A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

Issue 339 made every trusted setting the controller's terminal's alone, so an agent could only hand the
operator a line to type at the control node. Now anyone the bus admits may PROPOSE a layer: settings
propose keeps the proposal in the controller's own asks (the asked bucket, which the controller alone
writes), judged as settings set judges, and asks the operator on the operator channel at the level
approve with every key, its exact new value (in its shape where a path or an address may not leave the
mesh), the was of a changed key, the removed keys and the layer's fingerprint. The serving controller
sets the layer on the warrant alone: once, for the ask it holds, only when the record's values still
digest to what the option bound and the layer is still the one shown, with the terminal's judgement and
history, and keeps who approved it beside the layer, which settings says back (migration 0090). Decline,
expiry, a cancel, a replacement or the router's refusal discard it; nothing is asked when no router, no
grant or no channel can carry it. settings proposals lists them. The push afterwards is a separate act.

cmd/mesh-controller/seatverbs.go

@@ -260,10 +260,10 @@ func refusedAsTheGenericCommand(argv []string) error {
 	// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
 	// settings verb is where what a verb may not set is refused, and one route is one set of words.
 	// The command refuses places and accesses through any verb as well; this says so before it runs.
-	if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
-		return &heldAtTheTerminal{msg: "settings are set and cleared through the settings verb, not the " +
-			"generic command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
-			"Nothing was done"}
+	if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" || w == "propose" }) {
+		return &heldAtTheTerminal{msg: "settings are set, cleared and proposed through the settings verb, not the " +
+			"generic command; and places and accesses are set at the controller's terminal or on the operator's " +
+			"warrant (novox/hq issue 339, ADR 0277). Nothing was done"}
 	}
 	// The generic verb only reads (novox/hq ADR 0266): what writes has a named verb that composes its own
 	// line, or is the operator's at the controller's terminal.
@@ -835,6 +835,21 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		if str("module") == "" && on("clear") {
 			return nil, errors.New("settings: a module is needed to clear a layer; name it with module")
 		}
+		// The proposals, listed or one whole (novox/hq ADR 0277): a read, needing no module.
+		if on("proposals") || str("proposal") != "" {
+			if str("module") != "" || str("values") != "" || str("node") != "" || on("clear") || on("replace") ||
+				on("history") || str("list") != "" || on("propose") || (on("proposals") && str("proposal") != "") {
+				return nil, errors.New("settings: proposals lists what was proposed and proposal shows one; either takes nothing else")
+			}
+			argv := []string{"settings", "proposals"}
+			if id := str("proposal"); id != "" {
+				argv = append(argv, id)
+			}
+			return argv, nil
+		}
+		if str("module") == "" && on("propose") {
+			return nil, errors.New("settings: a module is needed to propose a layer; name it with module")
+		}
 		if list := str("list"); list != "" || str("module") == "" {
 			if list != "" && list != "preferences" {
 				return nil, fmt.Errorf("settings lists %q only; %q is not a listing", "preferences", list)
@@ -855,6 +870,22 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		var argv []string
 		switch {
+		case on("propose"):
+			// A proposal: the values, or clear, put to the operator (novox/hq ADR 0277). Nothing is set here.
+			argv = []string{"settings", "propose", str("module")}
+			switch {
+			case on("clear") && str("values") != "":
+				return nil, errors.New("settings: a proposal gives values or says clear, not both")
+			case on("clear"):
+				argv = append(argv, "--clear")
+			case str("values") != "":
+				argv = append(argv, str("values"))
+				if on("replace") {
+					argv = append(argv, "--replace")
+				}
+			default:
+				return nil, errors.New("settings: a proposal gives the values, or says clear")
+			}
 		case on("clear"):
 			argv = []string{"settings", "clear", str("module")}
 		case str("values") != "":
@@ -1447,7 +1478,7 @@ var commandReadForms = map[string]func(rest []string) bool{
 	"conditions": func(r []string) bool { return flagsOnly(r) || subIn(r, "list", "show", "history") },
 	"node":       func(r []string) bool { return subIn(r, "list", "show") },
 	"module":     func(r []string) bool { return subIn(r, "list") },
-	"settings":   func(r []string) bool { return subIn(r, "show", "preferences") },
+	"settings":   func(r []string) bool { return subIn(r, "show", "preferences", "proposals") },
 	"retire":     func(r []string) bool { return subIn(r, "list") },
 	"cleanup":    func(r []string) bool { return subIn(r, "list") },
 	"delivery":   func(r []string) bool { return subIn(r, "plan", "walks") },