ask offering an approval is
answered only where it could be approved; a message says who asks, what each answer does and what expiry
does. The router's own asks bind the account they are about; a link is checked against one per kind as it
is made; an unlinked account does not come back by a code within a day; a fresh link is unlinked from the
desk; no link begins while the desk cannot show its code, and a code is marked secret on every path. Links
are bounded per account in the router's state; a warrant's message id cannot be foreseen. Moves to
mesh-sdk 76902998 (canonical digests).

modules/messenger/README.md

@@ -38,17 +38,32 @@ channel's client and no channel's secret.
 - **An ask never defaults**: at its expiry it ends `expired` and its asker does what it said it would.
 - **Linking** (`/start` to the bot): a six-digit code is shown, with the account's name and number, on a
   channel whose words stay private (the desk) for ten minutes; the operator sends it to the bot, and the
-  account is linked. It acknowledges at once and approves after an hour. At most three links are asked of a
-  kind in an hour. Every link and unlink is said on every channel.
+  account is linked. It acknowledges at once and approves after an hour. **The code is shown now or never**:
+  while the desk cannot show it (its notifications paused, nobody there), no link is begun and no code waits
+  in a queue. At most three links an hour per account, and ten per kind, counted in the router's state. Every
+  link and unlink is said on every channel. An account unlinked less than a day ago is not linked again by a
+  code; one account per kind is checked again as a link is made.
 - **Unlinking is asked of the account that is linked** (`messenger_unlink` asks it): an approve question put
   to that account alone. Its approval unlinks it, told to it first, by name, then everywhere. **A link within
-  a day of an unlink waits for the replaced account's approval**, asked of it by name.
+  a day of an unlink waits for the replaced account's approval**, asked of it by name. Each unlink or relink
+  question binds the account it is about, so its approval never acts on another account linked meanwhile.
+  **An account still in its first hour**, which cannot approve yet, is unlinked from the desk: when another
+  account sends `/start`, the desk is asked whether to unlink it.
 - **When that account is lost with its phone**, root at the router's machine leaves a file in this module's
-  state directory — `unlink.<kind>`, or `allow-link.<kind>` for a link that waits — and the router does it,
-  announced as done at the machine. A file not made by root is refused and said.
+  state directory — `unlink.<kind>`, or `allow-link.<kind>` for a link that waits, a regular file owned by
+  uid 0 — and the router does it within the minute, said on every channel with what was done, and every open
+  question of the router's own ends. A file not made by root is refused and said.
 - **A channel proving its sender says only to the linked account**: none linked, it is not ready, and asks
-  for approval are not offered on it. While the controller says an agent can become root without a person
-  where the router or the channel runs (`agent-root`), no approval is offered or taken there.
+  for approval are not offered on it. **An approval rests on the controller's positive word**, asked of its
+  verb `root-free` for the router's machine and the channel's, live when an answer arrives (a word at most
+  30 s old renders the buttons): only a machine it says is free carries an approval. A router that does not
+  know its machine, a controller that does not answer, a machine its answer leaves out, or a word on the
+  channel kinds older than two minutes all fail closed.
+- **An ask that offers an approval is answered only where it could be approved**, whichever option is
+  chosen: the desk, which proves nothing of who clicked, is not offered it, and an acknowledgement from a
+  fresh link does not end it. An asker wanting an acknowledgement at the desk asks it alone.
+- **Each ask's message says who asks** (as the bus names it), what each answer does, and what happens if
+  nobody answers. A warrant is published under a message id nobody can foresee.
 - **The router runs as its own account `messenger`, on a bus account of its own**, never carried by the
   machine's runtime (ADR 0259 §8): its state and its bus credential are that account's.