The desk as a channel of the operator's conversation: kind desktop of the channel and intake benches the router (messenger) declares (novox/hq ADR 0258, ADR 0259). It shows the router's messages on the notifier of each machine the operator sits at (the node-notifier seat), and says which button was chosen there.

It proves nothing about who clicked. Any process of the operator's account can choose a notification's action (dunstctl action), so its claim declares no verified-sender: the router offers here only acknowledgements (Silence for a week, Details) and says in the words where an approval can be given.
An answer is taken only on a machine its message was shown on, and once; a refused click is said where it was made. A message with buttons stays until it is dismissed.
A notifier that started again (dunst.started) is shown again every open message with buttons it showed.
A message no machine took is said to the router as failed; the router tries it again.

What the operator gives

The machines to show on, as a setting: settings for desk-channel with {"desktop-machines": ["<the machine the operator sits at>", …]}. Until then it says it cannot send, and the router sends warnings to the channel that reaches the operator away.

Where it runs

Held once for the mesh, on the same machine as the router, which is where it is assigned. It runs as the account desk-channel, in a runtime of its own, on a bus account of its own (runs-as), as telegram does: what it shows and the answers it says are out of reach of the operator's account, which agents run as. It asks each machine's notifier through the mesh: nothing new runs on the machines.

A link's code (the review of 2026-10-09)

It is shown only where it is seen. Each machine's notifier says whether it is paused (dunst.paused, at least every two minutes). A message the router marks secret is shown only on a named machine heard unpaused in the last five minutes; while there is none, it is said to the router as failed and the desk says it cannot send, so the router starts no link. A code held by a paused notifier would appear later, to whoever is at the screen then.
It is kept nowhere. Not in this module's state, and sent secret to the notifier, which sends it transient in the category mesh.secret: dunst's rules keep it out of its history, and node-notifier.history, which every caller of the mesh's verbs may read, leaves it out.
What remains: while it is on screen, a program of the operator's account on that X display can read it (X11 isolates no client from another). It is shown for as long as the router's code lives.

Tools

tool	does
`desk_channel_status`	whether it can show messages, the machines and each one's last answer, and its rules