give: never take a trusted party's secret at a desk, and announce it before it is kept (hq ADR 0259 §10, the confirmation review's N1-give)

A desk's prompt is answered over the desk machine's bus, on a subject that machine's runtime answers;
on a desk machine agents run as the operator, who holds that credential, so an agent could answer first
with a bot token of its own sealed to the call's key. The secret of a module running as an account of
its own (the Telegram bot's token) is now refused at the desk, before anybody is asked, naming the line
to type at the controller's terminal; there it is announced on every channel, the old one among them,
before it is kept, and not kept when that announcement fails. What is typed at the terminal is not
echoed. Tests: the refusal with nobody asked, and only the desk machine's launcher may answer its
prompt (MaySubscribe).

cmd/mesh-controller/secret.go

@@ -108,12 +108,27 @@ func secretCommand(ctx context.Context, args []string) error {
 		fmt.Printf("  run `push %s` and `push %s` to send it\n", *provider, node)
 		return nil
 	}
+	// A trusted party's secret is announced before it is kept (the confirmation review of 2026-10-09, N1-give):
+	// on every channel, the one it replaces among them, which still runs on its old value until the next push.
+	// Not announced, it is not kept: a channel whose token changed unheard of answers for somebody else.
+	trusted, err := open.inventory.RunsAsItsOwnAccount(ctx, module)
+	if err != nil {
+		return err
+	}
+	if trusted {
+		if err := announceSecretGiven(ctx, node, module, name, "at the controller's terminal"); err != nil {
+			return fmt.Errorf("%s runs as an account of its own, and the change of its %s could not be announced on "+
+				"your channels first, so nothing was kept: %w", module, name, err)
+		}
+	}
 	untilStart, err := open.inventory.AcceptGivenSecret(ctx, node, module, name, value)
 	if err != nil {
 		return err
 	}
-	if err := announceSecretGiven(ctx, node, module, name, "at the controller's terminal"); err != nil {
-		fmt.Printf("  this change could NOT be announced on the operator's channels: %v\n", err)
+	if !trusted {
+		if err := announceSecretGiven(ctx, node, module, name, "at the controller's terminal"); err != nil {
+			fmt.Printf("  this change could NOT be announced on the operator's channels: %v\n", err)
+		}
 	}
 	// Not printed back, and there is nowhere it could be printed from: it is sealed to that
 	// machine and the mesh cannot read it again.
@@ -387,6 +402,8 @@ func valueFor(node, module, name, from string) (string, error) {
 		fmt.Fprintf(os.Stderr,
 			"reading %s's %q for %s from standard input; it is not echoed anywhere\n",
 			module, name, node)
+		// At a terminal, what is typed is not shown either: echo off while it is read.
+		defer hideTyping(os.Stdin)()
 		line, err := bufio.NewReader(os.Stdin).ReadString('\n')
 		if err != nil && line == "" {
 			return "", fmt.Errorf("nothing was given on standard input: %w", err)