Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

- M1: a condition offering both kinds of answer is asked twice: its authorising answers about the
  condition, its acknowledging ones (Silence) apart, so an answer from a channel that only acknowledges
  never ends an approval.
- L2: the asked store creates once and changes only over the revision it read, deciding again on what it
  reads; a stale cancel no longer writes over an act.
- L3: every ask is kept before it is published, one whose publishing failed is marked unsent and asked
  again, and a cancel is kept before it is said. The terminal's test question is now `rehearse`, so it is
  not called what the glossary calls a drill; its two answers are both approve-level.
- L7: two deliveries of one warrant to two controllers at once act exactly once, on a real bus.
- Re-vendored onto mesh-sdk 76902998 (canonical digests): an option binds an asks.Act with each argument
  as arg.<name>.
- The lab's bus fixture composes verified-sender only where the lab says its machine is root-free
  (MESH_LAB_ASKS_ROOT_FREE=true).

cmd/mesh-controller/asker_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -19,24 +20,40 @@ import (
 
 type memAskedStore map[string]asked
 
+// memAskedMu guards every memAskedStore: Change is a compare-and-set as the bus's is.
+var memAskedMu sync.Mutex
+
 func (m memAskedStore) Get(_ context.Context, id string) (*asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
 	r, ok := m[id]
 	if !ok {
 		return nil, nil
 	}
 	return &r, nil
 }
-func (m memAskedStore) Put(_ context.Context, r asked) error { m[r.ID] = r; return nil }
-func (m memAskedStore) Claim(_ context.Context, id string, w asks.Warrant) (bool, error) {
+func (m memAskedStore) Create(_ context.Context, r asked) error {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
+	if _, kept := m[r.ID]; kept {
+		return errors.New("an ask is kept under that id")
+	}
+	m[r.ID] = r
+	return nil
+}
+func (m memAskedStore) Change(_ context.Context, id string, change func(*asked) bool) (bool, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
 	r, ok := m[id]
-	if !ok || r.State != askOpen || r.Acted != "" {
+	if !ok || !change(&r) {
 		return false, nil
 	}
-	r.State, r.Warrant, r.Acted = string(asks.OutcomeChosen), &w, "acting"
 	m[id] = r
 	return true, nil
 }
 func (m memAskedStore) All(context.Context) ([]asked, error) {
+	memAskedMu.Lock()
+	defer memAskedMu.Unlock()
 	var out []asked
 	for _, r := range m {
 		out = append(out, r)
@@ -437,7 +454,7 @@ func TestTheAskDropsWhereItIsAnsweredAndTheConditionKeepsIt(t *testing.T) {
 	if !strings.Contains(c.Explanation, FromMeshMCPServer) {
 		t.Fatalf("the condition lost where it is answered: %q", c.Explanation)
 	}
-	q, _ := askOf("x", c, time.Now())
+	q, _ := askOf("x", c, partsOf(c)[0], time.Now())
 	if strings.Contains(q.Explanation, "mesh MCP server") || !strings.HasPrefix(q.Explanation, "Needs you: release it, or stop it.") {
 		t.Errorf("the ask says %q", q.Explanation)
 	}
@@ -507,7 +524,7 @@ func TestAWarrantPerformsOnlyTheActItsOptionBound(t *testing.T) {
 		})
 	}
 	// Every option of an ask binds its act.
-	q, _ := askOf("x", heldCondition(), time.Now())
+	q, _ := askOf("x", heldCondition(), partsOf(heldCondition())[0], time.Now())
 	for _, o := range q.Options {
 		if o.Binds == "" {
 			t.Errorf("the option %s binds nothing", o.ID)
@@ -563,3 +580,65 @@ func TestAnAskThatCannotBeDeliveredIsSaid(t *testing.T) {
 		t.Errorf("nothing needs asking, and still said: %+v", got)
 	}
 }
+
+// The review of 2026-10-09 (M1): an acknowledging answer never shares an ask with an authorising one. A
+// condition offering Restart and Silence is asked twice — Restart alone, about the condition, and Silence
+// alone, apart — so Silence chosen on a channel that only acknowledges leaves the Restart ask open.
+func TestAnAcknowledgementNeverSharesAnAskWithAnApproval(t *testing.T) {
+	r := newAskerRig(t)
+	key := "module.shanks.plex.down"
+	c := conditions.Condition{Key: key, Kind: "module-down", Severity: conditions.Urgent, Headline: "Plex down on shanks",
+		Explanation: "Needs you: restart it, or silence this.", Needs: "restart it, or silence this.",
+		Actions: []conditions.Action{
+			{Label: "Restart", Verb: "node-service-manager.restart", Machine: "shanks", Level: conditions.LevelApprove,
+				Arguments: map[string]string{"unit": "plex"}},
+			conditions.SilenceAction(key)}}
+	r.open = []conditions.Condition{c}
+	if err := r.a.reconcile(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	sent := r.asksSent(t)
+	if len(sent) != 2 {
+		t.Fatalf("asked %d time(s): %+v", len(sent), sent)
+	}
+	for _, q := range sent {
+		if err := q.Check(r.now); err != nil {
+			t.Errorf("%s: %v", q.About, err)
+		}
+		levels := map[asks.Level]bool{}
+		for _, o := range q.Options {
+			levels[o.Level] = true
+		}
+		if len(levels) != 1 {
+			t.Errorf("the ask about %s mixes levels: %+v", q.About, q.Options)
+		}
+	}
+	byAbout := map[string]asks.Ask{}
+	for _, q := range sent {
+		byAbout[q.About] = q
+	}
+	if q := byAbout[key]; len(q.Options) != 1 || q.Options[0].Label != "Restart" {
+		t.Errorf("the condition's own ask: %+v", q)
+	}
+	if q := byAbout[key+".acknowledge"]; len(q.Options) != 1 || q.Options[0].Level != asks.Acknowledge {
+		t.Errorf("the acknowledging ask: %+v", q)
+	}
+	// Silence chosen: performed, and the Restart ask stays open, never asked twice.
+	answerWith(t, r, r.warrantFor(t, key, "Silence for a week"))
+	if len(r.silenced) != 1 || len(r.called) != 0 {
+		t.Fatalf("silenced %v called %v", r.silenced, r.called)
+	}
+	_ = r.a.reconcile(context.Background())
+	open := 0
+	for _, a := range r.store {
+		if a.State == askOpen && a.Condition == key {
+			open++
+			if a.Part != "" || a.Ask.Options[0].Label != "Restart" {
+				t.Errorf("the open ask is %+v", a)
+			}
+		}
+	}
+	if open != 1 || len(r.asksSent(t)) != 2 {
+		t.Errorf("after the silence: %d open, %d asked", open, len(r.asksSent(t)))
+	}
+}